Victoria's Plan to Unmask Online Trolls Has a Cyber Safety Expert Unimpressed

Key points

• The Victorian government announced plans in 2025 to let a state tribunal force social media companies to reveal the identity of anonymous abusive users.
• Parents suing tech firms over harm to children currently must prove at least 10 percent permanent impairment; the government wants to lower that bar.
• Cyber safety expert Susan McLean says social media companies already hand user identities to police on request through existing law enforcement portals.
• A near-identical federal proposal by the Morrison government in 2021 failed to pass parliament and was criticised for being out of reach for ordinary people financially.
• The government has no stated plan for users who live overseas or hide behind a VPN, a service that masks a user's real location and identity online.

The Victorian government is drafting laws to force social media companies to reveal who is behind anonymous abusive accounts, and to make it simpler for parents to take big tech to court when their children are psychologically harmed online. Premier Jacinta Allan said the reforms would be introduced before the state election in November.

Under the plan, the Victorian Civil and Administrative Tribunal (VCAT), a state body that hears civil disputes, would gain the power to issue "demasking orders." Those orders would compel platforms to hand over the real identity of an anonymous user who has breached Victoria's anti-vilification laws, which ban speech inciting hatred or serious contempt based on attributes like race or religion. The government also wants to explore removing the impairment threshold entirely for adult victims, not just minors.

The proposed impairment threshold change matters practically. Currently, a parent must prove their child has suffered a permanent impairment of at least 10 percent before courts will hear the case. That bar will come down.

Does this change anything that isn't already possible?

Not much, according to Susan McLean, a former Victorian Police officer who now works as a cyber safety specialist. McLean told ABC News Australia that every major social media platform already operates a dedicated law enforcement portal, a secure channel through which police can formally request a user's account details. She pointed to cases involving AFL footballers who received serious online abuse, where police obtained the offender's identity and made arrests under existing processes.

"There is no such thing as an anonymous social media account," McLean said.

Her core criticism is that most victims never file a police report to begin with. Routing cases through VCAT instead adds a civil legal layer without fixing that underlying problem. She said it "beggared belief" that the government had chosen VCAT as the forum, adding: "I do not think for one moment this is going to fix anything."

That VPN gap is a thread we've pulled before. Our 13 July story on age verification for adult sites found Australian regulators already struggling to answer the same question: what happens when a user simply routes around the rules with a privacy tool? Victoria's proposal offers no answer either.

The Morrison federal government put forward a strikingly similar bill in 2021, also aimed at unmasking abusive users. It never passed. Legal experts at the time said ordinary people rarely had the money to pursue major tech companies through the courts even if they knew who had abused them. Victoria's proposal carries the same gap.

For anyone currently dealing with serious online abuse, McLean's advice is blunt: report it to police. The mechanisms to identify abusers already exist. Using them is the first step.

The opposition broadly supported the proposal, though shadow attorney general James Newbury questioned whether the legislation would actually reach parliament in the four sitting weeks remaining before the election.