Digital duty of care
Digital duty of care: protecting users without overlooking the people who build their services
I look at Australia’s proposed digital duty of care with three hats on: my cybersecurity hat, my teacher’s hat and my community hat.
From a cybersecurity perspective, identifying risks and putting sensible controls in place is familiar territory. As a teacher, I consider how people learn, interact with technology and respond differently to the same experience. From a community perspective, I want useful information, education and activities to remain accessible.
Those perspectives give me reasons to support harm prevention, while questioning how the responsibility will work in practice.
People who operate online services should consider how those services could harm others. But we also need to consider the risks the framework creates for individuals, small businesses, educators and community organisations providing those services.
Both questions deserve attention, regardless of which government proposes the legislation.
This article examines published proposal and consultation material available on 31 October 2026. Detailed provisions discussed below come from the September exposure draft and should not be treated as confirmation of the latest parliamentary wording or obligations already in force.
What is being proposed?
The government proposes placing a proactive safety responsibility on online service providers, including games, social media services and AI chatbots. Its stated objectives include preventing serious online harm and providing additional protections for children.
The policy considers how services are designed and operated, alongside existing mechanisms for responding to harmful content. The government’s framework paper describes an approach focused on systems, processes and reasonably foreseeable risks. It also identifies general websites and apps within the intended scope.
That matters to someone running a community weather website, educational apps or children’s games. Posting on Facebook and operating an independent online service are different activities. A small operator needs clarity about which activities attract obligations.
Where I sit in this
Wally’s Weather is not an enterprise I have built to provide my living. Sponsorship helps support the work, but the purpose is to provide useful weather information, tools, education and community services.
In my view, trying to make a full living from online content can create pressure to take a much more aggressive approach to attracting attention, retaining audiences and generating income. That does not mean every full-time creator behaves irresponsibly. It does mean commercial incentives can push people towards the grey area between engaging an audience and exploiting its attention.
There is a potentially uneven allocation of responsibility here.
Someone concentrating on content within Facebook uses a service whose platform-level safety obligations and associated compliance costs generally sit with Meta. The creator still has responsibilities for their content and must comply with applicable laws and platform rules.
Someone like me also develops independent systems, tools, educational activities and services. Those activities may bring the operator directly within the proposed framework, depending on the final scope and exemptions.
Could a modest community operator acquire direct compliance responsibilities for useful independent tools, while a more aggressive content business operates mainly within a large platform’s compliance arrangements?
That is a question worth examining when considering whether responsibilities are proportionate.
Why the objective has merit
Online harm can arise from product design as well as individual posts. A service can make harmful material easier to encounter, enable abusive interactions or create incentives that undermine users’ wellbeing.
The official impact analysis describes the rationale for preventive regulation, while recognising compliance costs and potential unintended effects. These include providers taking an excessively cautious approach to moderation and small or low-risk services being uncertain about their responsibilities.
The challenge is making preventive responsibility proportionate to the service and its actual risks.
Intent, harm and reasonable precautions
A developer can mean well and still create something that causes harm. Equally, harm occurring does not automatically establish that the developer failed in their responsibilities.
The September exposure draft uses a “reasonably practicable” test. Relevant considerations include the likelihood and severity of harm, what the operator knows or should reasonably know, available precautions, cost and privacy. It also proposes written risk assessments and documentation of measures taken.
This leaves an important practical question: what evidence would demonstrate that a small operator had done enough?
Consider an engaging children’s game. Wanting players to enjoy it and return is an ordinary design objective. A player spending a long time playing does not, by itself, establish addiction, serious harm or a regulatory breach.
However, credible evidence that a particular feature contributes to serious problems would warrant assessment. Individual vulnerabilities matter, but assumptions based solely on a diagnosis such as autism would be an inappropriate substitute for evidence about the actual user, feature and harm.
Risk management requires us to distinguish plausible risks from every imaginable outcome. It also requires us to review our assessment when new evidence emerges.
Likelihood versus impact
For Wally’s Weather, the relevant activities include public weather information, apps and children’s games. The games do not collect player names or other player information beyond ordinary server analytics. Their current design has not been independently audited for this article.
From an operator’s perspective, several different risks need to be considered.
Administrative work is a foreseeable cost if the services are covered. Establishing scope, documenting precautions and reviewing changes could create recurring work. The extent remains uncertain, but the impact would be less time available for development, teaching and community information.
Complaints are possible. Their frequency cannot be estimated without evidence from the service’s history. Even a complaint that does not establish a breach can require time, cause stress and potentially involve advice costs.
Platform restrictions are another possible risk. A legitimate weather post could be misunderstood or lose context during moderation. Whether the proposal would increase that risk is unknown. For a community page, an interruption could affect communication, audience reach and sponsor value.
Formal regulatory action could have serious consequences. However, its likelihood cannot responsibly be estimated from the information available. A headline maximum penalty tells us little about the probability of enforcement or the outcome for a particular small operator.
There is also the risk of responding too cautiously. An operator might remove useful features or close a service because the requirements appear uncertain or unaffordable. That could reduce personal exposure while costing the community a useful resource.
These are preliminary judgments, not measured probabilities or findings of non-compliance.
A sound assessment considers each event separately. The likelihood of receiving a complaint is different from the likelihood of investigation, a finding of breach or a substantial penalty.
The burden can arise before any penalty
For a small operator, recurring costs can matter even where formal enforcement is unlikely.
Time spent understanding requirements, recording decisions, answering complaints and seeking advice has an opportunity cost. Someone doing this alongside teaching, employment and family responsibilities has limited capacity.
For a service not designed to provide a living, that cost may be absorbed personally or paid for by reducing what the service offers.
Documentation can also be useful. It can explain why a design was chosen, identify overlooked risks and support a sensible response when a concern arises. Its value depends on whether the required effort matches the actual risk.
A brief assessment may be appropriate for a simple game. A service involving public messaging, uploads, purchases or personalised recommendations presents a different set of questions. Those features should be assessed where they exist, rather than assumed.
Rights and safeguards matter too
The Australian Human Rights Commission supports preventing online harm while calling for clearer definitions, limits on delegated rule-making powers and stronger consideration of human rights. Its concerns relate to the exposure draft and should not automatically be attributed to every later version.
For creators and users, clarity matters because uncertainty can encourage unnecessary restrictions. Effective reporting, understandable decisions and accessible review processes help protect people on both sides.
Is continuing worth the risk?
There is insufficient evidence to conclude that a useful weather service or simple children’s game should close because of this proposal.
There is also insufficient evidence to promise that a small, well-intentioned operator has nothing to consider.
With my cybersecurity hat on, I want identifiable risks, proportionate controls and evidence that those controls work.
With my teacher’s hat on, I want room to create engaging educational experiences while responding responsibly to different users’ needs.
With my community hat on, I want the benefits of accessible information and activities included in the assessment, alongside the potential harms.
The sensible decision compares those benefits with the remaining risks after practical precautions: who could be harmed, how likely that is, how serious the consequences could be, what the operator can reasonably control, and what compliance itself costs.
The same discipline should apply to the legislation. Its success should be judged by reductions in harm, alongside its effects on privacy, expression, small operators and access to useful services.
Protecting users and keeping worthwhile community services viable are both outcomes worth measuring.
What does this mean for me in practical terms?
A preliminary workload estimate is four to eight hours initially to identify which services are covered, assess foreseeable risks, document existing controls and check reporting arrangements.
Allowing another 30 to 60 minutes a month for routine monitoring and record keeping brings the estimated first-year workload to 10–20 hours. That is approximately 1¼–2½ eight-hour working days diverted from development, teaching or community information.
A significant new feature could require another 30–90 minutes of assessment. Complaints, technical changes and professional advice would add costs that cannot yet be reliably estimated.
These figures are planning assumptions, not measured compliance costs or government-prescribed hours. They assume straightforward services without substantial redesign. Final requirements may change the estimate.
The likelihood of a complaint, investigation, breach finding or penalty cannot currently be quantified for my services. Those are separate events and should not be treated as equally likely. Equally, a headline maximum penalty is not an estimate of my expected financial loss.
My decision therefore rests on three things: the actual obligations, the time and money required to meet them, and the community benefit retained. At present, the evidence supports a proportionate review—not a conclusion that the services should close.
References
Australian Government: Digital Duty of Care
Australian Government: Developing a duty of care framework, May 2026
Australian Government: September 2026 exposure draft
Office of Impact Analysis: Digital Duty of Care Model for Online Safety
Australian Human Rights Commission: Submission on the exposure bill
Comments