Australian Federal Court upholds online safety rnforcement against X Corp
X Corp argued that it was not legally bound to comply with the notice because it had absorbed Twitter Inc. through a merger and was not the original recipient.
The Federal Court of Australia has dismissed X Corp’s appeal against the eSafety Commissioner in a case that tested the enforceability of Australian online safety obligations across corporate restructures involving foreign platforms. The Court upheld the validity of an infringement notice issued under the Online Safety Act 2021 (Cth), confirming that X Corp, as the legal successor to Twitter Inc., was responsible for responding to a compliance notice issued before the merger.
The matter arose in February 2023 when the eSafety Commissioner issued a Reporting Notice to Twitter Inc., seeking information on the platform’s compliance with basic online safety expectations during the previous year. Following a corporate merger in March 2023, Twitter ceased to exist and was absorbed into X Corp, a Nevada-based company. Later that month, X Corp submitted a report to the Commissioner. However, the report was found to be incomplete or misleading, leading to the issuance of an infringement notice in October 2023. The notice alleged ongoing non-compliance for each day from 29 March to 5 May 2023 and sought cumulative penalties amounting to $610,500.
X Corp challenged the infringement notice, arguing that it was not legally obligated to comply with a notice originally addressed to Twitter, and that the merger had severed any such responsibility. It also contended that the notice was invalid for failing to specify the place of contravention and that it had been granted an extension of time to respond.
The Court rejected these claims. It found that, under Nevada law, Twitter’s regulatory obligations were transferred to X Corp as part of the merger. By applying Australia’s Foreign Corporations (Application of Laws) Act 1989, the Court determined that foreign corporate status and liabilities should be interpreted according to the law of incorporation. It accepted the opinion of an expert in corporate mergers that the Nevada statute governing mergers included both monetary and non-monetary obligations in the definition of liabilities, including regulatory duties such as those imposed by the Online Safety Act.
The Court also concluded that the infringement notice’s omission of the “place” of contravention did not render it invalid, as X Corp had not suffered any prejudice. Moreover, the correspondence from the Commissioner after the original response deadline was interpreted as a follow-up inquiry rather than a formal extension of the reporting deadline.
This decision carries significant implications. It affirms that Australian regulators can hold foreign entities accountable for regulatory duties, even after mergers or restructures. It strengthens the eSafety Commissioner’s ability to enforce compliance with the Online Safety Act and clarifies that formal defects in infringement notices will not defeat enforcement unless they impair the recipient’s ability to respond. The case provides a reference point for future disputes involving global platforms and cross-border application of domestic safety regulations.
