- within Cannabis & Hemp, Accounting and Audit and Insolvency/Bankruptcy/Re-Structuring topic(s)
The Australian Government has released a long awaited exposure draft of the Online Safety Amendment (Digital Duty of Care) Bill 2026 (Exposure Draft), proposing a major overhaul of Australia’s online safety regime.
At the centre of the reforms is a new statutory digital duty of care that would require a broad range of online service providers to proactively protect users from online harms. If enacted, the reforms would move Australia away from its current co-regulatory approach and towards a model based on statutory obligations enforced by the eSafety Commissioner.
Public submissions are open on the Exposure Draft until 22 September 2026.
Key takeaways:
The Exposure Draft signals a significant shift in Australia's online safety framework. Rather than relying primarily on industry codes and standards, the proposed regime would impose proactive and enforceable obligations on online service providers to identify, assess and mitigate online harms.
Although the proposed digital duty of care framework is not intended to commence until 12 months after Royal Assent, organisations should begin considering its impact now. In particular, businesses should assess:
- whether their services fall within the expanded definition of an online service;
- the adequacy of existing risk assessment and governance processes; and
- how platform design features may be evaluated under the proposed framework.
Given the breadth of the reforms and the substantial penalties proposed for non-compliance, organisations operating across the online services ecosystem should closely monitor the consultation process and begin preparing for a significantly more prescriptive regulatory environment.
What is the proposed digital duty of care?
The proposed duty would require persons responsible for an online service to ensure, so far as is reasonably practicable, a safe online environment for users. Responsibility would extend not only to the provider of a service, but also to any person able to exercise day-to-day control over that service.
The duty is framed as an outcomes-based obligation. A ‘safe online environment’ would require providers to address the following outcomes:
- for all users: protection from serious harms, including content involving illegal sexual material, violence, terrorism, drug use, or material that encourages or instructs self-harm;
- for children: protection from:
- harmful content including pornography, disordered eating content, hostile attitudes towards women and dangerous stunts; and
- harms arising from platform design features, including recommender algorithms, infinite scrolling, visible engagement metrics, and disappearing content.
The Exposure Draft also proposes additional restrictions for social media services by prohibiting certain design features with ‘negative behavioural impacts’ for users under 16 years of age. These changes complement the existing social media minimum age framework and would be accompanied by a significant increase in penalties for non-compliance. The Exposure Draft also contemplates the eSafety Commissioner advising the Minister on emerging categories of harm, exemptions for online services and types of harm.
What would providers need to do?
In addition to the outcomes-based obligations, the proposed duty is also supported by specific mandatory compliance obligations. These include:
- Risk assessments - providers would be required to undertake written risk assessments addressing reasonably foreseeable online harms associated with their services. This would include risks arising from content, platform design, systems and operational processes. Assessments would need to be reviewed at least annually, revisited before service changes that could introduce new or additional risks, retained for six years and provided to the eSafety Commissioner on request.
- User empowerment tools - Ministerial power to require specified online services to offer tools that give users greater control over how services operate, including tools that allow users to influence, or ‘switch off' recommended/algorithmic content and platform experiences.
- Take effective measures - providers would be required to take effective measures necessary to address the risk assessments.
- Abide by remedial directions - the eSafety Commissioner will gain the power to issue remedial directions where the Commissioner reasonably believes a person has failed, or is failing, to comply with the digital duty of care. The direction may require a person to take action specified by the Commissioner directed towards ensuring the person does not fail, or is unlikely to fail, to comply with the duty in the future.
Who does the proposed duty of care apply to?
While much of the existing public debate has been focused on social media platforms, the proposed framework extends to a wide range of services across the online ecosystem, including:
- social media platforms;
- messaging services;
- internet carriage services;
- gaming services;
- hosting providers;
- search engines;
- app distribution services;
- AI services; and
- certain hardware manufacturers, installers and suppliers.
Consequences for non-compliance
The Exposure Draft proposes significant penalties for non-compliance. Breaches of the digital duty of care (or a remedial direction by eSafety to take specified actions to comply) could attract penalties of up to 60,000 penalty units (up to $21.84 million for individuals, or $109.2 million for corporations).
Other proposed changes
The Exposure Draft also includes a number of broader changes to the Online Safety Act, including:
- Repeal of BOSE and the industry codes / standards: The proposed reforms indicate a shift away from the existing co-regulatory framework towards a more direct statutory model centred on the digital duty of care and stronger enforcement powers.
- Increased penalties and enhanced enforcement powers: The Exposure Draft would increase many existing penalties, with most maximum fines doubling to more than $21 million (up to $109.2 million for corporations).
- Extending infringement notice and compliance powers: The eSafety Commissioner would gain broader powers to issue warnings, require remedial action, compel the production of information, require attendance for examination and pursue civil penalty proceedings.
- Formalised transparency regime: The eSafety Commissioner would be able to require providers to prepare transparency reports covering compliance activities, online harms, moderation practices, risk mitigation measures and performance against specified standards or benchmarks.
- Publication of information: The eSafety Commissioner would be able to require providers to publicly disclose online safety and operational information on the provider’s website.
- New data access scheme for researchers: The reforms also propose a new statutory framework designed to facilitate research into online safety risks.
- “Sock puppet” provisions for eSafety and researches: The eSafety Commissioner and approved researches will have the ability — and a wide immunity — to false identities for the purposes of carrying out activities in relation to online services (e.g., investigations).
- New regime for ‘fake nude material’: A targeted framework would prohibit certain apps and websites designed for, or predominantly used to generate, non-consensual deepfake intimate images.
- Accelerated content removal timeframes: Compliance periods for a number of existing takedown and removal notice regimes would be reduced from 48 hours to 24 hours, significantly increasing the speed at which providers must respond to harmful content.
- Expanded link deletion notice powers for search engines: The Commissioner would gain new powers to require search engines to remove links to cyberbullying material targeting children, cyber-abuse material targeting adults, and intimate image abuse material, in addition to the existing powers relating to Class 1 material. The reforms also substantially increase penalties for non-compliance with link deletion notices.
- For prescribed online services, a dispute and complaints mechanism that complies with the Commissioner’s requirements.
What next?
We will monitor the status of the Exposure Draft.
In the meantime, entities should consider whether there are any practical issues they wish to raise on the Exposure Draft by the due date of 22 September 2026.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
