A new digital duty of care for all online service providers 10 min read
On 8 September 2026, the Commonwealth Government commenced consultation on an exposure draft of the Online Safety Amendment (Digital Duty of Care) Bill 2026 (the Draft Bill). If passed as is, the Draft Bill would completely overhaul Australia's online safety regime and introduce a new statutory digital duty of care (the Duty).
The Duty will repeal and replace all existing Standards and Industry Codes prescribed under Division 7 of Part 9 of the Online Safety Act 2021 (Cth) (OSA), as well as the Basic Online Safety Expectations (BOSE). In their place, the Duty will be inserted into the OSA and become the single overarching compliance obligation for in-scope online services. Some of the Codes being repealed have barely been in force a year.
The proposed online safety reforms would operate in parallel to the upcoming Privacy Act reforms and Children's Online Privacy Code (COPC). Together, they represent a fundamental shift in how Australia regulates its online environment, marking a pivot from co-regulation to direct regulation of online safety in Australia.
The reforms have already drawn sharp criticism, including from US President Donald Trump, whose administration warned it would likely view the laws as 'facilitating censorship'. The Australian Government has allowed just 18 days for submissions on the Draft Bill. Given the attention the reforms have garnered (including globally), significant refinements are likely before it reaches Parliament.
Key takeaways
- Broad application: This is not a 'big platforms only' reform. The Duty means anyone responsible for an online service will need to ensure, so far as is 'reasonably practicable', that they provide a 'safe online environment'. A breach carries a maximum penalty of approximately $100 million.
- Greater flexibility: On the face of it, repealing prescriptive Industry Codes and Standards should give online service providers greater flexibility in implementing controls that minimise harm. However, the eSafety Commissioner is unlikely to accept controls any less robust than those of the existing framework.
- Greater uncertainty: The Draft Bill would create a framework fraught with subjectivity and uncertainty about both the harms the Duty seeks to prevent and the controls providers must implement. Under the new regime, the eSafety Commissioner's guidance and the Minister for Communications’ exercise of discretionary powers will carry even greater weight.
- Online providers will need to review and strengthen their risk management frameworks. The reforms will require online providers to reassess (and for some providers, assess for the first time) the risk of harm arising from use of their service, particularly harm to children.
- Higher bar for social media services to protect under-16s. Social media service providers should be aware that under the proposed reforms, it will no longer be sufficient to simply take reasonable steps to ensure under-16s are prevented from holding social media accounts. They will also need to ensure that – as far as reasonably practicable – certain design features do not operate for children under 16. In practice this means: (i) none of these features can operate in a logged-out state; and (ii) the 'reasonable steps' bar is effectively raised to 'as far as reasonably practicable'.
How did we get here?
Australia's current online safety framework is a reactive co-regulatory model comprising a complaints-based takedown scheme, industry-drafted Codes and Commissioner-issued Standards, and the non-binding BOSE.
The Government's Issues Paper on a Digital Duty of Care (Issues Paper), published in May 2026, committed to legislating a digital duty of care to prevent serious online harms. The framework was informed by consultation conducted between late 2025 and early 2026 and was a key recommendation of the Statutory Review of the Online Safety Act 2021 (February 2025).
The Draft Bill marks a deliberate shift towards a proactive, outcomes-focused model, imposing a single overarching duty on online services to identify and mitigate risks of harm before they materialise.
Who is captured?
This is not a 'big platforms only' reform. The Duty captures 'online services' including social media, messaging, designated internet services (ie, many website operators), hosting providers, search engines, app stores, and equipment providers tied to those services. It also captures AI tools that let users generate and share content.
The Duty applies to: (i) service providers; and (ii) anyone in a position to exercise day-to-day control of the service. Given the extra-territorial application of the OSA, this captures overseas entities operating services available to Australians.
The Minister may exempt an online service (or class of services) from aspects of the Duty by legislative instrument if it is satisfied that the service poses little risk to Australian users or has minimal use in Australia. There is no general small-business carve-out, and the drafting suggests this is not a reform targeted solely at big platforms.
What is the digital duty of care?
The Duty requires that anyone responsible for an online service ensures, so far as is 'reasonably practicable', that they provide a 'safe online environment'.
The Duty does not apply to lawful private communications solely between consenting adults. By implication, it will apply to private communications solely between minors or between adults and minors. The narrowness of this exception may require providers to implement broader age assurance measures and/or actively monitor chats and messaging.
Proposed amendment
'Reasonably practicable' means that which is, or was at a particular time, reasonably able to be done, taking into account and weighing up all relevant matters, including:
- the likelihood and severity of the harm occurring;
- what the person knows, or should reasonably know, about the risk and how to eliminate or minimise it;
- the availability and suitability of ways to eliminate or minimise the relevant risk;
- the cost of eliminating or minimising the risk, including whether that cost is grossly disproportionate to the risk (noting that cost may be 'grossly disproportionate' to a risk where the cost is high but the likelihood and severity of harm are low); and
- the privacy impact on a reasonable person, including whether that impact is grossly disproportionate to the risk.
In practice, the Duty is intended to be discharged by appropriately managing design features, undertaking risk assessments, taking measures to address those assessments, and reporting obligations.
Implications
- The principles-based 'reasonably practicable' standard (which replaces the more prescriptive Industry Codes and Standards) creates flexibility at the cost of certainty. For example, the RES (Age-Restricted Material) Code establishes that gaming service providers who enable end-users to play an R18+ game that contains 'simulated gambling material' must implement age assurance and access controls. However, it is unclear how the existing restriction on 'simulated gambling material' will carry through into the new Duty.
- We expect that the eSafety Commissioner will offer detailed guidance on the gap created by the repeal of Industry Codes and Standards. However, this will take time and we expect online service providers will therefore need to assess, build and demonstrate their own 'safe online environment' well ahead of any such guidance.
- In the meantime, it is unclear whether organisations that now comply with a registered Industry Code, Standard or the BOSE will satisfy the Duty. Given the breadth of the Duty, we expect they will not.
- Regulatory guidance is less predictable than legislative Standards or the Industry Codes, as it can be issued outside of any consultation or legislative process and can change without oversight.
Proposed amendment
A 'safe online environment' comprises three elements:
- Seriously harmful material and conduct: a list of harmful material and conduct applying to all Australians, broadly similar to the Unlawful Material (Phase 1) Codes and Standards. It covers child sexual abuse material and grooming, sexual violence, extreme violence or cruelty, promotion of terrorism, encouragement of serious harm or suicide, and explicit threats of physical harm.
- Material and conduct 'harmful to children': a broad, subjective and non-exhaustive category applying only to under-18 users. It includes pornography, material promoting disordered eating, hostile attitudes towards women or gender equality, glorification of crime, dangerous stunts, and abuse, harassment or bullying.
Note: The Draft Bill also allows the Minister to determine what constitutes 'seriously harmful material and conduct' and material harmful to children. - Social media service-specific harm: social media services must prevent – 'so far as reasonably practicable' – under-16s from accessing specified design features (including recommender systems, logged-in-only functionality, endless feeds, engagement-feedback mechanics and time-limited content) deemed to have a negative behavioural impact on children. This new requirement would operate alongside, and impose a materially higher bar than, the existing 'reasonable steps' test under the social media minimum-age framework (Part 4A of the OSA). It would, in effect, require these features to be switched off by default for under-16s.
Implications
- The 'harmful to children' category is extremely broad and contains descriptions of harms that are inherently more subjective than the 'seriously harmful' list. Providers will have to make difficult judgment calls on areas of legitimate political, religious, cultural and social debate. This limb has attracted significant political criticism.
- There are no public interest exceptions (eg, for journalistic content), unlike the United Kingdom's Online Safety Act 2023, which includes such protections. Providers will need to rely heavily on the eSafety Commissioner's guidance to apply these concepts consistently.
Proposed amendment
The Draft Bill presumes that certain design features carry 'negative behavioural impacts' for all users, including:
- algorithmic recommender systems;
- endless feeds;
- logged-in-only functionality;
- feedback mechanics; and
- time-limited (ie, disappearing) content features.
Implications
- Including these design features in a service triggers a requirement to offer user empowerment tools – ie, tools allowing users to manage how those features operate. Practically, the Government expects individuals will be able to 'switch off' certain algorithmic features.
Proposed amendment
Persons responsible for online services must produce a written risk assessment covering harm posed by the service in Australia. The assessment must identify all reasonably foreseeable risks (including relevant design features and affected persons), assess likelihood and severity, document mitigation measures in place or proposed, evaluate their effectiveness, and provide for regular review and reassessment. These obligations go well beyond risk assessment requirements in the current Industry Codes and Standards.
Risk assessments must be conducted at least annually and before any service change likely to introduce new risk. Records must be kept for at least six years and provided to the eSafety Commissioner within 30 days of a request.
Implications
- Although risk assessments are not novel under the OSA, the scope of what is proposed is remarkably broad: the 'harm' to be considered is not limited to harms in the 'safe online environment' definition but extends to any harm.
- This will impose ongoing compliance burdens irrespective of a service provider's size, maturity, or risk profile. It will potentially require dedicated compliance resources, enhanced documentation and greater coordination between product, legal, trust and safety, and risk teams.
Proposed amendment
Breach of the Duty (or an associated remedial direction) carries a significant civil penalty of up to 60,000 penalty units (approximately $100 million) per breach.
The Commissioner may also issue infringement notices for a breach, carrying penalties of up to 600 penalty units (approximately $218,000) per breach.
Implications
- The 60,000 penalty unit maximum applies as a flat cap regardless of the provider's size, revenue or market position.
- Unlike comparable international regimes, the Draft Bill does not adopt a graduated or revenue-linked penalty model. For example, the UK's Online Safety Act 2023 permits fines of up to the greater of £18 million or 10% of worldwide revenue.
- A flat cap of this nature risks being disproportionately severe for smaller or emerging Australian service providers.
Interaction with ongoing reforms: the Children's Online Privacy Code
The Draft Bill lands alongside the Office of the Australian Information Commissioner's draft COPC (which we reported on here). Both apply to the same core universe of digital services and both single out children for extra protection. The Draft Bill focuses on content and conduct 'harmful to children' and design features with negative behavioural impacts, while the COPC imposes a 'best interests of the child' test on collection, use and disclosure of children's personal information, including restricting default settings to what is 'strictly necessary'.
Together, these reforms will require many providers to fundamentally redesign their service to either: comply with each regime as though all users are children; offer a differentiated service for adult and child users; or restrict children's access altogether.
Next steps and further considerations
The Draft Bill remains the subject of consultation. Given the publicity that the Draft Bill has attracted, significant modifications are likely before it reaches Parliament.