Eighteen months is a long time in online safety. Since the Rickard Review was handed to the Minister, a child sexual abuse material scandal engulfed one of the world’s largest AI companies, the United Kingdom’s Online Safety Act came into force, and the EU’s Digital Services Act moved from principle to enforcement. Australia’s Digital Duty of Care has finally arrived — and for the most part, it has been worth waiting for. Two drafting choices and legacy artefacts give me pause, however. Left unaddressed, they could prove to be the flaws that swallow the Duty.
A solid foundation
The Department’s Issues Paper, released on 26 May 2026, sets out a draft framework that tracks closely to many of Rickard’s recommendations. There are important gaps, however, which may prove problematic for online safety regulatory cohesion down the track. All in all, however, the framework set out in the issues paper represents a solid and pragmatic starting point for legislating a duty of care, with caveats.
Government is proposing a statutory Duty of Care that would provide the basis for a range of secondary or delegated regulatory instruments. This is the right approach, as providing an overly prescriptive regulatory model within the primary legislation of the Online Safety Act 2021 would introduce brittleness and inflexibility. It is good to see that the Minister or eSafety Commissioner will be able to pivot to address new, emerging, or high priority harms through the creation of legislative instruments.
The Duty requires service providers to ‘maintain effective systems and processes’ that, in summary, provide a safe online environment for all Australians (as far as is reasonably practicable); prevent, monitor and ‘appropriately’ address content that is illegal or harmful to young people; and ensure the safety of ‘service features’. In this latter category, the Department has explicitly included ‘AI’, ‘algorithmic content recommendation and generation systems’, and ‘bot accounts’.
The focus on systems and processes is the right approach, avoiding a situation where the eSafety Commissioner becomes a funnel for each and every possible grievance users might have about the safety of online services. Conceptually, this maps to the logic of both the codes and standards under the OSA, as well as the Basic Online Safety Expectations.
This is an explicitly proactive duty, requiring ongoing assessment of the efficacy of safety features and an embedded risk assessment and mitigation process. An obligation to evaluate how effective processes are is a crucial distinction from the existing systemic instruments, and arguably one of the most crucial elements being proposed under the Duty.
It is pleasing to see that the Department has explicitly referenced the eSafety Commissioner’s Safety by Design principles (of service provider responsibility, user empowerment and autonomy, and transparency and accountability) as key to guiding development of the regulatory framework. Whether this commitment is legislated (unlikely) or expressed in the eventual Bill’s Explanatory Memorandum (more likely) remains to be seen.
A few other quick points. The paper suggests that the upper penalty quantum will be made ‘commensurate’ to offences under other legislation. The example given is the Competition and Consumer Act, where the ACCC was recently granted the ability to seek up to $100 million in civil penalties.
The final commitment is slightly murky, however, as the paper’s schedule notes ‘Support’ against Rickard’s recommendation 34, which proposes an increase to the maximum allowable penalty under the OSA topping out at $50 million or 5% of global turnover. Given that penalties for codes and standards non-compliance were upgraded to $50 million when the minimum age legislation was enacted, this issues paper could signal Government’s willingness to go even further.
Incentivising compliance through clear regulatory signals is highly effective, and has been one of the most puzzling shortcomings of the OSA, where the wealthiest companies in the world could comfortably snack on infringement amounts while not being required to admit liability.
Building on existing instruments and the question of what survives
Under both the Unlawful Material Codes and the Age-Restricted Material Codes registered by the eSafety Commissioner, certain services must conduct risk assessments and report on compliance with the codes. The Duty builds on these obligations, but adds an important rider requiring the best interests of the child to be taken into account when assessing and mitigating risks arising from the design and operation of their service, which is welcome.
eSafety will have access to a range of existing information-gathering and investigative powers to assess compliance, which is pleasing to see. Linking the Duty to a robust set of tools to obtain evidence, to remedy and deter non-compliance, and issue reporting notices is simply essential to success.
Such a link isn’t necessarily an inevitable outcome: in the rush to legislate other harm responses, notably the abhorrent violent material (AVM) amendments to the Criminal Code, the Government overlooked connecting eSafety’s role under that amendment to the s 27 functions in the OSA, rendering uncertain the OSA’s suite of powers to address AVM.
We will need to see where the rest of eSafety’s existing instruments shake out under a Duty of Care. The proposed reform potentially places the Codes and Standards on the pathway to redundancy if eSafety were minded to renew them after they expire, especially given their narrow applicability to class 1 and class 2 material (rather than the broader harms taxonomy suggested under the Duty).
It also calls into question the utility of the Basic Online Safety Expectations if the Duty provides a power for eSafety to compel information about compliance with the broad sweep of the Duty’s components, and to require periodic and non-periodic reporting.
Further casting the BOSE in doubt is that the proposed Duty takes two of the most powerful expectations under the BOSE and weaves them into its core logic. The first is the expectation that reasonable steps are taken to ensure end-users are able to use a service safely.
The second is that the provider of a service will take reasonable steps to ensure that the best interests of the child are a primary consideration in the design and operation of any service that is likely to be accessed by children. These are strong normative positions for the Government to express through the Duty — and reassuring to see.
A Liquorice All-Sorts harms taxonomy
Where I think the Department’s framework exposes itself to criticism and eventual weakness is in the harms taxonomy that is intended to address content that is illegal, or is harmful to young people.
As I’ve written elsewhere, the National Classification Scheme is completely inadequate, even inappropriate, for the regulation of online content harms. The issues paper specifically names three categories of ‘class 1’ material (see Part 9 of the OSA) that appear a priority under the proposed Duty: child sexual exploitation material, pro-terror material, and material instructing, inciting or promoting in crime and violence.
Confusingly, the issues paper also notes that specific categories of offences under the Commonwealth Criminal Code will be addressed under ‘illegal and harmful content’. These include causing or threatening to cause psychological harm, menacing and harassing communications, doxxing and stalking, image-based abuse and ‘cyber-flashing’, and hate crime offences.
Why not include the definition of ‘child abuse material’ contained in the Criminal Code, too? My personal view is that retaining the National Classification Code as the basis for assessing CSAM is, from a rights perspective if no other, utterly perverse.
This is because it requires an assessment of whether a ‘reasonable adult’ would find the description or depiction of a child offensive. Who cares what the reasonable adult thinks?
We have simple definitions of child abuse and child abuse material in the criminal statutes that centre on the victim, not whether some hypothetical construct finds offence. Let’s use them.
The illegal content harms taxonomy also includes content and activity that “presents a seriously harmful threat to Public Safety at an appropriate threshold that preserves individuals’ freedom of expression and free speech”.
Finally, we are provided a list of content that the Department regards as harmful to young people, including eating disorder material, content glorifying dangerous activities such as stunts or the promotion of crimes, online pornography and other material that is not appropriate for children such as self-harm and suicide content.
There isn’t much value in picking the eyes out of these categories yet, at least not until we see the draft Bill. However, I am concerned that introducing such a Liquorice All-Sorts taxonomy, made up of bits and pieces of the OSA, the Criminal Code, and a vaguely defined ‘Public Safety’ category alongside elements of eSafety’s Age-Restricted Material Codes will aggravate the Act’s already incoherent harms logic.
If a general commitment to ‘safety’ under the Duty is then accompanied by an assortment of loosely-defined and disconnected categories, the reform risks a content detection and compliance labyrinth.
Two drafting concerns that need to be resolved before the Bill proceeds
‘Reasonable and defensible basis’: an unusual threshold for the audit power
Of particular note in relation to the Duty is the creation of an audit power for eSafety. Such a power would be new for the online regulator, but would track similar powers granted to European counterparts under the Digital Services Act, and Ofcom under the UK’s own Online Safety Act.
The audit power would allow eSafety to direct that a provider source at its own expense an independent audit of how effective their systems and processes are in complying with the Duty. The threshold for an audit being required is where eSafety develops a ‘reasonable and defensible basis’ to believe the service was failing to systemically meet the Duty.
It is unusual to include ‘defensible’ as a threshold issue within statutory language. If this were to be translated wholesale into the OSA, it potentially places the eSafety Commissioner outside the conventional investigative logic that applies to other regulators seeking information.
For example, section 33C of the Privacy Act allows the Privacy Commissioner to assess various systemic matters relating to that Act’s operation. If the Commissioner has reason to believe that an entity has information or a document relevant to an assessment, the Commissioner can compel that information.
Similarly, section 155 of the Competition and Consumer Act provides that inspectors delegated by the Chair of the ACCC have a power to obtain information, documents and evidence relating to contraventions of the Act (and other instruments) if they have reason to believe that a person can furnish such information or documents.
Closer to home, section 63G of the Online Safety Act grants the eSafety Commissioner a range of information-gathering powers, including in relation to compliance with the age-restricted social media laws.
These powers are also based on the eSafety Commissioner establishing a reasonable belief (via a ‘reasonable grounds’ test) that an age-restricted social media platform has information relevant to compliance.
Beyond being misaligned with similar information-gathering powers, ‘reasonable and defensible basis’ creates a redundancy in construction. Australian case law deals with this question across a number of key judgments.
Perhaps most critically, the High Court held in 1990 that ‘reasonable grounds’ requires “the existence of facts which are sufficient to induce the state of mind [for example, a regulator’s reasonable belief] in a reasonable person” (George v Rockett). Crucially, this does not require definitive proof, but merely the existence of facts that support a reasonable belief — which of course would then be the basis for a further investigation to develop proof.
If ‘defensible’ is fused to ‘reasonable’, then the threshold would be something approaching the need to establish a prima facie case before eSafety can even start to investigate a service’s failure to comply with the Duty.
Whether a decision by the eSafety Commissioner to exercise an information-gathering power was ‘defensible’ in any given matter — i.e., whether it was the correct or preferable decision, or lawful — is already a question that the Administrative Review Tribunal can assess during a merits review, or the Federal Court through judicial review.
Hopefully, this is a flourish employed by the issues paper team at the Department, and not a signpost of drafting intent.
‘In good conscience’: jarring equitable echoes
Another odd term appears in the issues paper when describing the scope of the Duty. On page 2, we learn that services ‘will be required to act reasonably and in good conscience to prevent reasonably foreseeable harms from occurring’.
My concern is that ‘in good conscience’ if legislated could be inverted by a service resisting a civil penalties application commenced by the eSafety Commissioner to argue that what the construction intends is that only alleged breaches that are unconscionable are actionable.
To reach this threshold, presumably, would require the Commonwealth laying evidence of a lapse so egregious, and so intentional or reckless as to be beyond conscience.
Likely, this would also require proof that the platform’s systems and processes specifically and unconscientiously exploited the known vulnerabilities of a class of persons.
‘Good conscience’ is equity’s language, with a specific doctrinal home in unconscionable conduct — both under the unwritten law as articulated in Commercial Bank of Australia v Amadio, and the statutory provisions in the Australian Consumer Law (ss.20–22 of the ACL and their ASIC Act equivalents). Either pathway imposes a significantly heavier evidentiary burden on the Commonwealth than the straightforward reasonableness standard that governs the rest of the Duty.
As with the ‘reasonable and defensible basis’ problem, this looks like a drafting artefact — policy intent expressed in lay language that was not tightened up with a litigation eye.
Both phrases should be resolved before the Bill is introduced.
The technology architecture question: still unfinished business
My final concern is that the Government has not seen fit to address the technology mix question, as recommended by the Rickard Review. In my mind, this joins reliance of the Duty on the National Classification Scheme as the most anachronistic element of the OSA, which still employs service-level definitions (’social media service’, ‘relevant electronic service’, ‘designated internet service’ and ‘hosting service’) that were first declared more than a decade ago in the Enhancing Online Safety for Children Act 2015 (Cth).
Technologies have moved on significantly, and while the Duty deploys the more complete industry architecture set out in the Codes (which include device manufacturers, app store providers, search engine services and others), it doesn’t capture the ‘full stack’ as it claims to.
In its opening, the issues paper asserts that amendments enlivening the Duty will include “updating the proactive elements of the Act to embed safety by design and require systemic and preventative action by services ‘upstream’ of the kind of seriously harmful behaviour”.
But it’s not especially helpful to think about services as being ‘upstream’ from harms — they are the actual vector for harms, providing means and opportunity through their design to allow perpetrators to inflict damage.
Saying that the Duty will regulate those services is merely stating the obvious. What would be more helpful would be for the Government to commit to adopting a far more modern architecture of the broader ‘digital industry’.
This might involve employing the four broad categories recommended by Delia Rickard, which would cover all those referred to in the issues paper, but then include online infrastructure services (nameserver providers, CDN networks, DDoS mitigation services, domain name registry operators, and network operators) as a new focus.
By doing so, eSafety could actually move ‘upstream’ from the harms on services such as websites to put pressure on providers of larger networks that are relied upon by bad hosters to, for example, distribute child abuse material. The ‘Trichan Takedown’ orchestrated by the Canadian Centre for Child Protection and Professor Michael Salter is a useful case study for the utility of such a power.
The Digital Duty of Care framework is, in most respects, what Australia’s online safety regime has needed for a decade. The shift to proactive, systems-based obligations, backed by meaningful penalties and a genuine audit function, represents a step change in regulatory ambition.
But regulatory ambition only translates into regulatory effect if the legislative drafting is airtight. Two phrases in the issues paper — ‘reasonable and defensible basis’ and ‘in good conscience’ — are liable to create unnecessary complications given their doctrinal shift. Platforms with deep legal resources will find them, and they will use them. The drafters have time to fix both before the Bill is introduced. They should.