A "safety net upstream" – that’s how Australia’s Communications Minister Anika Wells described the intent behind the Online Safety Amendment (Digital Duty of Care) Bill 2026, introduced to the country’s Parliament on Thursday.
Wells was making the announcement hours before she was to address the National Press Club. The bill, which is 90 pages long, carries a civil penalty of up to 60,000 penalty units, or $109.2 million, for failing the duty.
In Parliament, Wells said, "It moves the safety net upstream to the people who design the product to stop the harm before it ever reaches an Australian."
At the Press Club, she put it this way: setting "basic safety standards for the online services we use every day" will see the platforms regulated "just like we have in every other industry."
Wells said that the goal is to "shift the burden from the shoulders of victims to the companies that are creating the environments where harms occur."
She added: "To make this abundantly clear, we have removed the ministerial rule-making power to define new harms in the final bill."
Instead, she said, "New harms can be added by parliament through legislative amendment."
The takedown changes in Schedule 1 kick in the day after Royal Assent, while the duty of care itself comes into force 12 months later.
In September, the exposure draft gave the minister the power to add, by instrument, any material "that the Minister is satisfied may cause serious harm." That power is now gone.
The bill does not at any point ask platforms to balance their "duty of care" with the need to protect freedom of expression and privacy of users.
Section 26 sets the duty: a platform "must take appropriate action to ensure a safe online environment, including by taking effective measures to mitigate risks."
Section 26A spells out what counts as "appropriate" and "effective." The matters to be taken into account "include" how far the measures achieve "a safe online environment," how much they reduce the risk of harmful material, "the impact on the security of the online service," and "whether the action or measures are or would be proportionate to the level of risk."
Section 26A(3) states: "The cost of the action or measures must not be taken into account."
Nowhere in this is freedom of expression or privacy mentioned. The word "encryption" does not appear at all in the 90 pages, nor do the phrases "freedom of expression" or "free speech."
In the UK Online Safety Act – which is no friend of free speech, either – there is at least a section (22) that imposes on platforms, when deciding on safety measures, "a duty to have particular regard to the importance of protecting users’ right to freedom of expression within the law," and a matching duty on privacy.
The Australian bill has no such provision.
In fact, nobody has to "order" over-removal – the way the legislation is written is enough to make it happen. And it will happen because a platform that removes too much content will not be punished or fined; but one that doesn’t comply and removes too little, can be.
This is not an original observation, either – the US government, in its submission to the September consultation, said, "A framework that empowers governments to enforce vague definitions of ‘harm’ risks becoming a mechanism for viewpoint-based censorship, as platforms will be incentivized to over-moderate speech that should be protected to avoid regulatory penalties."
This is a classic case of a chilling effect. But Minister Tanya Plibersek, when asked about it, had this to say: "Oh, I really do think that’s, you know, it’s like saying – what would stop a platform from showing fairies."
Plibersek: "There are all sorts of claims about this being about censorship. It is simply not."
Wells said at the Press Club that the ministerial power to define new harms has been removed. But then there is section 25E(1)(f) of the bill, which says that material "harmful to children" includes "any other material or conduct, or combination of material and conduct, that may cause serious harm to children."
So the "list" was never closed, and this latest addition doesn’t close it either.
Other categories in the bill include material that "encourages or promotes hostile attitudes towards women or gender equality" (s25E(1)(c)); material that "glorifies crime or encourages dangerous stunts" (s25E(1)(d)); material "reasonably likely to cause serious harm by menacing or harassing an individual" (s25D(1)(i)).
Protest organizers should take a close look at section 25D(1)(m), which covers material that "encourages, promotes, incites or instructs the commission of a serious Commonwealth offence that is reasonably likely to cause serious harm." A serious Commonwealth offence is one that carries a sentence of three years or more in prison.
In September, shadow communications minister Sarah Henderson called the draft "a backdoor way of reintroducing the disinformation and misinformation bill."
Nationals leader Matt Canavan shared the sentiment: "I don’t trust Big Tech, but the answer is not to trust the Labor Party instead. No politician should get to decide for themselves what lawful speech is harmful and then pressure platforms to make it disappear."
One Nation leader Pauline Hanson said the bill must be "abandoned completely": "Labor’s shocking censorship bill cannot be fixed."
Section 25F lists "excluded material", which the harm duties do not reach. It includes "professional news material" and "material that is in the public interest" (s25F(1)(i)).
Wells has said that "professional news material" is excluded from the harm duties – but this applies only to news produced by those bound by the Australian Press Council, the Independent Media Council, or those that adhere to "rules or internal editorial standards that are analogous" – and have "editorial independence from the subjects of the person’s news coverage."
Wells told the Press Club that the carve-out was in the legislation to remove any doubt and protect public-interest journalism.
This is a point that Wells was asked about in September by News24, who wanted to know if news websites were covered by the new rules. Wells first said "yes" – before reversing herself to say that news sites were "not captured by the Digital Duty of Care. It’s just not."
Individuals, on the other hand – those who are not employed by a news organization, or who are publishing on their own – are not protected by this carve-out. They are left at the mercy of the social media platforms, who will have to decide whether their work is "analogous" to that of the big, established players.
This looks more like a way to protect the already protected, licensed press, while leaving independent journalists, writers, and creators at the mercy of the platforms’ interpretation of who qualifies for the exemption, and why.
The "digital duty of care" – the obligation to provide a safe online environment – is the core of the bill. The bill spells out only one instance when private messages are exempt: if they are lawful, and take place in private, solely between consenting adults.
The exception is contained in Section 26B: "The digital duty of care does not require any action to be taken in relation to lawful communications occurring in private solely between consenting adults."
This means that if a platform can’t see inside a message, it can’t be sure it was lawful – so the exception doesn’t apply. If a minor is taking part in a chat, the exception doesn’t apply either.
The duty of care imposed on platforms requires them to take "effective measures" to mitigate the risk of "harmful material" – and the first item on the list is child sexual abuse material. A platform that cannot "see" inside a conversation cannot prove it has taken these effective measures.
In fact, the bill does not have to explicitly require client-side scanning – or say that encryption must be broken. The obligation to take effective measures, combined with the huge fines for those who don’t, will likely result in platforms themselves opting for the most "effective" way to comply: scanning messages on the device before they are encrypted and become private.
In 2024, Australia’s eSafety Commissioner Julie Inman Grant was promoting her organization’s anti-encryption standards, and revealed that "industry" was not very receptive to the idea. At that time, the standards said that companies "will not be required to break encryption and will not be required to undertake measures not technically feasible or reasonably practical."
The new bill contains no such statement.
The definition of a safe online environment in section 25C includes making sure children under 16 "do not have access to, and are not exposed to, design features of the service that have negative behavioral impacts."
In the case of social media, section 25G spells these out as recommender feeds, and logged-in features like endless feeds, likes and other engagement counts, and posts that disappear after a time, like stories.
To switch these off for teenagers, a platform must first know who its teenage users are – meaning it must check the age of all users.
The bill has a number of sections dealing with age verification, but the most direct is 27D, which says that where there is a "reasonably foreseeable risk" that a child could see pornography or "material that describes or depicts specific fetish practices or fantasies", the platform must, "where technically feasible and reasonably practicable", offer "a choice of one of at least 2 appropriate age assurance measures" and access controls.
If the material "describes" certain sexual acts, that is enough to trigger the measure, so it doesn't have to be visual content. This is concerning because "describes" reaches text-based content, like that found in blogs, forums, or comments sections.
The choice of two methods is a safeguard, but a small one - as it still means proving your age.
In Australia, under-16s are already banned from having social media accounts, and from December 2025, search engines were checking the age of users who are logged in.
The power of the minister to name new systemic online harms and then force platforms to mitigate them was one of the more controversial parts of the bill. The government said it had dropped it, but the bill shows that the power is still there, albeit in a smaller form.
It can be found in section 25G(2): "The Minister may, by legislative instrument, determine that a design feature of an online service has negative behavioural impacts."
This is limited to social media and under-16s, and the bill says the minister must seek advice from eSafety and have regard to that advice, while Parliament can disallow the legislative instrument.
Our interpretation is that a future minister could use this to name sharing or reposting as a feature with negative behavioral impacts, and cut a creator's reach to teenagers overnight. And it's the same eSafety that will be "advising" the minister that will be enforcing the rule.
The Act defines a "sock puppet identity" as "a false or fictitious identity assumed by a person in the course of using, or carrying out any activity in relation to, an online service" (Section 205G). But both eSafety and "approved researchers" are allowed to create and use fake accounts (Sections 205H and 205J), despite the fact this goes against the terms of service of many online platforms.
These powers are regulated in the bill’s sections 205G to 205M. And while the initial draft said that this could be done "despite anything to the contrary in any other law," the final version has narrowed that down to "despite anything to the contrary in any agreement, contract or deed."
In other words, fake accounts can be used even if they violate a social media platform’s own terms of service, and this is limited only by the law.
The limit on using fake accounts to engage with other users is this: "but only to the extent necessary to prevent closure of an account with the service" (s205K(1)(d)).
However, sub-paragraphs (c) and (f) are more vague and could potentially be used to justify a wide range of activities: (c) is "engaging with an online service or a person responsible for the service" and (f) is "testing an online service’s response to actions taken using the online service."
While (d) limits engagement with ordinary users, what is there to stop "testing an online service’s response to actions" from meaning posting some material to see what happens to it? Both (c) and (f) appear to be open to interpretation.
The rules governing all this are not even laws – they are written by eSafety "in consultation with the Commissioner of the Australian Federal Police" (s205K(3)). Those acting "in good faith" have civil immunity (s205L).
The public will learn about the activities of their online regulator in general terms only, once a year (s205M).
On the day the bill was introduced, Wells said, "We are not controlling free speech. And we are not conducting covert surveillance."
The way the bill is written, it is easy to see why observers might think otherwise – eSafety is essentially a regulator that can write its own rules, in secret, in conjunction with the police.
The new legislation says that eSafety can summon "the person" it believes can answer questions relevant to compliance with, or "a possible contravention" of, the Act, and examine them "on oath or affirmation" (s199 and 200).
Section 201 adds that "the examination of the person must be conducted in private" – though an adviser may be present.
If the person refuses to answer a question, or to take the oath, they are committing an offense and can be jailed for 12 months (section 204). And they cannot invoke their privilege against self-incrimination, i.e., the right to remain silent, because the Act explicitly states that a person "is not excused from giving information or evidence, producing a document or answering a question under this Division on the ground that doing so might tend to incriminate the person" (section 205).
There is some immunity from this: if a person is compelled to answer questions, their answers, and any information or documents they provide, as well as anything found as a result of their answers, cannot be used against them in most civil penalty and criminal proceedings (section 205(2)).
Journalists, meanwhile, are excused from answering only if it would reveal the identity of a confidential source, and they have to prove this (section 204(5)).
The failed "misinformation" bill that the Australian government tried to pass in 2023 had a provision that would have given people accused of spreading "misinformation" fewer protections against self-incrimination than suspects in murder or arson cases.
Now, the same thing is back, via the Online Safety Act.
eSafety is already an online regulator with broad powers, but the new bill turns it into an enforcement body under the Privacy Act as well.
Schedule 2, item 53 of the bill amends the Privacy Act 1988 by adding "the eSafety Commissioner" to the definition of "enforcement body."
This means that personal information can be disclosed to eSafety without consent for enforcement purposes, and eSafety can collect sensitive information under the same exceptions, with no new safeguards introduced by the bill.
The bill also expands the list of those with whom eSafety can share information, from the current list in section 212 of the Online Safety Act to "a Commonwealth entity" – which means any of them.
The bill also gives eSafety the power to send its own representative inside a platform, by requiring the company to "give a person nominated in the notice the access to the service required for the nominated person to report to the Commissioner on the features, systems and processes of the service."
A platform can ask the Administrative Review Tribunal to review the notice, but there is no limit on the user data that eSafety’s representative will be able to see.
Schedule 1 of Australia’s "censorship bill" – as opponents are calling it – starts the day after the proposed legislation receives Royal Assent.
Notices for removal of "cyber-abuse material" will have to be acted upon within 24 hours, down from the current 48.
eSafety will be able to order removal of "reposts" of material it has previously had taken down, even if the new post contains "commentary" on the original content – and even if the original content is not illegal, but has simply been subject to a removal notice.
Search engines can be ordered to stop linking to cyber-abuse material targeted at an Australian adult within "24 hours after the notice was given" (s92A).
The bill also validates industry codes and standards that have been registered after a short consultation period, and makes sure that this validation is retroactive.
Wells has stopped short of guaranteeing that the government will never revisit the issue of "misinformation" legislation, saying only that it was not on her agenda for the current term. In 2024, the government dropped its "misinformation" bill after then-minister Michelle Rowland said, "there is no pathway to legislate this proposal through the Senate."
On Thursday, Communications Minister Anika Wells hit back at critics of the new censorship legislation, saying that if adults want to "listen to manosphere podcasts, or people post their views about the government, or make memes, or want to say the moon landing was fake, they can continue to do so without restriction."
The bill doesn’t seem to back her up – in fact, it doesn’t even mention freedom of expression or privacy as a factor to be taken into account when implementing "a duty of care" to prevent and mitigate the risk of harm to individuals.
Section 26A(3) also says that "the cost of the action or measures must not be taken into account."
Even if a platform removes content that is clearly legal, simply to be on the safe side, the bill does not offer any protection from liability for that removal. In other words, the only safe harbor is over-removal.
Follow this bill on our bill tracker.
