The digital duty of care: Australia’s comprehensive overhaul of online safety laws

Australia's new digital duty of care Bill

• The Australian Government plans to overhaul Australia's online safety laws with a new "digital duty of care" as part of the Online Safety Amendment (Digital Duty of Care) Bill 2026. This is a major change to Australia’s online safety laws. The duty will affect most businesses operating online in some way, not just big platforms.
• The duty shifts regulation away from reacting to harmful content through removal notices and the co-regulatory regime of online safety codes and standards, towards managing the risk of harm proactively.
• The Australian Government is confident it will pass the Bill in late November 2026. The Bill passed the House of Representatives with amendments on 28 October and is now before the Senate. A Senate Committee is accepting submissions on the Bill and will report by 20 November 2026. Once the Bill is passed, the duty is expected to have a 12-month transition period.
• The Bill changed significantly during recent consultations, and we expect further significant changes before it becomes law.
• The duty is untested and introduces novel concepts. We expect the regulator and online services to test the boundaries of the new obligations and the regulator’s investigation and enforcement powers.
• In this article we highlight, what you need to know, and take a closer look at key elements of the digital duty of care.

What you need to know

• Understanding the regulator is vital: The regime heightens expectations on the eSafety Commissioner to take meaningful action and gives the Commissioner wide scope to shape obligations through non-binding guidance and remedial directions. To develop a compliance strategy, you need to understand eSafety’s expectations, priorities and strategies.
• A faster runway for regulatory action: eSafety has extensive transparency, information-gathering and enforcement powers. Organisations need to assess regulator notices quickly, make decisions and respond. Beneath the headline civil penalty of A$109.2 million sit a mid-level penalty of A$10.92 million (eg for failing to comply with certain regulator notices) and infringement notices of A$218,400. eSafety can question individuals under oath (failure to comply can result in 12 months’ imprisonment) and issue remedial directions. While eSafety is expected to take a graduated approach to enforcement, the regime allows rapid escalation, and eSafety can commence civil penalty proceedings without first using other options.
• Risk management is central: Failing to conduct risk assessments attracts the same maximum penalty as breaching the digital duty of care. To get ahead of a fast-changing risk environment, you need the capacity to identify existing, new and emerging foreseeable risks, to assess them quickly, and to take effective mitigation measures. Product launches and change processes require reviews that "close the loop" to avoid risks being identified but left untreated.
• Getting your first risk assessment right: The Minister has said that services complying with current codes and standards "will be well placed to comply" with the duty. However, services must assess all existing services against a new framework and standard, with new requirements about what to consider and document. The Minister has indicated that obligations for "low risk" services will be minimal, through guidance, eSafety determinations and Ministerial exemptions that do not currently appear in the Bill itself. Businesses will need to revisit existing legal advice and compliance assessments across product and service portfolios. Getting the first risk assessment right, and setting up consistent global review processes for product launches and updates, will simplify longer-term compliance and establish defensible practices.
• Cost is irrelevant: In deciding whether the duty requires an action or mitigation measure, cost must not be taken into account. Removing cost from the equation departs significantly from normal risk management practice. Proportionality to the risk of harm remains one of the mandatory factors.
• AI is treated as a high-risk feature: The explanatory materials cite features that rely on or interact with AI as examples of high-risk features, and the Bill expressly calls out generative AI as a specific regulated category of service. Relevant controls may include pre-deployment testing, safeguards on prompts and outputs, and post-deployment monitoring.
• Flexibility and uncertainty will give rise to legal challenges: The Bill introduces novel concepts and broad regulatory tools. eSafety has shown it is willing and able to make use of its broad powers and take significant action that challenges regulatory limits. eSafety and industry will inevitably test the boundaries of the new obligations and powers, and courts will settle them.

A closer look at the proposed digital duty of care

What is the digital duty of care?

We unpack what this means below.

Who does the digital duty of care apply to?

• The duty applies to a very broad range of online services (including social media, app stores, websites, hosting services, search engines, internet access supplied to the public, and others). It expressly extends to generative AI services and to equipment manufacture, supply, maintenance and installation services. It does not apply to State or Territory authorities or agencies that provide or control an online service.
• The "person responsible" for an online service includes the provider of the service and (except for equipment services) the person exercising the greatest degree of day-to-day control of it. This could draw a broader range of persons into regulatory action.

Are there exemptions to the duty?

• The Minister can exempt online services from one or more provisions, but only where the Minister is satisfied the service (or class of services) poses little risk to users in Australia. For example, a service could be subject to the duty but exempt from conducting risk assessments. Exemptions can be conditional.

What does a "safe online environment" mean?

A "safe online environment" is one in which:

• Adults and children in Australia are protected from seriously harmful material and conduct: This concept covers 15 defined categories, dealing with issues such as child exploitation, grooming, non-consensual fake nude and intimate images, terrorist and violent extremist content, sexual and gender-based violence, explicit threats of physical violence, and encouraging serious Commonwealth offences. Lawful age-restricted materials (class 2 materials under Australia’s content classification laws) are excluded. The list is exhaustive and cannot be expanded by the Minister or eSafety, other than by Parliament changing the laws.
• Children under 18 years are protected from material and conduct harmful to children. This is a broader concept, covering any material or conduct that may cause serious harm to children, including a non-exhaustive list of areas such as pornography, disordered eating, hostility towards women and gender equality, content glorifying crime or encouraging dangerous stunts or seriously harmful practices, abuse, harassment or bullying.
• Children under 18 years are also protected from harms associated with access or exposure to design features of online services. "Design features" are not exhaustively defined, but will extend to recommender features, endless feeds, engagement feedback, and time-limited features, whether or not a user is logged in.
• For social media services only, children under 16 years must not have access to, or be exposed to, design features with negative behavioural impacts: recommender features, "logged-in features" (endless feeds, feedback features and time-limited features available only with an account), and any other features the Minister determines.
• Further exceptions are discussed below.

User empowerment tools and algorithmic recommendations

• The Minister may require online services to provide tools that let users manage how design features operate. The Government is already consulting on a "My Feed, My Way" determination that would require services recommending user-generated content to let users choose a "following-only" feed, containing only material from accounts the user follows (plus advertising).

What is an "appropriate action", and does cost matter?

• In deciding whether an action is "appropriate" (and therefore required by the digital duty of care), the matters to consider include:
  • the extent to which it achieves or would achieve a safe online environment;
  • for seriously harmful material, the nature of the material, the extent to which exposure to it would be inconsistent with a safe online environment, and the extent to which the action may reduce the risk;
  • for material harmful to children, the nature of the material, the extent to which children’s exposure to it would be inconsistent with a safe online environment, and the extent to which the action may reduce the risk;
  • the impact on the security of the online service; and
  • whether the action is proportionate to the risk (likelihood and degree of harm).

• The cost of an action must not be taken into account. Explanatory materials justify this on the basis that, on a large platform, even a small percentage of harms can significantly affect Australians (although the duty applies well beyond large platforms).
• These mandatory considerations are not exhaustive, and other factors might be relevant in appropriate cases. This departs from current online safety codes and standards, some of which explicitly require consideration of matters such as human rights (including freedom of expression), provider capacity and technical limitations (including encryption and other information security measures).

What are the new risk assessment requirements?

• Services must conduct risk assessments at least annually (or more often if eSafety requires) and before making significant changes that could introduce new or additional risks. Assessments must cover "reasonably foreseeable risks".
• The duty includes implementing "effective" measures to mitigate the risks those assessments identify. Whether a mitigation measure is "effective" turns on the same factors as whether an action is "appropriate" (discussed above), and again cost must not be taken into account.
• Risk assessments must:
  • Identify reasonably foreseeable risks, and the material or conduct, design features and other systems or processes that give rise to them, and the people who may be affected.
  • Assess their likelihood and severity.
  • Document the measures implemented to address them, with an assessment of their expected effectiveness.

• Assessments must also provide for regular review and reassessment of the measures’ effectiveness, meet any additional requirements eSafety determines, be retained for at least 6 years, and be given to eSafety within 30 days of a request. The Explanatory Memorandum says routine software updates or security patches that do not materially change a service’s safety or key characteristics are not intended to trigger reassessment.
• Obligations scaled to risk? The obligation applies to all online services (unless exempted), but what is required is expected to scale with risk. eSafety can set requirements for assessments, and the Minister has said that "the extent of a service's obligation, including the need to conduct a full risk assessment, and the level of detail required will vary as determined by the eSafety Commissioner". The Minister indicated that services self-assessed as "low risk" (eg those without user-to-user interaction, user-generated content or recommender systems) will have minimal obligations but must reassess before significant changes. These arrangements are not in the Bill and will likely appear as part of eSafety's determinations.

What are the exceptions?

• Private communications: The duty does not require action on lawful communications occurring in private solely between consenting adults (which would exclude large group chats, unlawful or non-consensual communication, and communication involving children). This exception is significantly narrower than the exceptions in current codes and standards.
• "Excluded material": A "safe online environment" will not extend to protecting people from certain "excluded material", such as research material, literary, artistic or educational material that is not contrary to the public interest, public health and safety and harm reduction material, and any other material that is in the public interest. In addition, entertainment content on on-demand program services or content classified under Australia’s classification schemes is excluded material. User-generated content in computer games is not excluded.
• "Professional news material" is material that reports, investigates or explains issues or events relevant to public debate and democratic decision-making, or current issues or events of public significance or interest. To be "professional", it must be produced by a person who publishes news online, is subject to specified journalistic codes (or analogous editorial standards), and is editorially independent from the subjects of its coverage.

What transparency mechanisms are in the Bill?

The Bill also introduces new transparency mechanisms, including:

• Information about features, systems and processes: eSafety can require information about how a service’s features, systems or processes work (including recommendation and moderation algorithms and when human review occurs), or give a nominated person access to the service to report to eSafety.
• Transparency notices: eSafety can require transparency reports on compliance, harms and safety measures, and require classes of services to publish safety information (such as risk assessments, mitigation measures, content moderation, staffing, complaint volumes and account suspensions).
• "Sock puppet" accounts: eSafety and approved safety researchers can create false "sock puppet" identities to observe and test online services. eSafety must publish an annual statement on its sock puppet activities.
• Data access for researchers: Data access rules can require online services to give approved researchers (employed by Australian universities) access to data for approved online safety research.

When will the digital duty of care commence? 

The duty will commence after 12-month transition period, which has been framed to allow for guidance to be produced and providers to ensure that they are compliant with the new regime. However, some changes (such as significantly higher penalties for other online safety obligations and changes to content take-down and link deletion powers) will take effect immediately.

Current online safety codes and standards remain in force until then, but penalties for non-compliance with standards, or with directions from eSafety (in relation to codes) increase to A$109.2 million in the meantime.

Other changes

The Bill also makes a range of other online safety changes, including:

• Age assurance and access control: New requirements to ensure appropriate age assurance measures and access control measures are put in place to prevent access by children to pornography or material that describes or depicts specific fetish practices (replacing age assurance requirements that were put in place under recent age-restricted material online safety codes).
• Fake nude material: eSafety may require app distribution services and internet search engine services to remove apps, links, advertising or access for end-users in Australia if those apps or websites are predominantly designed or being used for generating fake nude material. Failure to comply within 24 hours attracts a civil penalty of up to A$10.92 million.
• Removal and link deletion notices: Significant changes to content removal regimes for cyber-bullying, cyber-abuse and intimate images.
• Complaints and disputes: Prescribed online services (to be determined by eSafety after consultation with the Privacy Commissioner) must have complaint and dispute processes available equally to all individuals in Australia (whether or not they are users), and comply with any requirements eSafety determines.

Next steps

The Government intends to pass the legislation before the end of November 2026, with the duty commencing after 12-month transition period.

Consultation is also open on the proposed "My Feed, My Way" Rule, which would require social media services to offer users a choice of feeds. eSafety may publish non-binding guidelines on how the digital duty of care operates, and enforcement priorities, which will likely address the transition from existing codes and standards.

The Bill faces heavy scrutiny. The Coalition opposes it, calling it a blank cheque for political censorship. The Greens have called for a right for individuals to sue platforms directly and penalties tied to global revenue. At the National Press Club on 15 October 2026, the Minister signalled possible changes, including a private right of action (potentially opening the gates to individual claims and class actions), as well as discussing regulator resourcing and free speech concerns – rejecting claims that the duty targets individual posts or misinformation.

As well as monitoring the Bill’s progress, online service providers should use the time before the legislation commences to review the tools and governance they use to manage safety risks, including whether those tools are likely to be “appropriate” under the new duty.

Part of a developing online risk environment

Regulators and litigants worldwide are scrutinising online services as never before. The digital duty of care is just one part of a global trend of increased regulatory and civil action we are seeing in relation to child safety, online safety and digital platforms. 

In Australia, we have:

• new private class actions related to online safety, inspired by US litigation. Australian actions will likely rely on existing technology-agnostic causes of action such as negligence or the Australian Consumer Law.
• a new Children's Online Privacy Code to be registered under the Privacy Act by the end of the year, introducing fundamental reforms for online services for or involving children.
• a second tranche of Privacy Act reforms expected to shift from prescriptive compliance to a more holistic "fair and reasonable" data handling requirement, bringing similar flexibility and uncertainty to the proposed digital duty of care.
• social media minimum age laws, for which the penalties were recently doubled, and which the digital duty of care partly and intentionally duplicates. The Minister has said a breach of both could attract cumulative maximum penalties of over A$200 million. 

Want to know more?

• Data Bytes AU: Key Australian privacy updates so far in 2026 (15 October 2026)
• The kids are online – what Australia's Children's Online Privacy Code means for you (8 May 2026)
• Australia Privacy Act Reform 2026: Tranche 2 Key Changes (7 September 2026)

Authors: Geoff McGrath, Partner; Nick Perkins, Partner; Andrew Hilton, Counsel; Imogen Loxton, Senior Associate; Ragul Sivaram, Graduate and Cindy Nguyen, Graduate.