New digital duty of care for Australian online services announced

If enacted, the reforms would impose proactive obligations on a broad range of online service providers to prevent foreseeable digital harms and promote safer online environments.

The exposure draft legislation would expand the objectives of the Online Safety Act and require regulated providers to identify risks, conduct assessments, implement mitigation measures, and report on the effectiveness of those measures. The proposed DDoC would also extend to risks arising from AI systems, recommender algorithms and other product design features.

The framework would replace Australia's existing online content regulatory model, which is based on industry codes, standards and non-binding basic online safety expectations, with a systems-based obligation requiring providers to maintain a safe online environment "so far as is reasonably practicable". A 12-month transition period would apply after commencement.

The proposed regime would be enforced by the eSafety Commissioner, whose powers would expand significantly. The regulator would be able to issue warnings and remedial directions, compel the production of risk assessments and transparency reports, and pursue civil penalties of up to A$109.2 million (approx. US$77.8 million), or 60,000 penalty units, for non-compliance.

Broad scope

The definition of a regulated online service extends well beyond social media platforms. It would capture internet carriage services, hosting services, search engines, app distribution services, AI content generation tools and providers involved in the manufacture, supply, maintenance or installation of equipment used in connection with online services. 

Although the minister would have powers to exempt low-risk services, the breadth of the proposed definition means the regime could apply to a much wider range of businesses than traditional online safety laws.

The exposure draft contains detailed definitions of harmful material and conduct, including content harmful to children and other forms of serious online harm. Providers would be required to assess and manage foreseeable risks arising from both content and platform design.

Focus on design features and algorithms 

There is a particular focus on the safety by design of service features which could have adverse behavioural impacts. These include recommender systems, logged-in features, endless feeds, feedback mechanisms and time-limited features. Additional features could be designated in future.

Providers would be required to manage these design features appropriately and undertake risk assessments. Social media services would face additional restrictions designed to protect children under 16, including prohibitions on certain design features deemed harmful to younger users.

The legislation would also enable the minister to require specified services to provide "user empowerment tools", allowing users to manage how design features operate and influence content recommendations. The framework aligns with the government's "My Feed, My Way" policy agenda by supporting greater user control over algorithmically curated content.

Risk assessments and transparency 

A central feature of the framework would be mandatory risk assessments. Providers would be required to identify foreseeable risks, analyse the content and design features contributing to those risks, and document mitigation measures and their expected effectiveness. Assessments would need to be completed annually and whenever significant service changes are introduced.

The eSafety Commissioner would be able to require production of those assessments within 30 days and compel the provision of information and documents during investigations.

The exposure draft also establishes a new transparency reporting regime. The commissioner could require providers to report on matters such as content moderation decisions, staffing levels, complaint handling, account suspensions and user numbers. Providers could also be directed to publish specified operational information on their own websites.

In addition, regulated services would be required to maintain complaints and dispute resolution processes accessible to all Australians.

Stronger enforcement powers 

The proposals would strengthen the commissioner's existing content removal powers by reducing compliance timeframes from 48 hours to 24 hours. The regulator would also gain enhanced powers to address reposted harmful material and issue link deletion notices requiring search engines to stop linking to certain harmful content after removal notices have been issued.

The framework would also establish a research data access scheme under which approved researchers could be granted access to platform data for online safety research. Both researchers and the commissioner would be authorised to use "sock puppet" accounts to test services and investigate compliance.

Part of broader digital regulation reforms 

The DDoC follows recommendations from the 2023-24 review of the Online Safety Act, with consultation on the framework beginning in late 2025. The government has positioned the reforms as a key component of its wider online safety and AI governance agenda.

The proposals are expected to operate alongside forthcoming privacy reforms and complement initiatives such as the Children's Online Privacy Code and the under-16 social media restrictions. Together, the measures are designed to create a broader safety-by-design regulatory framework covering both traditional and AI-enabled digital services.

If enacted, the reforms would mark a significant shift in Australia's approach to online regulation, moving from a reactive content moderation model toward proactive obligations requiring providers to identify and prevent foreseeable harm arising from the operation and design of their services.

Co-written by Elly Krambias and Jason Chan of Pinsent Masons.