Digital Duty of Care Bill 2026: What early childhood services need to know

The Australian Government has released an exposure draft of the Online Safety Amendment (Digital Duty of Care) Bill 2026, proposing a new legal framework to place greater responsibility on online service providers to prevent foreseeable harm.

The draft Bill would amend the Online Safety Act 2021 and represents a significant proposed expansion of online safety regulation, particularly in relation to children, harmful content and platform design.

It was published on 8 September 2026. Feedback is open until 12 noon on Tuesday 22 September 2026.

The proposal is primarily directed at providers and controllers of online services. It does not automatically impose new duties on every early childhood education and care (ECEC) service. However, it is relevant to the sector because services increasingly rely on digital platforms for family communication, learning documentation, image sharing, enrolment and administration.

The exposure draft would introduce a new digital duty of care requiring a person responsible for an online service to ensure, so far as reasonably practicable, a safe online environment.

A person responsible for a service would include:

• The provider of the online service
• A person in a position to exercise day-to-day control of that service.

The proposed definition of an online service is broad and includes social media services, hosting services, search engines, app distribution services, internet services and certain services that allow users to create and share artificial intelligence-generated material.

A safe online environment would be intended to protect Australians from seriously harmful material and conduct, while providing additional protection for children from harmful content and risks associated with online design features.

The draft identifies seriously harmful material and conduct relating to child sexual exploitation and abuse, grooming, sexual violence, extreme violence, serious harassment, suicide and self-harm, terrorism, criminal activity and illicit drug use.

It also identifies content harmful to children, including pornography and material that encourages, promotes or provides instruction for disordered eating.

The proposed framework would address design features that may contribute to negative behavioural impacts. These include:

• Recommender features
• Logged-in features
• Endless feeds
• Feedback feeds
• Time-limited features
• Other features determined by the Minister.

For social media services, the draft proposes that design features with negative behavioural impacts would not operate for Australian children under 16.

The Bill would also allow the Minister to require specified online services to provide user empowerment tools, such as controls over the type of content recommended to users.

A central proposal is a requirement for providers of online services to complete written assessments of the risks of harm posed by their services in Australia.

The assessments would need to identify:

• Foreseeable risks
• Content, design features and processes contributing to those risks
• People who may be affected
• The likelihood and potential severity of harm
• Measures implemented or proposed to address the risks
• The expected effectiveness of those measures.

Providers would be required to review the effectiveness of their controls regularly and reassess risks before making changes that could introduce new or additional risks.

The draft proposes that assessments be completed at least annually, retained for at least six years and provided to the eSafety Commissioner within 30 days if requested.

The exposure draft would give the eSafety Commissioner additional powers to monitor and enforce compliance.

These would include the ability to:

• Issue formal warnings
• Give remedial directions
• Publish digital duty of care guidelines
• Request risk assessment information
• Require complaint and dispute processes for prescribed online services.

The proposed maximum civil penalty for failing to comply with the digital duty of care is 60,000 penalty units. A further civil penalty of up to 60,000 penalty units could apply if a person failed to comply with a remedial direction.

The draft also contains separate proposed removal powers for certain material, including fake nude material, with notices potentially requiring apps, links, advertising or access to be removed.

The Bill is aimed at online service providers, not at making ECEC services responsible for the design or safety of every platform they use.

Its direct application to services will depend on the final legislation, the categories of online services covered and any exemptions or legislative instruments made after the Bill is considered.

Nevertheless, the proposed reforms provide a timely reason for approved providers and service leaders to review their digital governance.

ECEC services commonly use platforms for:

• Family messaging
• Digital portfolios
• Photographs and videos
• Enrolment and attendance records
• Cloud-based administration
• Staff communication
• Online learning and professional development
• Social media engagement.

Services should understand what their platform providers are responsible for and what remains the responsibility of the service.

Without assuming the Bill will become law in its current form, services can strengthen their existing digital safety arrangements by:

• Mapping every digital platform used by the service
• Reviewing contracts, privacy terms and data-handling arrangements
• Checking how children’s images and personal information are stored and shared
• Reviewing consent and withdrawal processes
• Confirming user access, permissions and administrator controls
• Updating digital communication and social media policies
• Clarifying staff expectations for personal devices and online contact with families
• Providing training on privacy, image sharing and responding to online harm
• Documenting how digital risks are identified, controlled and reviewed
• Asking platform providers about their safety, moderation and incident-response processes.

These actions can support existing privacy, child safety, governance and risk-management responsibilities. They should complement, rather than replace, the service’s obligations under applicable ECEC legislation, approved policies and child safe requirements.

The Digital Duty of Care Bill 2026 remains an exposure draft and is not currently in force. The consultation process may result in changes to its scope, definitions, obligations and penalties.

The Australian Government is accepting feedback until 12 noon on Tuesday 22 September 2026 at [email protected].

ECEC providers should monitor the consultation outcome and any subsequent legislation or guidance issued by the Australian Government and the eSafety Commissioner.

For now, the proposal is best understood as a reminder that digital safety is part of broader child-safe governance. Services do not need to wait for new legislation to ensure that the platforms they use support children’s privacy, safety and wellbeing.

Access the information on the Australian Government here.