Is Tor legal in Australia? What the law says

As of November 2026, using Tor is legal in Australia: we found no Australian law that bans it. But phone and internet providers must keep metadata about their customers’ communications for two years,^[1] police have warrants aimed at crime on the dark web,^[2] and offences such as accessing child abuse material apply whatever browser you use.^[3]

Does Australia’s data retention law record Tor use?

Under the Telecommunications (Interception and Access) Act, phone and internet providers have had to keep a set list of “telecommunications data” since 13 October 2015. Often called metadata, it covers who the subscriber is and their account details, the source and destination of each communication, its date, time and duration, its type, and the location of the equipment used. Most of it must be kept for two years, and subscriber details until two years after the account closes. Providers must encrypt what they keep.^[1]

The law also says what providers don’t have to keep: the content of communications and, in the Act’s words, “subscribers’ web browsing history”.^[1] With Tor, a provider can’t see which sites you visit in the first place.^[4] By default it can see that you’re using Tor, though connecting through a bridge reduces that risk.^[5]

Agencies use retained data heavily. Under section 178 of the Act, an authorised officer of an enforcement agency can approve access to existing telecommunications data if satisfied that it’s reasonably necessary to enforce the criminal law.^[1] The government describes this data as information about a communication, such as who called whom and for how long, but not its content.^[6]

In 2024–25, 21 enforcement agencies made 364,868 authorisations to access existing telecommunications data, including 59,076 for illicit drug offences.^[6]

What does the Assistance and Access Act mean for Tor?

The Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018, which became law on 8 December 2018, lets agencies seek help from “designated communications providers”. A technical assistance request asks for voluntary help. A technical assistance notice requires help a provider can already give, and a technical capability notice can require help a provider may not yet be able to give.^[6][7]

The definition of provider is wide: it covers anyone who “develops, supplies or updates software” used with an electronic service that has end-users in Australia. But no request or notice may require a provider to build a “systemic weakness” or “systemic vulnerability” into a form of electronic protection, which the Act says includes building a new decryption capability.^[7]

Requests and notices are confidential: disclosing information about one without authorisation is generally an offence.^[7] The government’s annual report gives totals. In 2024–25, police forces and the Australian Criminal Intelligence Commission (ACIC) made 58 voluntary requests and issued no compulsory notices. Those figures don’t cover intelligence agencies.^[6]

What police powers target the dark web?

In August 2021, Parliament passed the Surveillance Legislation Amendment (Identify and Disrupt) Bill. It gave the Australian Federal Police (AFP) and the ACIC three new powers: to modify or delete data to frustrate offending, to collect intelligence on criminal networks, and to take control of suspects’ online accounts. The government said network activity warrants would cover “the most harmful criminal networks operating online, including on the dark web and when using anonymising technologies”.^[2]

These warrants must be issued by an eligible judge or a nominated member of the Administrative Review Tribunal, who has to be satisfied that they’re proportionate. As of November 2026, the powers are due to lapse at the end of 4 September 2029 unless Parliament renews them.^[8]

How have Australian police dealt with Tor sites?

Queensland Police’s Task Force Argos, a child-protection unit, has more than once taken over child-abuse sites on the dark web to find their users. In 2014, its investigators secretly took control of The Love Zone, which had more than 45,000 members when police closed it, and identified several hundred offenders around the world. Detective Inspector Jon Rouse told the ABC in 2016 that there were still “significant boards on TOR”.^[9]

In October 2016, after US Homeland Security agents arrested the creator of Childs Play, a dark-web child-abuse forum with about a million registered profiles, Argos took the site over. It ran the forum for 11 months to gather information on its users, then shut it in September 2017. CBC News, which notes that the dark web is reached through Tor, reported that critics questioned the ethics of keeping the site running.^[10]

What’s still illegal when you use Tor?

The offences in Tor cases are about conduct. Under the Criminal Code, using a “carriage service” (a phone or internet service) to access, send or share child abuse material carries up to 15 years in prison. Creating, running, moderating or promoting an online service meant for those offences carries up to 20 years. Importing illegal drugs is an offence too, however they were bought.^[3]

Do you need a bridge in Australia?

A bridge isn’t only for getting around blocks. By default, anyone watching your traffic can see that you use Tor, and connecting through a bridge reduces that risk.^[5] Our guide to Tor Browser explains how bridges work, and on a phone, see Tor on iPhone and Android.

A bridge doesn’t make you anonymous, though. If you sign in to an account or give your details, that site knows who you are, and the Tor Project says perfect anonymity is generally impossible, even with Tor.^[5] For other countries, see Is Tor legal? A country-by-country guide, including our pages on India and China.