The strongest case for Australia's new draft is a serious one. Online harms such as cyber-abuse, non-consensual intimate imagery and AI-generated "fake nude" tools are real, they hit people quickly, and a victim waiting two days for removal is waiting too long. A regulator that can only react to individual complaints will always be behind. A systems-based duty that pushes platforms to design out foreseeable harm is a defensible answer to that.
The government's exposure draft of the Online Safety Amendment (Digital Duty of Care) Bill 2026, published on 8 September 2026, takes that approach. Consultation closed at noon on 22 September. This piece argues that the systems-level duty is the right direction, but that the accompanying expansion of notice-and-takedown powers deserves much more scrutiny than it has received.
What the draft does
The bill would require persons responsible for online services to ensure, "so far as is reasonably practicable", a safe online environment. Civil penalties for breaching the duty are set at 60,000 penalty units, which Corrs Chambers Westgarth calculates at A$109.2 million for a body corporate. That is a fixed figure, not the percentage-of-turnover model the Rickard Review had recommended. The duty would replace the existing Basic Online Safety Expectations and industry codes after a 12-month transition following Royal Assent.
The less-noticed provisions do not wait for that transition. According to the same analysis, removal deadlines for cyber-bullying, intimate image and cyber-abuse material fall from 48 hours to 24, taking effect the day after Royal Assent. The draft also creates removal notices for apps and websites designed for, or predominantly used to generate, fake nude material. App distribution services and search engines would have 24 hours to comply, with penalties of 6,000 penalty units. The government's own summary adds expanded search-engine link-deletion powers.
Misinformation is not named as a harm category. Corrs notes the draft focuses on specific harms such as violence, exploitation and grooming rather than false information generally. That is a real and welcome restraint: Australia has not tried to legislate a truth test.
Why the misinformation silence is not the end of the story
A bill can avoid the word and still enlarge the machinery. Every measure above widens the set of things eSafety can order down, and every shortened clock reduces the time a platform has to ask whether an order is lawful. Platforms facing multimillion-dollar exposure and a 24-hour deadline have a strong incentive to comply first and question later. Over-removal is the predictable result, and it falls hardest on lawful speech at the margins: satire, news reporting, medical or educational nudity, and political criticism that a complainant calls abusive.
Search-engine link deletion has particular free-speech weight. A link removal does not touch the underlying page, so it is easy to treat as low-stakes, but for most users a page that cannot be found is a page that does not exist. Widening this power without published thresholds, review rights and transparency reporting is the kind of quiet expansion that ends up doing work no one debated.
The Baumgarten problem
This draft arrives months after a ruling that exposed how informally the current system operates. In eSafety Commissioner v Baumgarten [2026] FCAFC 12, decided on 18 February 2026, the Full Federal Court dismissed the Commissioner's appeal and held that an informal request to remove content, made outside the formal statutory notice powers, could be subject to merits review. The case concerned a post on X about a school event, and the court rejected the argument that such a request was beyond review even though the platform treated it as something it had to comply with.
The lesson is that the gap between a formal notice and a "request" matters, because platforms respond to both as if they were binding. The draft's lower deadlines and wider notice categories make that gap more consequential. If the Commissioner's informal requests are reviewable, then the bill's new powers should be built to be reviewable from day one, with reasons given to the affected poster, not only to the platform.
A proportionate version
The duty of care itself has a useful safeguard. The "reasonably practicable" test weighs harm likelihood, mitigation options and cost, and Corrs reports that it also considers whether safety measures create privacy impacts "grossly disproportionate to the risk". Proportionality of that kind is what a pro-innovation regime should demand of every measure, not just the duty.
Three changes would keep the draft's benefits while reducing its risks:
- Keep 24 hours for the narrow, clear-cut categories such as non-consensual intimate imagery, but allow a short, documented extension for contested cyber-abuse and cyber-bullying claims, where context determines lawfulness.
- Write review rights into the bill. Make explicit that removal notices and link-deletion orders are reviewable, and that the person whose content is affected is notified and can be heard, consistent with Baumgarten.
- Require transparency reporting on the number of notices, the share contested, and the share reversed, so Parliament can see whether over-removal is occurring.
The fake-nude provisions are the easiest to defend, since the target is tools built for a harmful purpose. Even so, definitions such as "predominantly used to generate" should be tight enough that general image-editing or AI tools are not swept in.
Australia is right to move from complaint-by-complaint enforcement toward systemic duties. But a statute that never says "misinformation" can still change what people are able to say online. The next draft should show, in the text, that shorter deadlines come with stronger checks.