- What the Bill says
- The Bill does not mention reviews or comments. It requires appropriate action to protect users from harmful material and conduct on the service, in proportion to the risk (sections 26 and 26A).
- Our reading
- Reviews and comments do not decide whether the Bill applies. They raise a site's risk, because other people can publish on it. Approval before publishing and a way to report a post are the main safeguards.
- Not yet decided
- Whether a site with moderated reviews still counts as lowest risk. eSafety's early criteria start with no interaction between users.
Why do reviews and comments raise risk?
Because you no longer control every word on your site. A review box or comment thread lets a stranger publish text, and sometimes photos, under your business name. Most posts are harmless. The risk is the rare one that is abusive, threatening or unsuitable for children.
Would a site with reviews still count as low risk?
That is not settled. eSafety's early criteria for the lowest-risk sites start with no interaction between users. Reviews are a mild form of user content, and nobody has said which side of the line they fall on. We rate them as moderate risk in our checker until eSafety publishes its criteria.
What if my reviews are on Google, Facebook or a review platform?
Reviews posted on another company's service are that company's responsibility. You are a user of that service. If you display those reviews on your own website through a widget, on our reading they become content on your site, and you should be able to hide one if needed.
Do testimonials I choose and publish myself count?
No. A testimonial you select and put on a page is your own content, the same as any other text you write. The risk comes from open posting, where the public can publish without you seeing it first.
What safeguards manage the risk from reviews?
Timing: as at 14 November 2026 the Bill is not law, and none of this is required. These are the practices that manage the risk. They are worth knowing now and would matter if the Bill passes.
- Approve before publishing. Hold each review or comment until someone has read it.
- Give people a way to report a post. A link or an email address is enough for a small site.
- Remove harmful posts quickly and note the date you did it.
- Limit or check photo uploads.
- Use the spam and profanity filters your platform already has.
- Write down who checks reviews and how often. That note is most of your risk assessment for this feature.
Do my replies to reviews matter?
Your replies are your own content. Keep them professional, and do not publish a customer's personal details in a reply. That is good practice under privacy and defamation law as well.
What about comments on a blog?
Blog comments work the same way as reviews. If the Bill passes, a rarely used comment section is a candidate for switching off, which removes the risk entirely. One you keep can be held for approval.
Is this the same as being liable for defamatory comments?
No. Defamation law is separate and already applies. The Digital Duty of Care is about protecting users from harmful material and conduct. The same habits help with both: moderate what is posted and act on complaints.
Sources
Last updated 14 November 2026