Before anything else: if you or someone else is in immediate danger, call 000. If a crime is involved (threats, extortion, stalking), report it to police via ReportCyber or your local station. The eSafety pathway below deals with getting content removed; it doesn't replace law enforcement.
With that said: the eSafety Commissioner is the single most underused removal pathway in Australia. It's a federal regulator with actual statutory takedown powers under the Online Safety Act 2021, the process is free, it's confidential, and it's designed to be used without a lawyer. For the categories it covers, it works faster and more predictably than anything else in this space.
The catch is the phrase "for the categories it covers". eSafety's powers are specific and deliberately bounded. Knowing whether your matter fits before you start saves weeks.
What eSafety can actually order removed
The Online Safety Act 2021 gives the Commissioner four reporting schemes, each with its own threshold.
Image-based abuse. Intimate images or videos shared, or threatened to be shared, without consent. This is the strongest scheme: it applies at any age, threats count even if nothing has been posted yet, and digitally altered images (including AI-generated ones) are covered. eSafety can issue formal removal notices to platforms and to the individuals who posted the material, and platform compliance typically lands within 24 to 48 hours when criteria are met. If this is your situation, our extortion and image-based abuse page covers the full response, including the police and platform pieces.
Cyberbullying of a child. Material targeting someone under 18 that is seriously threatening, intimidating, harassing or humiliating. The threshold is deliberately lower than the adult scheme. The process requires reporting to the platform first; if the material stays up, eSafety can compel removal.
Adult cyber abuse. Material targeting an Australian adult that both is intended to cause serious harm and is menacing, harassing or offensive in all the circumstances. Both limbs have to be met, and the bar is intentionally high: it's aimed at the worst end of online abuse, not at content that's merely hostile, rude or unflattering. As with the child scheme, you generally report to the platform first and escalate to eSafety if it stays up.
Illegal and restricted content. Child sexual abuse material, pro-terror content, and other class 1 material. Anyone can report this, no personal connection to the content required.
Where a removal notice is issued, services are required to comply within tight statutory windows, with civil penalties behind them. That enforcement weight is why platforms that ignore an individual's report often move quickly once eSafety is involved.
What eSafety can't do
This list matters just as much, because mismatched reports waste time you may not have.
eSafety has no power over defamation. False and damaging statements route through the defamation pathway with counsel; the explainer on what qualifies covers the elements.
It has no power over news articles. Journalism, however damaging, sits entirely outside the schemes. Articles route through editorial requests, the Press Council, legal pathways where grounds exist, or suppression. The decision framework in how to respond to a damaging news article covers the sequencing.
It has no power over negative reviews, hostile forum threads, or general nastiness that doesn't meet the serious-harm-plus-menacing threshold of the adult scheme. In practice most reputational content fails that test, and that's by design; the scheme was built for abuse, not reputation management.
And it doesn't order Google to delist things. Its notices go to the services hosting the content. Search results fix themselves once the underlying page comes down and the index updates, but residual problems (screenshots reposted elsewhere, copies on smaller sites, cached references) need their own work.
How the process actually runs
The mechanics are straightforward, and doing them in order strengthens the report.
First, collect evidence before anything disappears or gets deleted by the abuser: full-screen screenshots including the URL and date, the account names involved, and for image-based abuse any threats received. You won't be asked to send intimate images themselves; eSafety works from URLs and descriptions.
Second, for the cyberbullying and adult cyber abuse schemes, report to the platform first and keep proof of the report. The Act expects this step, and the platform's failure to act is part of what eSafety assesses. For image-based abuse you can go straight to eSafety.
Third, lodge the report at esafety.gov.au/report. The forms are plain-language and ask for the URLs, the evidence, and the connection to you (or to the child, for the cyberbullying scheme).
From there, eSafety investigates, and the practical experience is informal-first: in a large share of matters they obtain removal by working with the platform without needing to issue a formal notice. Where the service doesn't cooperate, formal removal notices follow with statutory compliance windows. Throughout, the process is confidential; reporting doesn't make the matter public.
For image-based abuse specifically, it's worth pairing the report with StopNCII.org, which creates a hash of the image on your device (the image never leaves it) and blocks re-uploads across participating platforms.
Where ORMA fits, and where we don't
Honestly: if your matter sits cleanly inside one of the schemes above, you may not need anyone. The pathway is free, self-service, and effective, and the assessment will tell you exactly that rather than sell you an engagement. Around a third of assessments end with us pointing people at the right free pathway.
Where paid work earns its place is around the edges of a takedown. Content that spreads across platforms and smaller sites outside the original notice. Screenshots and reposts that keep surfacing on searches for your name after the original is gone. The reputational residue of an episode that's resolved but still visible. That's coordination and search-side work, and it runs alongside eSafety and police processes, never instead of them. We don't provide legal advice, and we don't replace law-enforcement reporting; those come first.
If you're not sure which bucket your situation is in, start the assessment. It's free and confidential, you don't need to share the content itself, and within one business day you'll know whether the eSafety pathway applies, what to report and in what order, and whether there's any role for us at all.