Victoria's Plan to Unmask Online Trolls Has a Cyber Safety Expert Unimpressed

Key points

• The Victorian government announced plans in 2025 to let a state tribunal force social media companies to reveal the identity of anonymous abusive users.
• Parents suing tech firms over harm to children currently must prove at least 10 percent permanent impairment; the government wants to lower that bar.
• Cyber safety expert Susan McLean says social media companies already hand user identities to police on request through existing law enforcement portals.
• A nearly identical federal proposal by the Morrison government in 2021 failed to pass parliament and was criticised for being out of reach for ordinary people financially.
• The government has no stated plan for users who live overseas or hide behind a VPN, a service that masks a user's real location and identity online.

The Victorian government has announced it is drafting laws to force social media companies to reveal who is behind anonymous abusive accounts, and to make it simpler for parents to take big tech to court when their children are psychologically harmed online. Premier Jacinta Allan said the reforms would be introduced before the state election in November.

Under the plan, the Victorian Civil and Administrative Tribunal (VCAT), a state body that hears civil disputes, would gain the power to issue what the government is calling "demasking orders." Those orders would compel platforms to hand over the real identity of an anonymous user who has breached Victoria's anti-vilification laws, which ban speech that incites hatred or serious contempt toward a person based on attributes like race or religion.

The government also wants to lower the legal threshold for parents suing social media or artificial intelligence companies over psychiatric harm to their children. Currently, a parent must prove their child has suffered a permanent impairment of at least 10 percent before the courts will hear the case. That bar, the government says, will come down.

Does this change anything that isn't already possible?

Not much, according to Susan McLean, a former Victorian Police officer who now works as a cyber safety specialist. McLean told ABC News Australia that every major social media platform already operates a dedicated law enforcement portal, a secure channel through which police can formally request a user's account details. She pointed to cases involving AFL footballers who received serious online abuse, where police obtained the offender's identity and made arrests using existing processes.

"There is no such thing as an anonymous social media account," McLean said.

Her core criticism is that most victims simply never file a police report to begin with. Routing cases through VCAT instead, she argues, adds a civil legal layer without fixing that underlying problem.

The comparison to 2021 is worth noting. The Morrison federal government put forward a strikingly similar bill that year, also aimed at unmasking abusive users. It never passed. Legal experts at the time said ordinary people rarely had the money to pursue major tech companies through the courts even if they knew who had abused them.

Victoria's proposal carries a similar gap: the government has offered no explanation of how the rules would apply to users based overseas or to anyone using a VPN.

For anyone currently dealing with serious online abuse, McLean's advice is straightforward: report it to police directly. The mechanisms to identify abusers and pursue charges already exist. Using them is the first step.

The Victorian opposition said it broadly supported the proposal, though the shadow attorney general questioned whether the legislation would actually reach parliament in the four sitting weeks remaining before the election.