Question 1

What is the Digital Duty of Care?

Accepted Answer

A proposed Australian law that would require anyone responsible for an online service, including many business websites, to take appropriate action to keep users safe and to keep a written risk assessment.

Question 2

Is the Digital Duty of Care law yet?

Accepted Answer

No. As at 14 November 2026 it is a Bill. It has passed the House of Representatives and is before the Senate.

Question 3

When does the Digital Duty of Care start?

Accepted Answer

If the Bill passes, the duty would start 12 months after Royal Assent. That means late 2027 at the earliest.

Question 4

Does the Digital Duty of Care apply to small businesses?

Accepted Answer

Probably, if you run your own website or app. The Bill has no exemption based on size, turnover or user numbers. The Minister could exempt low-risk services, but no exemption exists yet.

Question 5

Does my business website need a risk assessment?

Accepted Answer

On the Bill's wording, likely yes. The requirement applies to every person responsible for an online service. For a simple website the assessment should be short.

Question 6

Is there an exemption for small business websites?

Accepted Answer

Not yet. The Bill would let the Minister exempt services that pose little risk. None can be made until the Bill is law, and none has been announced.

Question 7

Does it apply to my Facebook or Instagram page?

Accepted Answer

Probably not to you. The platform provides the service and carries the duty for it.

Question 8

Does it apply if my site is on Wix, Squarespace, Shopify or WordPress?

Accepted Answer

Likely yes. Using a website builder does not move the duty. You still provide your website to the public.

Question 9

Does the Digital Duty of Care apply to AI chatbots?

Accepted Answer

Yes, on the Bill's wording. It lists services that generate material using artificial intelligence as online services, with no size threshold.

Question 10

What has to be in the risk assessment?

Accepted Answer

The foreseeable risks of harm, who may be affected, how likely and severe each risk is, the measures you take, and how well you expect them to work.

Question 11

How often do I need a risk assessment?

Accepted Answer

At least once a year, and before any significant change that could introduce new risks, such as adding a chatbot or public reviews.

Question 12

How long do I have to keep a risk assessment?

Accepted Answer

Six years. You would also have to give it to the eSafety Commissioner within 30 days if asked.

Question 13

Can I write my own risk assessment?

Accepted Answer

Yes. The Bill does not prescribe a template and does not require a lawyer or consultant.

Question 14

Who is responsible if a developer or agency runs my website?

Accepted Answer

You are, as the provider. An agency with the greatest day-to-day control may be responsible alongside you.

Question 15

What are the penalties under the Digital Duty of Care?

Accepted Answer

The maximum civil penalty would be 60,000 penalty units, currently $21.84 million. The Government puts the maximum for a company at $109.2 million. Maximums are for serious cases, and a court must consider the size of the organisation.

Question 16

What is a penalty unit?

Accepted Answer

A fixed dollar amount that federal law uses to set fines, currently $364. A fine of 60,000 penalty units is 60,000 times $364, which is $21.84 million.

Question 17

Who enforces the Digital Duty of Care?

Accepted Answer

The eSafety Commissioner. Its tools would include formal warnings, remedial directions, infringement notices and court action.

Question 18

Can customers sue my business under the Digital Duty of Care?

Accepted Answer

The Bill does not create a right to sue. It is enforced by the eSafety Commissioner. The Department has said the duty would strengthen the basis for a negligence claim under existing law, and some senators want an express right to sue added.

Question 19

Is this the same as the under-16 social media ban?

Accepted Answer

No. The social media minimum age is a separate, existing law about who can hold social media accounts. The Digital Duty of Care is about how online services manage harm.

Question 20

Do I need to do anything now?

Accepted Answer

Nothing is required yet under this Bill. Listing your online services and noting the risky features is useful either way. eSafety's existing industry codes already apply to some services.

Question 21

Is the small business exemption based on turnover or staff numbers?

Accepted Answer

No. The Bill's exemption test is whether a service poses little risk to users. It does not mention turnover, staff or user numbers. COSBOA has suggested thresholds of under $10 million turnover or fewer than 50 staff, but these are not in the Bill.

Question 22

Will a small business have to write a full risk assessment?

Accepted Answer

Probably not a long one, if the site is low risk. The Department expects low-risk services would likely answer a small number of questions confirming they do not host or enable higher-risk material, conduct or features. That is an expectation, not a rule in the Bill.

Question 23

When will eSafety publish the risk assessment form?

Accepted Answer

eSafety has said it aims to publish its risk assessment materials at least six months before the requirement starts, after public consultation.

Question 24

When would the first risk assessment be due?

Accepted Answer

The Bill gives no separate date. The requirement starts with the duty, 12 months after Royal Assent. eSafety has asked Parliament to make explicit that the first assessment must be finished by then.

Question 25

What is COSBOA asking for?

Accepted Answer

The Council of Small Business Organisations Australia wants an exemption from mandatory written risk assessments for low-risk small business websites, written into the Act itself. It is not asking for an exemption from the duty as a whole.

Question 26

Would eSafety fine a small business straight away?

Accepted Answer

Unlikely, on what has been said. The Department says services would generally get the chance to identify and fix problems first, and eSafety would have graduated options: formal warnings, remedial directions, infringement notices, then court.

Question 27

Do today's online safety codes still apply?

Accepted Answer

Yes. eSafety's existing industry codes and standards stay in force for the 12 months after Royal Assent, and eSafety says it will keep enforcing them until the duty replaces them.

Question 28

Does a 'recommended for you' feature on my website count?

Accepted Answer

Mostly no. The Bill's ban on children under 16 seeing features with negative behavioural impacts, which include recommender features, applies only to social media services. Other websites must still protect children from harms linked to their design features in general.

Question 29

Is eSafety going to target small business websites?

Accepted Answer

eSafety says no. The Commissioner told a Senate hearing on 10 November 2026 that eSafety is not focused on small businesses that have a web presence, and concentrates on high-risk, high-harm services. The Bill itself still covers business websites.

Question 30

What makes a website lowest risk in eSafety's eyes?

Accepted Answer

eSafety told the Senate hearing its early criteria are no interaction between users, no user messaging, no interaction between adults and children, and no AI chatbot. It will consult before settling them, so they could change.

Question 31

What would a low-risk risk assessment look like?

Accepted Answer

The Department told the Senate hearing it would be a simple checkbox process. A site would answer questions such as whether it offers pornography, chatbots or user-to-user interaction. If every answer is no, the assessment is done.

Question 32

Does the Digital Duty of Care apply to church, club and charity websites?

Accepted Answer

On the Bill's wording, yes, in the same way as business websites. Church groups raised parish websites at the Senate hearing. eSafety said it is not focused on religious institutions or community groups that simply have a web presence.

Question 33

If eSafety is not focused on small business, can I ignore the law?

Accepted Answer

No. A regulator's priorities are not an exemption. If the Bill passes unchanged, a business website would still need a risk assessment, though a short one for a low-risk site. Priorities can also change.

Question 34

How much is the fine under the Digital Duty of Care Bill?

Accepted Answer

The maximum civil penalty is 60,000 penalty units. At the current $364 per unit that is $21.84 million for an individual and up to $109.2 million for a company. A court sets the actual amount, and the maximum is aimed at the largest platforms.

Question 35

What fine would a small business realistically face?

Accepted Answer

If any, most likely an infringement notice: $4,368 for a sole trader or $218,400 for a company per breach. The Department says services would generally get the chance to fix problems first, and eSafety can start with a formal warning.

Question 36

Is breaching the Digital Duty of Care a criminal offence?

Accepted Answer

No. The Bill's penalties for the duty and for risk assessments are civil penalties. A court can order a fine, but there is no conviction and no criminal record.

Question 37

When could fines first apply?

Accepted Answer

Not until the duty starts, 12 months after Royal Assent. If the Bill passes in late 2026 that is late 2027 at the earliest. The duty does not apply to anything before then.

Question 38

Does a contact form bring my website under the Digital Duty of Care?

Accepted Answer

A contact form adds no risk, on our reading. Messages go to you and are not shown to other users. Your website is likely an online service under the Bill with or without the form, at the low-risk end.

Question 39

Does an online booking system count?

Accepted Answer

It adds no risk. A booking system collects details and a time slot, and nothing the customer enters is published to other users. A booking tool run by another company is that company's service.

Question 40

Does live chat on my website count?

Accepted Answer

Live chat answered by your staff is low risk, because it is a private conversation between you and one customer. Chat answered by AI is higher risk, because the Bill lists services that generate material using AI.

Question 41

Which website features raise risk the most?

Accepted Answer

Forums and member communities, photo or video uploads that other users can see, messaging between users, and AI chatbots. Public reviews and comments raise it less. Reading, enquiring, booking and paying do not raise it.

Question 42

Do embedded YouTube videos or social media feeds count?

Accepted Answer

On our reading, an embedded video, map or feed is content you chose to show, so it is part of your site and you can remove it. The comments and interaction happen on the other company's service, which has its own duty.

Question 43

Should I remove reviews or comments from my website?

Accepted Answer

Not yet. The Bill is not law, so nothing requires a change today. For now, weigh up what they are worth to your business. If the Bill passes, reviews that help you can stay with safeguards such as approval before publishing.

Question 44

Are Google reviews of my business my responsibility?

Accepted Answer

No. Reviews posted on Google or another platform are on that company's service, and you are a user of it. If you display them on your own website through a widget, treat them as content on your site.

Question 45

Do testimonials on my website count as user content?

Accepted Answer

No. A testimonial you choose and publish yourself is your own content, like any other text on the page. The risk comes from open posting, where the public can publish without you seeing it first.

Question 46

How should I moderate reviews and comments?

Accepted Answer

The main safeguards are approving each one before it appears, giving visitors a way to report a post, and removing harmful posts quickly with a note of the date. None of this is required until the Bill is law, but it is good practice already.

Question 47

Does the Digital Duty of Care apply to online shops?

Accepted Answer

Likely yes, if you run your own shop website. A shop with only products and a checkout is at the low-risk end. Customer reviews, an AI shopping assistant and age-restricted products raise the risk.

Question 48

Is Shopify responsible for my store under the Digital Duty of Care?

Accepted Answer

No. The platform is responsible for its own service. You are the provider of your store and have day-to-day control of it, so the duty would sit with you. The same applies on Wix, Squarespace and WooCommerce.

Question 49

Does it apply if I only sell on eBay, Etsy or Amazon?

Accepted Answer

Probably not to you. A seller account or store page on a marketplace is part of the marketplace's service, and the marketplace carries the duty. That changes if you also run your own website.

Question 50

Does the Digital Duty of Care apply to sports club websites?

Accepted Answer

On the Bill's wording, yes. It covers online services whoever runs them. A club site with only fixtures, news and contact details is low risk. A members' area where adults and children interact raises the risk.

Question 51

Is there an exemption for charities and not-for-profits?

Accepted Answer

No. The Bill does not mention charities or not-for-profits. Its test is the kind of online service, not who runs it. The Minister could exempt low-risk services of any kind once the Bill is law.

Question 52

Who is responsible if a volunteer runs our club website?

Accepted Answer

Most likely the club, as provider of the service, and possibly whoever has the greatest day-to-day control. Keep the website accounts in the club's name and not one volunteer's. Check the position with a lawyer.

Question 53

What is My Feed, My Way?

Accepted Answer

The Australian Government's plan to make social media platforms offer users a choice of feed, including one without algorithm recommendations. It would be made under the Digital Duty of Care Bill and applies to social media, not to business websites.

Question 54

Is My Feed, My Way law yet?

Accepted Answer

No. As at 14 November 2026 the Bill it depends on has not passed the Senate, and the instrument that would create it is an exposure draft.

Question 55

Does My Feed, My Way apply to my business website?

Accepted Answer

No. The draft applies to social media platforms that use a recommender feature. A business website, shop or blog would not have to build the tool.

Question 56

Is the Digital Duty of Care the same as the under-16 social media ban?

Accepted Answer

No. The under-16 ban is already law and covers age-restricted social media platforms. The Digital Duty of Care is a Bill that would cover almost every online service, including ordinary business websites.

Question 57

Does the Digital Duty of Care require age verification on my website?

Accepted Answer

Not as a general rule. The Bill requires appropriate action for your level of risk. A site with adult or age-restricted content should expect age checks to be part of that. An ordinary business site should not.

Question 58

Is the Digital Duty of Care part of the Privacy Act?

Accepted Answer

No. The Privacy Act is about handling personal information. The Digital Duty of Care would amend the Online Safety Act and is about keeping users safe from harmful material and conduct.

Question 59

What should I do now about the Digital Duty of Care?

Accepted Answer

Take stock. List what visitors can do on your site, weigh up what each feature is worth, check the accounts are in your business's name, and keep dated notes. Changing your site and writing a formal risk assessment can wait until the Bill passes.

Question 60

Should I pay for a Digital Duty of Care risk assessment now?

Accepted Answer

No. The requirements for a risk assessment have not been published, so nobody can sell a compliant one today. For low-risk sites the Department has described the assessment as a short checkbox process.

Question 61

Do I need a lawyer for the Digital Duty of Care?

Accepted Answer

Most small businesses with a simple website will not. Consider advice if your site has a forum, user uploads, messaging between users, adult content or child users, or if it is unclear whether you or your agency is responsible.

Question 62

What should I ask my web developer about the Digital Duty of Care?

Accepted Answer

Ask which features let visitors post or upload, who has admin access and in whose name, whether comments and reviews can be held for approval, and whether they will tell you before adding a feature such as a chatbot.

Question 63

Does the proposed Digital Duty of Care apply to a Shopify store?

Accepted Answer

Likely yes. The Bill names no platforms. On our reading the store owner provides the store and is the responsible person, and Shopify is responsible for its own service. A store with only products and a checkout is at the low-risk end.

Question 64

Are community organisations exempt from the Digital Duty of Care?

Accepted Answer

No. The Bill has no exemption for community organisations, charities or not-for-profits. The Minister could exempt low-risk services of any kind once the Bill is law, and eSafety has said it is not focused on community groups with a simple web presence.

Digital Duty of Care: questions and answers