At what The Nightly described as her last Senate Estimates hearing as Commissioner, on Tuesday 27 October 2026, eSafety Commissioner Julie Inman Grant said she believes eSafety needs "a digital duty of care but also stronger tools and protections for individuals, including a private right of action." MLex dates its report of the same remarks 28 October. Earlier in October, at her National Press Club address, Communications Minister Anika Wells said Labor is open to including such a right in the Digital Duty of Care bill and would "consider" it during negotiations. The proposal deserves a serious hearing. As currently framed, it would also push the hardest definitional work in the bill onto courts and plaintiffs' lawyers.
The strongest case for letting people sue
The argument for a private right is real. A regulator has finite capacity, and the Online Safety Act 2021 is enforced by one Commissioner's office choosing which complaints to pursue. Victims whose cases never reach the top of that queue have no recourse. Enforcement by one agency is also a single point of failure: it can be under-resourced, captured by priorities, or politically cautious. Wells herself acknowledged the success of private-right-of-action laws in the United States, according to The Nightly. Inman Grant's own framing, reported by regional AAP outlets, is that such a right would share the burden of enforcement. On this view, a right to sue keeps platforms honest where the regulator cannot reach.
What the bill actually asks of platforms
The Online Safety Amendment (Digital Duty of Care) Bill 2026 was introduced in mid-October after changes to the early-September exposure draft. MinterEllison summarises the core obligation: a person responsible for an online service must ensure, "so far as reasonably practicable," a safe online environment. Breach carries civil penalties of up to approximately AUD109 million for a body corporate, and the duty is "enforceable directly by the eSafety Commissioner." It commences 12 months after Royal Assent. According to The Nightly, it reaches messaging and gaming platforms, search engines, app stores, generative AI models and chat forums.
Two features matter here. First, the duty is a regulatory obligation, built to be interpreted over time by a specialist regulator that can issue guidance, negotiate with services and calibrate enforcement. Second, "reasonably practicable" is a standard whose content depends on the service, its size, its risks and the available tools. That is a sensible design for regulator-led compliance. It is a poor fit for adjudication one plaintiff at a time.
Why a private right changes the character of the law
A regulator applying an open-textured standard can be predictable in practice. It publishes expectations, takes enforcement decisions that repeat, and can decline to act where a service is making good-faith efforts. A court hearing a claim from a single harmed user sees the opposite: a bad outcome, a sympathetic plaintiff and a defendant with deep pockets. Hindsight makes almost any harm look preventable. The standard that was meant to flex with a service's size and risk profile becomes whatever a given judge finds persuasive after the fact.
That asymmetry falls hardest on the services Australia presumably wants to see grow. A global platform can absorb a litigation function and settle quietly. A small Australian messaging app, a gaming start-up or a niche forum cannot. The Nightly reports the Greens want both individual and class-action rights. Class actions add a funding model in which litigation funders and law firms, rather than harmed users, set the pace of enforcement. The Information Technology and Innovation Foundation warned in its submission to the Senate Environment and Communications Legislation Committee that a private right would "open the floodgates for unnecessary, baseless lawsuits." That language is strong, and the evidence for it in the Australian context is untested. But the structural worry, that vague duties plus damages plus aggregation produce defensive over-removal, is a serious one.
Over-removal is the free-speech cost. If the cheapest way for a service to avoid liability is to take down or restrict anything adjacent to a harm, lawful speech by teenagers, minorities, and survivors discussing their own experiences pays the price. A regulator can weigh speech interests in a published decision. A defendant staring at a damages claim has little incentive to.
A narrower design worth negotiating
There is a version of this idea that addresses the enforcement gap without the litigation lottery. The negotiation Wells described is the place to build it:
- Tie liability to defined breaches. Allow private claims only for breaches of specific, regulator-defined obligations, such as ignoring a valid eSafety notice or failing to act on a verified report of a defined harm. Do not allow claims for breach of the general duty.
- Make the regulator the gatekeeper. Require a complaint to eSafety first, with a right to proceed only if the Commissioner declines or fails to act within a set time. That preserves the regulator's role in interpreting the standard.
- Keep penalties and damages proportionate. Senator Sarah Hanson-Young's stated red line, per The Nightly, is tying penalties to a percentage of global profits. Stacking that on top of uncapped private damages would multiply exposure well beyond what any smaller service can model.
- Sequence it. The duty will not commence until 12 months after Royal Assent. A review clause that revisits a private right after eSafety has built a body of enforcement decisions would give courts something concrete to apply.
What to watch
Inman Grant told Estimates she will not be the person implementing the duty of care, so the interpretive norms of the regime will be set by her successor. Hanson-Young has set 20 November as the Senate committee's reporting deadline, according to The Nightly, and the bill faces a final sitting fortnight in late November. The Greens and Coalition are both key votes. The Coalition opposes the draft on free-speech grounds, which makes Greens support pivotal and gives the Greens real leverage over the private right. Labor should spend that leverage on a narrow, regulator-gated right rather than conceding a general one. A user who can sue a platform for failing to fix a defined harm after a regulator has already found fault is a reasonable enforcement tool. A user who can sue because a court later disagrees about what was "reasonably practicable" is a lottery whose costs smaller innovators will bear first.