New online safety duty could reach apps, games and websites

Run an app, an online game or a site where people post? A new law could make you responsible for keeping Australian users safe. The penalty for getting it wrong could reach $109.2 million.

The Minister for Communications, Anika Wells, introduced the Digital Duty of Care bill to Parliament on 15 October. It isn’t law yet. “It will set basic safety standards for the digital services we use every day, just as we have for food, cars and kids’ toys,” she said.

Not just a big tech law

The government’s release says the duty puts “the onus on big tech”, but it also covers online services “such as games, apps and AI chatbots”. The Department’s page says providers must take reasonable steps to keep Australian users safe on their service.

The September exposure draft shows how far that reaches. It covered social media, messaging, email and chat, and online games where players interact. It also covered search engines, app stores, hosting and internet providers. Companies that make or install equipment for those services were in too. So were AI tools that let users create material and share it.

Then there are “designated internet services”, the Online Safety Act’s catch-all for services that let people access material online. On our reading, that could include an ordinary business website, especially one with reviews, comments or a forum. The draft had no size or turnover threshold. Instead, the minister could exempt services that “pose little risk” to Australian users or are “used minimally in Australia”.

The minister says that, in response to feedback, the introduced bill makes clear professional news and entertainment media are exempt.

What services would have to do

The September draft sets out the detail, which may have changed in the introduced bill. Its core duty is to ensure “so far as is reasonably practicable, a safe online environment”. That weighs the likelihood and severity of harm against what can be done about it. Cost counts, including whether it is “grossly disproportionate to the risk”, and so does the privacy impact.

In practice, the draft required a written risk assessment:

• at least once a year, and before changes that could add new risks
• covering the reasonably foreseeable risks, what causes them and who is affected
• kept for at least 6 years
• handed to the eSafety Commissioner within 30 days of a request.

The “audits” in some headlines are these yearly self-assessments. The draft doesn’t require external audits, though the government’s impact analysis flagged ad-hoc audits for some services. The duty would start 12 months after the law gets Royal Assent.

That impact analysis estimates the changes will add an average of $1.408 million a year in regulatory costs across Australian businesses, over ten years. It flags that small or low-risk services “may feel that they must comply”. It says the regulator will produce guidance, and exemptions for very low-risk services may be considered later.

Protecting under-18s

The duty covers seriously harmful and illegal material and conduct for everyone. Services must also protect under-18s from material, conduct and features that harm them. The minister’s release includes content that glorifies crime or life-endangering stunts, causes serious mental distress, encourages eating disorders or promotes hostile attitudes towards women.

Separately, a Children’s Online Privacy Code is on the way. Our Privacy Act explainer covers it.

Choose your own feed

For social media users, the most visible change is “My Feed, My Way”. Australians over 16 would be able to choose between recommended content and only the accounts they follow as their main feed.

The government is consulting on that rule now. Submissions close at 11.59pm AEDT on 5 November, which is 8.59pm in Perth.

The bill would also let eSafety order the removal of nudify apps and websites. It would halve the time platforms have to deal with reported cyberbullying and abuse, from 48 hours to 24.

Checklist

• List what users can post on your service. Reviews, comments, forums, chat, uploads and AI-generated content are the features to look at first for the risk assessment the draft describes.
• Write down the risks now. Note what could go wrong on each feature, who could be harmed and what you already do. That gives you a head start on a yearly assessment.
• Check who uses your service. The duty adds extra protections for under-18s, so know whether young people use your app, game or site.
• Work out who is responsible. The draft covers the provider or whoever has day-to-day control, so if a platform runs your forum or reviews, ask which of you that is.
• Have your say on My Feed, My Way. Submissions close at 11.59pm AEDT (8.59pm Perth) on 5 November, through the Department of Infrastructure’s consultation page.
• Watch for regulator guidance. The government’s impact analysis says the regulator will produce guidance. Under the draft, the duty starts 12 months after Royal Assent.