The internet can often be described as the Wild West. A place where algorithms are explicitly designed to retain our ever-shrinking attention spans. Until now, Australia has relied on a largely reactive, co-regulatory model for online safety. Under this model, platforms largely set their own rules through industry codes. The system only kicked in once someone had already suffered harm. Many internet users are children, and all sorts of unfiltered content can reach them. Meanwhile, the platforms profiting from that content shrug and point to their Terms of Service.
Enter the Online Safety Amendment (Digital Duty of Care) Bill 2026. This legislation has alarmed governments overseas and divided the crossbench. It has also sparked widespread debate about government control and censorship online. So, what is the Bill designed to do, and should we be worried?
What the Bill Actually Does
The Bill amends the Online Safety Act 2021 (Cth) to impose a single overarching “digital duty of care”. This duty falls on anyone responsible for an online service. The core obligation is straightforward in principle, if not in practice. Operators must take appropriate action to ensure a safe online environment. This includes taking effective measures to mitigate the risks their own risk assessments identify.
The duty applies to internet carriage services, social media services, messaging services and hosting providers. It also covers search engines, app stores and equipment providers. It reaches designated internet services, which broadly covers most website operators, and services that use artificial intelligence to generate material. If you run an online forum, a community platform, or a content-hosting service, this Bill is speaking directly to you.
Speaking to the National Press Club on 15 October, Communications Minister Anika Wells stated: “We must shift the burden from the shoulders of victims to the companies that are creating the environments where harms occur.” That is the policy intent. The legal machinery underneath is considerably more complex.
The Bill creates three tiers of obligation:
- Seriously harmful material: child sexual abuse material, grooming, sexual violence, terrorism promotion, suicide encouragement, and explicit threats, among fifteen listed categories. This applies to all Australians. No one is arguing with this one.
- Material harmful to children: pornography, content promoting disordered eating, material that encourages or promotes “hostile attitudes towards women or gender equality”, material that glorifies crime or encourages dangerous stunts, and abuse, harassment or bullying. This applies only to under-18 users.
- Social media design features: for users under 16 must not have access to, or be exposed to, design features with negative behavioural impacts — recommender systems, endless feeds, engagement-feedback mechanics, and time-limited or “disappearing” content.
For users over 16, the Government intends to require platforms to offer a “following-only” feed. This feed shows only material from accounts the user has chosen to follow. The Bill itself does not contain that obligation. Instead, s 27A empowers the Minister to require “user empowerment tools” by legislative instrument. The Government set out the detail in a draft determination released on 15 October. Consultation on that draft runs until 5 November. Users can still keep their algorithmic feed. However, keeping it becomes an active decision rather than a built-in default. The intention is that platforms offer an alternative, not that they eliminate recommendation systems altogether.
What is changing for under-16s is more significant: certain design features must not operate for them at all. That includes the endless scroll, engagement metrics, and the recommendation engine. These are precisely the features that behavioural researchers and parliamentary inquiries into teenage mental health have repeatedly identified as architecturally problematic for developing minds.
Is this Government Censorship in Disguise?
You may have seen this one doing the rounds, including, notably, from the United States Embassy, whose September submission on the exposure draft warned that platforms would be “incentivized to over-moderate speech that should be protected to avoid regulatory penalties”, and said that if Australia compelled platforms to filter protected speech out of algorithmic feeds, the United States “would likely consider such a measure as facilitating censorship”.
The concern was initially not without foundation. The exposure draft gave the Communications Minister discretionary power to designate new categories of harm by legislative instrument, a power that, in less careful hands, could theoretically be used to suppress inconvenient political content.
The Government has since removed that power. Announcing the change on 15 October, the day the Bill was introduced, Minister Wells confirmed the designation power would be scrapped following cross-party pushback, acknowledging it had been “a clear stumbling block for other political parties”. Parliament, rather than a single minister, retains the authority to legislate further protections if new harms emerge. That is a meaningful safeguard, even if it does not entirely satisfy those with deeper concerns about the Bill’s definitional vagueness — concerns we turn to below.
Genuine Concerns about the Bill
Whilst the Government has spent considerable effort quashing rumours and reassuring the public, there are legitimate concerns that deserve honest examination.
- The “harmful to children” category is uncomfortably vague:
Content “promoting hostile attitudes towards women or gender equality” under s 25E(1)(c) sounds clear enough until you think about it in practice. Does a documentary critical of third-wave feminism qualify? Does a religious sermon? What about a true-crime series that examines misogynistic violence? The difficulty is not in identifying the intent — no reasonable person wants children radicalised into misogyny online — but in drawing a workable legal line between harm and legitimate discourse.
The Bill as introduced now carves out excluded material under s 25F. This includes professional news material and “material that is in the public interest”. That answers the complaint critics levelled at the exposure draft, but it raises another. The Bill nowhere says what makes material in the public interest. Platforms must answer that question in the first instance. They face a maximum civil penalty of $109.2 million per breach if they get it wrong. That gives them a strong incentive to err on the side of over-removal. In practice, platforms could quietly suppress legitimate journalism, satire and advocacy content touching on sensitive social topics. They would do so not because any minister ordered it, but because no platform wants to take the risk.
Australia has no national charter of rights against which to test these provisions. It also has nothing equivalent to the European Union’s Charter of Fundamental Rights or Digital Services Act. The Bill focuses on safety rather than rights. That gap combines with some vague definitions and the broad discretion the new model gives the eSafety Commissioner. Together, they create a real downstream risk for free expression. That risk has nothing to do with ministerial bad faith. It has everything to do with how cautious platforms respond to uncertain rules.
- The penalty structure is blunt
The UK’s Online Safety Act caps fines at the greater of £18 million or 10% of qualifying worldwide revenue, a graduated model that scales with the offender’s capacity. Australia’s flat $109.2 million cap, which bites per breach, cuts both ways: it is disproportionately severe for smaller or emerging Australian operators, and oddly lenient for the global giants it most needs to move. A $109.2 million penalty is an inconvenience in a quarterly earnings report for Meta. For a homegrown platform, it is an extinction event.
- Risk assessments will not be created equal
Every online service must produce a written risk assessment, updated at least annually and before any service change that might introduce new risk. Records must be kept for six years and produced to the eSafety Commissioner within 30 days of a request.
For Meta, Google, or TikTok, this is table stakes. They already employ armies of trust and safety professionals, legal teams, and compliance officers for whom this kind of documentation is routine. For an Australian start-up or a small community platform operator — think a regional news forum, a local gaming community, a not-for-profit support service — standing up that compliance infrastructure from scratch is a serious and ongoing resource burden. The obligation is equal; the capacity to meet it is not, and s 26A(3) expressly forbids taking the cost of compliance into account. The Bill does not adequately grapple with that asymmetry.
- Replacing legislative certainty with regulatory guidance
The Bill repeals the prescriptive industry codes and standards, some of which have barely been in force a year, replacing them after a twelve-month transition with a principles-based duty and eSafety Commissioner guidance. The Commissioner’s guidance is, by nature, less predictable than a legislative standard: it can be issued without consultation, revised without parliamentary oversight, and applied to conduct that operators reasonably believed was compliant at the time.
For compliance purposes, that creates real uncertainty about what “appropriate action” and “effective measures” require in any given context. And when you combine that uncertainty with the definitional vagueness discussed above, the risk of a chilling effect on legitimate speech becomes more tangible, not through deliberate censorship, but through the entirely rational decision by platforms to remove anything that sits in the grey zone rather than risk the penalty.
The Bigger Picture
The direction of travel is clear, and in many respects, overdue. The existing framework is reactive: someone must be harmed before the system kicks in. The new duty is proactive: platforms must identify and mitigate foreseeable risks before they materialise.
That shift in burden, from victim to platform, is nothing new. It mirrors obligations already imposed on employers, shopping centres, and sporting clubs. The novelty lies in applying the logic to services that operate at global scale and whose architectures have, by design, maximised engagement at the expense of wellbeing.
The Greens pushed the Bill to a Senate inquiry, which is due to report on 20 November, and their support is conditional on amendments including a right for individuals to sue platforms for harm. The Coalition opposes the Bill, with Shadow Communications Minister Sarah Henderson calling it a “dog’s breakfast”. Minister Wells is right when she says this is “the most compelling policy question of our generation” and that it is important “that we give it all the scrutiny it deserves”.
What the Bill still needs, before it reaches its final form, is real content given to the public interest exception it now contains, a graduated penalty structure that does not inadvertently crush domestic competitors of the very platforms it targets, and definitional clarity that gives platforms something more concrete to work with than “we’ll let you know”.
The digital duty of care is the right idea. The execution needs work.
Jake McKinley notes that this article is written for the purpose of providing generalised information and not to provide specialised legal advice. If you require qualified legal advice on anything mentioned in this article, our experienced team of solicitors at Jake McKinley are here to help. Please get in touch with us on 02 9232 8033 today to make an enquiry.
Article Written by Seb Hain, PLT
References:
Coote, W., Guyot, I., Bloch, V., Pracy, V., Yang, S., & McClelland, R. (2026, September 24). Australia’s “Digital Duty of Care”: What the draft bill means for online services. Allens. https://www.allens.com.au/insights-news/insights/2026/09/australias-digital-duty-of-care-what-the-draft-bill-means-for-online-services/
EducationHQ News Team. (2026, October 15). Minister stripped of discretionary powers in upcoming digital duty of care proposal. EducationHQ. https://educationhq.com/news/minister-stripped-of-discretionary-powers-in-upcoming-digital-duty-of-care-proposal-216074/
Sharma, Y. (2026, October 15). Government reveals exactly how social media algorithm opt-out will work. Nine. https://www.nine.com.au/australia-news/digital-duty-of-care-legislation-how-social-media-could-change-on-aussie-screens-20261015-p615tk.html
U.S. Embassy in Canberra. (2026, September 22). U.S. government response to the Australian consultation on the “online safety amendment (Digital Duty of Care) bill 2026”. U.S. Embassy & Consulates in Australia. https://au.usembassy.gov/u-s-government-response-to-the-australian-consultation-on-the-online-safety-amendment-digital-duty-of-care-bill-2026/
Parliament of Australia. (2026, October 15). Online Safety Amendment (Digital Duty of Care) Bill 2026 (Cth). Parliament of Australia. https://www.aph.gov.au/Parliamentary_Business/Bills_Legislation/Bills_Search_Results/Result?bId=r7553
