With the Digital Duty of Care now before the Australian Parliament, and a Senate Inquiry around the corner, there is still time to fix the broken bits.
Yesterday, Primary Purpose Advisory lodged a submission to the Senate Environment and Communications Legislation Committee’s inquiry into the Online Safety Amendment (Digital Duty of Care) Bill 2026. I want to set out what we argued, and why.
Overall, this is a Bill worth supporting. It represents a watershed moment in Australian online harms regulation. But there are things that need fixing, and our view is that if they aren’t then the framework’s promise is blunted.
The duty is needed, and now
More than a decade of work against internet-borne threats to Australians has made one thing clear: piecemeal notice and takedown is no longer enough. Child sexual abuse material, child cyberbullying, adult cyber abuse, image-based abuse, sexual extortion and terrorist propaganda are produced and distributed at a pace and scale that defies elimination item by item. Recent advances in artificial intelligence are only accelerating that, in shape, scale and volume.
Complaints and removal schemes will always matter to individual Australians who need help. But durable reductions in harm require services to be designed and operated safely in the first place. That is what the digital duty of care does. By requiring those responsible for an online service to ensure a safe online environment, the Bill places responsibility where it belongs: with those who design, operate and profit from these services.
The duty reflects the core principles of Safety by Design. It is backed by risk assessments that must be conducted before significant changes to a service, age assurance and access controls, and coverage of AI services that generate material. I’m especially pleased to see s 28A, which lets the eSafety Commissioner require information about how a service’s algorithms recommend, restrict or moderate material, and when human review is triggered. At a moment of real concern about how AI companies respond when users disclose suicidal intent or abuse to chatbots, knowing when a human is brought into the loop is essential.
The Bill also retains and strengthens the transparency powers from the Basic Online Safety Expectations, and gives eSafety more robust powers to compel information and examine witnesses.
Where the duty falls short
Verification. The most significant gap is the missing audit power. In May, the Department’s Issues Paper committed to a power for eSafety to direct a service to procure an independent audit, at its own expense, of whether its systems and processes comply with the duty. That power was recommended by the Rickard Review and supported by Government. It does not appear in the Bill.
Without it, eSafety has no means to independently verify what industry tells it. Transparency that cannot be verified depends entirely on the honesty or candour of the party being regulated. That was always the core weakness of the BOSE, and the Bill risks perpetuating that weakness. Enforceable undertakings are no substitute. This is because an audit term depends on the provider agreeing to the condition, and arises only once eSafety already holds a prima facie case. Our submission recommends restoring the audit power, with annual audits mandatory for higher-risk services. Failing that, senior officers should at least be required to attest to responses to key notices. Attestation is a far weaker safeguard, but it is better than nothing.
Emerging harms. The Bill’s Exposure Draft allowed the Minister to declare new categories of seriously harmful material by legislative instrument. That power has been removed. The result is a framework that can respond to new services, design features and tools, but not to new forms of seriously harmful material or conduct, such as sadistic online extortion or synthetic child sexual abuse material, without amending primary legislation. Concerns expressed by the Opposition about ministerial overreach can be met with sensible safeguards: sunsetting, review requirements, disallowance and parliamentary committee scrutiny. Removing the power altogether is the wrong answer.
Classification. The Bill repeals the industry codes and standards, yet keeps the Online Content Scheme’s dependence on the National Classification Scheme to define class 1 and class 2 material. That Scheme was built in 1995 for professionally produced films, publications and games released commercially. As Rickard put it in her Review, it is not workable as the basis for regulating vast volumes of dynamic, fluid and even ephemeral online content. She recommended decoupling the two. Disappointingly, the Government merely noted the recommendation.
With the codes and standards gone, the case for keeping the link is very hard to sustain. The Bill already defines seriously harmful material in s 25D, which overlaps substantially with class 1. Redefining class 1 by reference to a subset of s 25D would be a relatively straightforward drafting exercise. Meanwhile, the new age assurance and access control obligations arguably make the class 2 restricted access system redundant.
There is a related problem in the “excluded material” carve-out at s 25F. Classified films and games produced for entertainment are excluded from the definitions of harm. On its face, that would exclude classified X18+ and R18+ pornography from material harmful to children. And because Refused Classification is itself a classification decision, RC material, including pro-terror content, could arguably fall within the exclusion too.
User empowerment. Section 27A bars the Minister from considering content when requiring user empowerment tools, yet defines those tools by reference to control over recommended content. Let’s ensure that content is relevant to giving users – especially younger users – control over their feeds. Some forms of harmful content, like eating disorder material, are subtle, cumulative and accrete over time. Allowing finetuning over that content may be precisely why a tool is needed.
Resourcing. Finally, the Bill’s Explanatory Memorandum says the Bill will have only a “minor” financial impact. That is hard to square with the scope of eSafety’s new functions, the 12-month window to build new capability, and rising litigation exposure. It is also hard to square with the Minister’s own comments about the resourcing the duty requires. We have recommended a published costing, increased funding before Schedule 2 commences, and consideration of an industry cost-recovery model.
On sock puppet identities and eSafety’s work to combat illegal content
No part of the Bill has attracted more misplaced alarm than the power to use “sock puppet” identities. Having led online harms investigations for well over a decade, I can explain why this power matters.
Social media services are gregarious matchers. One user searches for and then visits someone’s profile and the algorithm may suggest the two as potential friends. For investigators looking into an image-based abuse perpetrator from a personal or official eSafety account, they risk alerting that person to the existence of an inquiry. That can mean lost evidence, risks to the investigator and, if a complaint has been made in a family violence context, potential danger to the victim-survivor and their children.
The sock puppet power also matters to testing services. To remove a nudify app under the new s 86B, eSafety must be satisfied the app was designed predominantly to generate fake nude material, and that can’t be established without testing it. If eSafety can only use identifiable accounts, services can simply serve compliant results to those accounts. Similarly, eSafety is expressly provided power under s 205K(2) to test whether AI systems can generate illegal material. Neutral testing, untainted by attributable accounts, is the only way to see what users actually see.
Nor is investigating child sexual abuse material some new, unsanctioned frontier for eSafety as some commentary has asserted. eSafety has done this work since 2015, and the Australian Communications and Media Authority before it, in close partnership with the AFP and the global INHOPE network. In 2023–24 alone, eSafety handled almost 14,000 complaints, 82% concerning child sexual abuse material. Thousands of referrals are made by eSafety in any given year to INHOPE to achieve rapid removal of abuse material globally, and data shared with INTERPOL to help identify and rescue victims.
The Bill limits the power to eSafety’s functions and the activities set out in s 205K, requires policies developed with the AFP, and mandates annual public reporting. If more oversight is wanted, confidential annual reporting to the Commonwealth Ombudsman would be a sensible addition.
The digital duty of care can be a genuine step forward. With these fixes, it would be a far stronger one.