The proposed digital duty of care is an undemocratic and draconian government power grab that would crush freedom of speech on the internet
The purpose of this submission is to share analysis of the exposure draft of the Online Safety Amendment (Digital Duty of Care) Bill 2026 (exposure draft). The analysis is informed by earlier IPA research on the digital duty of care concept that identified how it would place an extraordinary burden on freedom of speech online by imposing a vague and subjective standard of harm and by incentivising over-compliance among internet services faced with heavy penalties and an over-zealous regulator.
Analysis of the exposure draft reaffirms these earlier findings. Overall, IPA analysis of the exposure draft highlights the dangerous amount of discretionary power this duty will grant the Minister for Communications and the eSafety Commissioner to curtail what Australians can say and see on the internet. Specifically, the analysis finds:
- The proposed “safe online environment” provisions would give the minister almost limitless power to control content on the internet.
- The different treatment of adult harms and child harms will in practice mean the restrictive childproof settings will become the standard for all users.
- The proposed “design features” provisions would give the government extraordinary powers to dictate how content is discovered and distributed on the internet.
- The combination of broad discretionary powers and heavy penalties mean that online services will over-comply and converge on extra-restrictive standards.
- The wider political context of the bill reaffirms the dangers of political censorship.
These problems follow from the extraordinarily broad application of the digital duty of care. Section 26 of the exposure draft imposes a general duty and three additional mandatory requirements on all “person[s] responsible for online services”. Online services include news and general interest websites, social media platforms, AI tools, and even hosting services and data centres (s 25A). Because the duty applies across such a vast and diverse domain, it entails extensive government discretion over its specific effects. These administrative decisions will have limited parliamentary oversight, meaning reduced transparency and accountability. This problem is inherent in the regulatory approach of imposing a single duty across the internet, meaning that the digital duty of care cannot be rescued by changes to the proposed laws.
The exposure draft confirms the digital duty of care is draconian – in its motivations, intended effects, implementation, and governance. It would severely curtail the ability of Australians to speak and to access information on the internet. The exposure draft must be withdrawn.
The proposed “safe online environment” provisions would give the Minister almost limitless power to control content on the internet
The federal government has emphasised the impact the digital duty of care will have on the design features of online services, such as algorithmic recommendations for users. However, the intended outcome of the proposed digital duty of care is that each online service should be a “safe online environment”, a standard that is defined primarily in terms of harmful “material and conduct” – that is, content. (As discussed below, even the obligation (at s 26(3)) upon online services to “manage design features… appropriately” is defined in relation to how that management achieves the overarching intent of the duty, i.e., a safe online environment.)
This is a problem, because the exposure draft gives the federal government almost limitless power to expand the range of harms covered by the safe online environment obligation. The clearest examples of this are the powers given the Minister, at s 25C(2) and s 25D(2), to add new kinds of “seriously harmful material and conduct” (from which all users must be protected) and “material or conduct harmful to children” (from which children must be protected). Given the strength of these powers, the safeguards on them are plainly inadequate:
- The Minister need only be satisfied that the content may cause serious harm. The Minister is under no obligation to base his or her decision on evidence; indeed, there is no requirement that there be any evidence that the harm is real rather than hypothetical.
- That these determinations are disallowable legislative instruments provides only imperfect parliamentary oversight. A senator or member must give notice of disallowance within just 15 sitting days of tabling, after which the relevant house has 15 sitting days to dispose of the motion. This places the initial political onus on opponents.
- The statutory definitions of “serious harm” (at s 5 of the Online Safety Act 2021) and “harm” (at s 25E) are broad and place few limits on how the concept of harm may be used by the Minister to target content online.
In addition to these powers to add new harms, the harms listed in the exposure draft at ss 25C(1) and 25D(1) are sometimes vague and require subjective interpretation (even as many are facially uncontroversial). For example, content covered by s 25C(1) includes anything that “promotes… a criminal offence,” which would include the various speech-related offences across Australia’s nine jurisdictions, and might even apply to news websites, documentaries, films etc. in their portrayals of crime and criminals. Similarly, s 25D(1)(c) defines as harmful to children “material or conduct that encourages or promotes hostile attitudes towards women or gender equality”. This provision may mean that children should not access information about traditional gender roles, including those rooted in religious belief, depending on how “hostile” and “equality” are understood. The inclusion of such a politically loaded provision can also be taken as an indicator of the kinds of harms that ministers may add using these powers.
The different treatment of adult harms and child harms will in practice mean the restrictive childproof settings will become the standard for all users
The exposure draft’s definition of a “safe online environment” refers to two separate types of harm – “seriously harmful material and conduct”, which applies to all Australians including adults, and “material that is harmful to children” specifically (s 25C and s 25D).
The interaction of these two sets of harms (for all users and for children) will likely have a further restrictive effect on free speech by making online services choose between age-gating or childproofing. As with the social media minimum age, users may have to prove they are not children to access content that is legal but deemed harmful to children. So, for example, a search engine may need to deploy age verification to give users a fuller set of results. Alternatively, some services may find it easier to childproof rather than age-gate. That is, the most efficient means of meeting the digital duty of care might be to restrict material for adult users as well. Among the online services for whom this might be the easier option are general interest websites (for whom the cost of age verification may not be worthwhile) and services that have no direct contact with end-users and so have little to no visibility of who is accessing what content, like hosting services.
Given the extraordinary scope of the digital duty of care, these differential standards for adult and child users of online services create a powerful incentive for childproofing to become the default across much of the internet. Yet either age-gating or childproofing would have implications for adult users: childproofing would restrict adults’ access to lawful material (including, say, religious teachings about gender roles), while widespread age-gating would place a new condition on adults’ ability to access and participate in lawful online activity, including speech and political communication.
The proposed “design features” provisions would give the government extraordinary powers to dictate how content is discovered and distributed on the internet
Political discussion about the digital duty of care has focussed on the harms of design features, like algorithmic social media feeds. The exposure draft proposes to impose three obligations on online services in respect of design features:
- For all users, section 26(3)(a) obliges online services to manage design features appropriately, including by providing “user empowerment tools” that would give users some control over how those features operate.
- The safe online environment standard (s26(1)) also includes two design features obligations: at 25B(1)(b)(ii), that children are protected from “harms associated with the operation of design features” and, at s 25B(1)(c), that social media services ensure that “design features of the service that have negative behavioural effects do not operate for children in Australia who have not reached 16 years of age.”
The relevant design features are defined at s 25F and include functions like recommender features (that shows content to users) and endless-feed features (that shows content with no “end-point”). Section 25G stipulates that the listed design features are taken to have negative behavioural impacts and that the Minister can determine other design features to have the same.
Importantly, the exposure draft aims at both the inherent harms of these design features (like addiction or compulsion) and their role in distributing harmful content. For all users, including adults, the concept of inherent harms is addressed indirectly through the mandatory requirement to make available user empowerment tools and the obligation, per s 26A, for online services to consider “all reasonably foreseeable risks” including those that “rise” from design features. This obligation is related to the general duty to provide a safe online environment, and that means that design features must be considered in connection to the harmful material and conduct from which users must be protected – that is, whether these features operate in a way that assists in protecting users from these kinds of content.
This reading is reinforced by the fact that neither “harms associated with the operation of design features” nor “negative behavioural impacts” are defined or given substance, and that these two terms have limited application anyway: the former applies only to child-related safe online environments, the latter only to under-16s on social media services.
The Minister would also wield a discretionary power to “require specified online services to provide specified user empowerment tools” that “may be specified by reference to any matter” (ss 26(4-5)). This power is not limited by any requirement that the Minister consider evidence or even seek advice from the eSafety Commissioner. In practice, then, the Minister could direct services about the settings options that must be available to users, how those settings are accessed and displayed, or even what kinds of content are affected by which design features. In other words, the regulation of design features includes regulation of the content that design features make available and visible to users.
One important consequence of this structure is that, while users may be given some additional control over, or reduced exposure to, the effects of certain design features, whatever settings they choose, the services will nonetheless have to be safe, meaning that they protect users from harmful content. Users will not readily be able to access or share content that is not safe, and as such, their experience of using the internet will be substantially shaped by how the bill defines the harms that safe online environments must protect them from. In short, no matter what settings users choose, they will not be able to turn off the digital duty of care itself.
The combination of broad discretionary powers and heavy penalties mean that online services will over-comply and converge on extra-restrictive standards
The broad and often nebulous powers discussed above are supported by a governance regime that is designed to strongly incentivise over-compliance by online services erring on the side of caution regarding what content and design features they permit and deploy.
Heavy penalties and a regulator armed with far-reaching investigatory powers provide a strong incentive to over-comply. Per s 26B, failure to comply with the digital duty of care (including any of the mandatory requirements) carries a maximum penalty of more than $20 million, rising to over $100 million for bodies corporate. Per s 26D(3), the same penalty applies to failures to comply with remedial directions from the Commissioner. It also expands the investigatory powers of the Commissioner, including the power to summons any persons who might have information relevant to compliance with the digital duty of care; these persons will have to give evidence under oath and self-incrimination will not be a reason to refuse giving evidence (ss 198–205). These provisions might apply to children with information relevant to compliance.
The risk of severe regulatory penalties is compounded by a burdensome and ambiguous risk-based regulatory framework which requires online services to “conduct risk assessments” and “take effective measures to address those assessments” (ss 26(3)(b-c)). All online services would be obligated to anticipate all reasonably foreseeable risks to users from their content, design features, and systems, and, in writing, evaluate their likelihood and magnitude, and measures taken to address them, along with anything else the Commissioner may prescribe. Failure to do so constitutes a breach of the duty. Moreover, compliance is expected to be proactive. Online services must anticipate possible harms – including any not listed in the exposure draft or in legislative instruments – and then police those harms themselves.
These onerous yet uncertain requirements will require interpretation by eSafety, including about whether all “reasonably practicable” measures have been taken. In turn, online services will likely welcome guidance from the regulator about meeting their regulatory obligations. In sum, the regulatory regime obliges online services to implement their best guess as to what the digital duty of care requires, under the threat of severe penalties.
Finally, not only will each online service be incentivised towards over-compliance, but the effect will also be reinforced across the internet. Because the services all interact with one another, they will have an interest in converging on common standards – for example, so that hosting services and app stores can be assured of their clients’ compliance. Indeed, this tendency is encouraged by the exposure draft, which provides that the Commissioner: may issue guidelines (s 26E); can exercise his or her powers to promote “industry best practice” including ordering services to publish information about their online safety steps, transparency reporting, and to inform people about online safety (s 192C, s192M); and, importantly, determine “standards, benchmarks or other metrics” that online services must use in their risk assessments (s 26A(2)(f)). Thus, online services are incentivised to adopt, in effect, a single restrictive standard that Australian internet users will not be able to escape.
The wider political context of the bill reaffirms the dangers of political censorship
The political context of the digital duty of care gives extra weight to concerns that the powers contained in the exposure draft will be used to silence the government’s opponents.
The Prime Minister and the Minister for Communications have both repeatedly connected the recent success of One Nation to social media and “algorithms”. Additionally, passage of the proposed laws will likely require the support of the Greens in the Senate, two of whom have recently said directly that part of their interest in the digital duty of care is to limit the effect of algorithms on “amplifying” One Nation’s messages and a wider “war on democracy”. Going further, there is evidence that demand for this kind of law has been seeded by the government: the idea of the digital duty of care was being promoted by the eSafety Commissioner as early as 2018, while IPA analysis has revealed that some ostensibly independent groups promoting the idea are substantially funded by government.
These matters suggest that if the digital duty of care becomes law, its application will extend far beyond the categories of harm listed in the exposure draft – it lays the groundwork for an unprecedented censorship machine.
Kind regards
Dr Andrew Bushnell
Senior Fellow and Director, Law and Freedom Program
