The Digital Duty of Care, explained
The Australian Government wants every online service, from social media to ordinary business websites, to take responsibility for keeping Australian users safe. The Online Safety Amendment (Digital Duty of Care) Bill 2026 is how it plans to do that. It isn't law yet and the Senate may still change it, so everything below is the bill as introduced.
Last updated
The short answer
The Digital Duty of Care is a proposed change to Australia's Online Safety Act. It would require anyone responsible for an online service, including social media, messaging, apps, hosting, search, AI tools and many websites, to provide a safe online environment for Australian users. Services would have to manage risky design features, write and regularly review risk assessments, and take effective steps to address the risks. Penalties for companies could reach $109.2 million. The bill was introduced on 15 October 2026 and, if passed, the duty would start 12 months after it becomes law.
Where it's up to
The government released an exposure draft for consultation on 8 September 2026, then introduced the bill to Parliament on 15 October 2026. Law firm Johnson Winter Slattery reports it was amended and passed by the House of Representatives on 28 October 2026. It has been referred to the Senate Environment and Communications Legislation Committee, which is due to report by 20 November 2026, and still needs to pass the Senate. Details can change before then, so treat everything on this page as the bill as introduced, not the final law.
What the duty would require
A safe online environment
The core duty: protect Australian users from seriously harmful and illegal material and conduct, and protect under-18s from material, conduct and features that are harmful to young people.
Manage design features
Features like recommendation feeds, endless scrolling, likes and disappearing messages have to be managed, with extra limits for under-16s on social media.
User controls
Where required, give users tools to change how features work for them, such as choosing a feed of only the accounts they follow.
Written risk assessments
Identify every reasonably foreseeable risk the service poses, rate how likely and serious each one is, and record what's being done about it. Under the draft, review at least yearly and before risky changes, and keep records for six years.
Effective measures
Take steps that actually address the risks found. Law firm Pinsent Masons notes the bill as introduced uses an 'appropriate and effective' test and doesn't let cost count as a reason to do less.
Faster takedowns
Response times for cyberbullying and abuse removal notices would drop to 24 hours, and the eSafety Commissioner could order removal of 'nudify' apps and websites.
Who it would cover
- Social media services, messaging, email and online games where users talk to each other.
- Designated internet services, which law firm Allens notes includes many ordinary website operators.
- Hosting services, search engines and app stores.
- Businesses that make, supply or install equipment used with these services.
- AI tools that let users create content and share it through any of the above.
- Overseas services used by Australians, as well as Australian ones.
The timeline
- 8 September 2026: exposure draft. The government published a draft bill and asked for comment.
- 15 October 2026: bill introduced. The Minister for Communications introduced the bill to Parliament, with changes made after consultation.
- 20 November 2026: Senate committee report due. The committee may recommend more changes before the Senate votes.
- 12 months after Royal Assent: the duty starts. If the bill passes, services get a year to prepare. Faster takedown rules would start sooner, the day after it becomes law.
How WaTo can help
- Read what the Digital Duty of Care means for small business or what it means for larger businesses and platforms.
- Our website security and compliance audit lists what your website lets visitors do, such as comments, reviews, uploads, chat and AI tools, which is the starting point for any risk assessment.
- We can switch off, moderate or rebuild the features that carry the most risk. We aren't lawyers, so for legal advice on whether the duty applies to you, talk to a technology lawyer.
Digital Duty of Care questions
Is the Digital Duty of Care law yet?
No. As of November 2026 it's a bill before Parliament. It has been introduced and is with a Senate committee due to report by 20 November 2026. If it passes, the duty itself would start 12 months after Royal Assent.
Does it only apply to big tech?
No. As introduced, it covers a broad range of online services, including many websites, and there is no general small business exemption. The Minister could exempt services that pose little risk to Australian users or have minimal use in Australia.
What are the penalties?
Civil penalties of up to $109.2 million for companies and $21.84 million for individuals for breaching the duty, according to the government and law firm Johnson Winter Slattery. The eSafety Commissioner would also be able to issue formal warnings and remedial directions.
Who would enforce it?
The eSafety Commissioner, with new powers to ask for information and documents, issue warnings and remedial directions, and take court action.
What does it replace?
Once the duty starts, it would replace the current online safety industry codes and standards with one overarching duty.
What should a business do now?
List the online services you run and what they let users do, then follow the bill's progress. If the law passes, there will be 12 months and eSafety guidance before the duty applies.
How WaTo can help with this
Guides on this topic
- Does the Digital Duty of Care apply to my small business?
- Digital Duty of Care for larger businesses, apps and platforms
- Digital Duty of Care risk assessment: what to include
- Website compliance checklist for Australian small businesses
Sources & references
- Department of Infrastructure, Transport, Regional Development, Communications, Sport and the Arts: Digital Duty of Care
- Parliament of Australia: Online Safety Amendment (Digital Duty of Care) Bill 2026
- Johnson Winter Slattery: Australia's proposed digital duty of care, what online services need to know
- Allens: Australia's digital duty of care, what the draft bill means for online services (September 2026)
- Pinsent Masons: Digital duty of care legislation introduced into Australian parliament
- MinterEllison: Australia's new digital duty of care, what it means
WaTo Consulting. Last reviewed 2026-11-07. Review after the Senate committee reports (due 20 November 2026), after the Senate vote, and when eSafety guidance is published.
Want to know what your website lets users do?
We'll go through your site, list the features where visitors can reach other people or create content, and tell you which ones carry the most risk.
Mon to Fri, 8:30am to 5pm
