Google warns duty of care bill could put age checks on email

Your email, messaging and online file storage could start checking ages under Australia’s new online safety law. That’s Google’s warning to the Senate inquiry into the bill.

Google says one section could force those everyday services to check users’ ages and screen what under-18s can reach. We covered what the Digital Duty of Care bill asks of online services when it was introduced in October. Here’s what has changed since.

The bill is halfway through Parliament

The House of Representatives passed the bill on 28 October. It now needs the Senate.

First, a Senate committee is examining it. Submissions closed on 30 October, public hearings were held on 9 November and continue on 10 November, and the committee is due to report on 20 November. Google, Meta, TikTok and Snap all gave evidence on 9 November.

Why your inbox is in the frame

The trigger is section 27D. It applies when there’s a “reasonably foreseeable risk” that a child could access pornography or fetish material through a service. Where technically feasible and reasonably practicable, the service must then offer a choice of at least two age assurance methods, plus access controls.

Google’s written submission says that test catches more than adult sites. A child could come across that material through messaging, email or private file storage, even where the service doesn’t allow it. Those services would then have to check ages and undertake “intrusive proactive scanning” to find and block it.

The proposed fix: limit section 27D to services whose sole or predominant purpose is spreading pornography or fetish material. Everything else would still sit under the general duty to protect children.

At the hearing, Rachel Lord from YouTube’s government affairs team spoke for Google. Information Age reports she wants it made clear there is no expectation of “age assuring those users and blocking access to under-18s” on private messages and storage. Reuters reports her warning as meaning the law could force Google to block under-18s from Gmail.

Privacy and cost are out of the test

The September draft we reported on said privacy impact and cost both counted when weighing up safety steps. The bill as passed by the House is different.

Section 26A lists matters to weigh when deciding whether a service’s safety measures are appropriate. That covers how well they reduce harm, the impact on security, and whether they’re proportionate to the risk. Privacy isn’t on the list. And the bill says plainly that the cost of a measure “must not be taken into account”.

Google wants privacy added back. It says the change removes a safeguard against intrusive monitoring of private messages and files. The bill does keep a separate exception: the duty doesn’t require any action on lawful private communications solely between consenting adults.

Small business wants a carve-out in the law

The duty can reach far beyond big platforms, including ordinary websites where users post or share material. Two submissions say low-risk services shouldn’t have to rely on the minister for relief.

Google asks for enterprise services, such as business cloud and productivity suites, to be exempt in the Act itself. Today the bill leaves exemptions for low-risk services to a later ministerial decision.

The Council of Small Business Organisations Australia (COSBOA) takes a narrower line. It wants low-risk small business websites exempted, in the law itself, from the yearly written risk assessments.

It also warns about reach. The bill treats every recommendation feature as having “negative behavioural impacts”. COSBOA says cautious platforms could then demote or withhold content from fitness, nutrition, beauty, alcohol retail and adventure tourism businesses. It wants a small business impact assessment before the minister makes rules on recommended content.

None of these changes has been made; the committee’s report on 20 November will show which ones it recommends.

Checklist

• Read the committee’s report after 20 November. It will be published on the Senate Environment and Communications Legislation Committee’s inquiry page and will show which changes are recommended.
• List the features on your site or app where users post or share. Reviews, comments, forums, chat and uploads are the first features a yearly risk assessment would look at if no small business exemption is added.
• Check how much of your reach comes from recommended feeds. If you sell fitness, nutrition, beauty, alcohol retail or adventure tourism, note how much of your reach comes from recommended feeds.
• Ask your industry association where it stands. COSBOA’s submission asks for a small business exemption in the law, and a small business impact assessment before rules on recommended content.