A “safety net upstream” – that’s how Australia’s Communications Minister Anika Wells described the intent behind the Online Safety Amendment (Digital Duty of Care) Bill 2026, introduced to the country’s Parliament on Thursday.
Wells was making the announcement hours before she was to address the National Press Club. The bill, which is 90 pages long, carries a civil penalty of up to 60,000 penalty units, or $109.2 million, for failing the duty.
In Parliament, Wells said, “It moves the safety net upstream to the people who design the product to stop the harm before it ever reaches an Australian.”
At the Press Club, she put it this way: setting “basic safety standards for the online services we use every day” will see the platforms regulated “just like we have in every other industry.”
Wells said that the goal is to “shift the burden from the shoulders of victims to the companies that are creating the environments where harms occur.”
She added: “To make this abundantly clear, we have removed the ministerial rule-making power to define new harms in the final bill.”
Instead, she said, “New harms can be added by parliament through legislative amendment.”
The takedown changes in Schedule 1 kick in the day after Royal Assent, while the duty of care itself comes into force 12 months later.
In September, the exposure draft gave the minister the power to add, by instrument, any material “that the Minister is satisfied may cause serious harm.” That power is now gone.
The bill does not at any point ask platforms to balance their “duty of care” with the need to protect freedom of expression and privacy of users.
Section 26 sets the duty: a platform “must take appropriate action to ensure a safe online environment, including by taking effective measures to mitigate risks.”
Section 26A spells out what counts as “appropriate” and “effective.” The matters to be taken into account “include” how far the measures achieve “a safe online environment,” how much they reduce the risk of harmful material, “the impact on the security of the online service,” and “whether the action or measures are or would be proportionate to the level of risk.”
Section 26A(3) states: “The cost of the action or measures must not be taken into account.”
Nowhere in this is freedom of expression or privacy mentioned. The word “encryption” does not appear at all in the 90 pages, nor do the phrases “freedom of expression” or “free speech.”
In the UK Online Safety Act – which is no friend of free speech, either – there is at least a section (22) that imposes on platforms, when deciding on safety measures, “a duty to have particular regard to the importance of protecting users’ right to freedom of expression within the law,” and a matching duty on privacy.
The Australian bill has no such provision.
