Australia's digital duty of care reforms: new obligations for online platforms and AI services

The Federal Government has released the Exposure Draft of the Online Safety Amendment (Digital Duty of Care) Bill 2026 (Digital Duty of Care Bill), which would introduce a new statutory digital duty of care for a broad range of online service providers.

The proposed reforms form part of the Government's broader online safety agenda following the enactment of Australia's social media minimum age reforms. Prime Minister Anthony Albanese has stated that the Digital Duty of Care Bill is intended to "put the onus on digital service providers to provide a safe online environment, setting minimum standards for the features and tools they use".

Consistent with that objective, the Digital Duty of Care Bill would:

• introduce a statutory digital duty of care for online service providers;
• expand the powers of the eSafety Commissioner;
• impose new transparency and reporting obligations;
• establish data access arrangements for approved researchers; and
• introduce additional safeguards aimed at protecting children online.

The key elements of the exposure draft are summarised below.

Digital Duty of Care

At the centre of the proposed reforms is a new digital duty of care requiring providers of specified online services to, as far as reasonably practicable, ensure a safe online environment.

The duty would apply broadly to a range of online services, including social media services, internet search engines, app distribution services, hosting services, AI content and generation services.

The Digital Duty of Care Bill targets certain platform design features that are taken to have negative behavioural impacts, including:

• recommender systems;
• infinite scrolling functionality;
• engagement metrics such as likes and views; and
• disappearing content features, (together, Design Features)

The concept of a safe online environment contemplates an environment in which:

• persons in Australia are protected from seriously harmful material and conduct;
• children in Australia are protected from material and conduct that is harmful to children, and harms associated with the operation of Design Features; and
• for social media services, Design Features that have negative behavioural impacts do not operate for children in Australia under 16.

In addition to the overarching obligation to ensure a safe online environment, to comply with the digital duty of care, service providers would be required to:

• manage platform design features, including providing ‘user empowerment tools’ which would allow users of an online service to manage the way design features of the service operate for that user (for example, by providing control over the kind of content that is recommended for the user);
• conduct written risk assessments identifying reasonably foreseeable online harms; and
• implement effective measures to address identified risks. The proposed risk-based framework is qualified by the concept of what is 'reasonably practicable', requiring service providers to consider factors such as the likelihood and severity of harm, available risk mitigation measures, costs and privacy impacts.

Protecting children online

A key focus of the Digital Duty of Care Bill is the protection of children online. The proposed reforms would not only require providers to protect children from harmful content and conduct, but also to manage risks arising from the Design Features.

The exposure draft identifies a range of content and conducts that may be harmful to children, including pornography, content promoting disordered eating, bullying and harassment, and content glorifying crime or dangerous conduct.

Importantly, the exposure draft proposes that social media services must ensure that Design Features do not operate for Australian children under the age of 16.

Expanded eSafety Commissioner powers

The Digital Duty of Care Bill would also significantly expand the eSafety Commissioner's regulatory and enforcement powers.

Transparency and reporting obligations

The Commissioner would be able to compel the production of information and documents and require providers to prepare transparency reports relating to the safety of their services.

Take-down and link deletion powers

The Digital Duty of Care Bill would introduce a range of new enforcement mechanisms aimed at facilitating the rapid removal of harmful material. These include powers to:

• require app stores and search engines to remove apps or websites predominantly used to generate fake nude material;
• issue link deletion notices requiring search engines to remove links to certain harmful content;
• issue remedial directions requiring providers to address compliance concerns; and
• issue removal notices requiring apps, websites and related content to be removed within 24 hours or such longer period as the Commissioner permits.

Penalties

The Digital Duty of Care Bill proposes significant civil penalties for non-compliance.

Maximum penalties include:

• 60,000 penalty units per breach of the digital duty of care and certain remedial directions; and
• 6,000 penalty units per breach of transparency reporting, complaint handling, data access obligations and link deletion requirements.

At the current value of a Commonwealth penalty unit ($364), certain contraventions could attract penalties exceeding $21.84 million per breach.

Broader regulatory context

The Digital Duty of Care Bill reflects a broader trend, both in Australia and internationally, towards increased accountability for digital platforms.

In Australia, the Digital Duty of Care Bill should be considered alongside the Government's recently proposed reforms to the Privacy Act 1988 (Cth) (which we wrote about here, including the proposed fair and reasonable test and children's privacy measures. The Digital Duty of Care Bill is also consistent with the direction of regulation with regard to the Exposure Draft of the Privacy (Children’s Online Privacy) Code 2026 (which we wrote about here).

Many of the Design Features regulated by the Digital Duty of Care Bill, particularly those relating to recommender systems and algorithmic content delivery, rely on the collection, analysis and use of personal information. As a result, the practical compliance burden for many online service providers may ultimately be driven as much (if not more) by the proposed privacy reforms as by the digital duty of care itself.

What organisations should do now

The public consultation process on the exposure draft will close on Tuesday 22 September 2026.

Although the Digital Duty of Care Bill remains in exposure draft form, affected organisations should begin evaluating their risk assessment processes, product features, product design governance and compliance frameworks ahead of the reforms being finalised.