Digital Duty of Care Bill: A Hobart Business Guide

Australia introduced the Online Safety Amendment (Digital Duty of Care) Bill 2026 to Parliament on 15 October 2026. It is not yet law. The proposal is aimed mainly at providers of online services—such as social media, games, apps and AI chatbots—rather than every ordinary small-business website. Still, Hobart businesses that run digital products, host user content or rely on online platforms should understand the direction of travel and review their safety processes now.

This guide explains what the Bill proposes, who is most likely to be affected and what practical steps a Tasmanian business can take without treating an unfinished law as a settled compliance checklist.

What happened on 15 October 2026?

The Australian Government introduced the Online Safety Amendment (Digital Duty of Care) Bill 2026 to Parliament. According to the Minister for Communications’ 15 October announcement, the Bill would move Australia’s online-safety regime further towards prevention: covered services would need to take reasonable steps to reduce foreseeable serious harm before it occurs.

The Bill follows a government consultation process and an exposure draft released on 8 September 2026. The Department’s exposure-draft page records that public feedback closed on 22 September. The introduced Bill may change as Parliament considers it, so businesses should follow the final wording and commencement arrangements rather than relying on early summaries.

What does “digital duty of care” mean?

At a practical level, a digital duty of care means designing and operating an online service with foreseeable harms in mind. Instead of waiting for a complaint and removing harmful material afterwards, a covered provider would be expected to identify risks, apply reasonable safeguards and review whether those safeguards work.

The government’s announcement says the proposed framework would set minimum safety standards for services including games, apps and AI chatbots. It would also require stronger protections for people under 18 and would give the eSafety Commissioner additional powers. Announced measures include:

• proactive steps to reduce seriously harmful material, conduct and service features;
• specific protections for users under 18;
• minimum standards for complaints and dispute processes;
• a shorter response period for cyberbullying and abuse complaints, from 48 hours to 24 hours;
• powers directed at “nudify” apps and websites; and
• penalties of up to $109.2 million for non-compliance.

Those are headline features of the Bill as introduced. They are not a statement that every Tasmanian business faces the maximum penalty, nor that every business website is automatically a covered service.

Does the Bill apply to an ordinary Hobart business website?

A standard brochure website, online menu, booking page or contact form is not the obvious target of the reform. The government describes the Bill as placing obligations on online services and “big tech”, with examples such as social platforms, games, apps and AI chatbots. A local accountant’s informational site or a restaurant’s booking site is different from a service that recommends content, hosts communities or lets users interact at scale.

However, the boundary deserves attention when a business does more than publish information. Your risk profile may be higher if you:

• operate an app, online game, marketplace or membership community;
• allow public profiles, comments, messaging, uploads or reviews;
• use automated recommendations or personalised feeds;
• provide an AI chatbot that gives users open-ended responses;
• offer a service used by children or teenagers; or
• moderate user disputes, harassment reports or harmful material.

Even where a small business is not directly regulated, the reform may influence the terms, tools and moderation expectations of the major platforms it uses. It can also shape what customers regard as responsible digital service design.

“My Feed, My Way” and algorithmic choice

A prominent part of the announcement is “My Feed, My Way”. The government proposes that Australians over 16 should be able to choose whether a social media service’s primary feed uses recommended content or shows the people and pages they chose to follow.

The Department opened a separate choice-of-feeds consultation on 15 October 2026. It says the Bill would allow the Minister to make a user-empowerment rule after Royal Assent. The proposed rule is therefore not operating yet. Consultation on how it should work is open until 5 November 2026.

For Hobart businesses that market through social media, a following-only option could affect how audiences discover unpaid posts. It is too early to predict reach or engagement changes, but it reinforces a familiar lesson: do not build your entire customer relationship on an algorithm you do not control. Maintain an accessible website, useful first-party content and consent-based email or SMS channels alongside social activity.

What Hobart businesses should do now

There is no need to launch a costly compliance project before Parliament has settled the law. There is value, however, in documenting the basic controls that a well-run digital service should already have.

1. Map the interactive parts of your service

List every place where a user can submit, receive or share content: forms, reviews, account profiles, chat, uploads, forums, direct messages, recommendation tools and AI features. Note which functions are delivered by your own software and which come from a third-party provider.

If you are planning a new site or app, put these requirements into a clear website design brief before development begins. Retrofitting moderation, reporting and user controls later is usually harder than designing them in from the start.

2. Identify foreseeable harms and vulnerable users

Consider realistic misuse, not every imaginable event. For a local marketplace, that might include scams, abusive messages or unsafe listings. For a youth program, it could include grooming risks, bullying or inappropriate uploads. For an AI assistant, it may include harmful advice, fabricated claims or disclosure of personal information.

Record who could be affected, how serious the harm might be, what controls already exist and who owns the follow-up action. This can sit alongside your broader small-business cyber-security plan; online safety and cyber security overlap, but they are not the same thing.

3. Make reporting and complaints easy

Users should be able to find a reporting path without hunting through legal pages. Use plain labels, acknowledge reports and document escalation steps for urgent safety issues. If your contact process is the starting point, check that it works for keyboard and screen-reader users and follows the principles in this guide to accessible contact forms.

4. Review vendors and platform dependencies

Ask app, hosting, community and AI suppliers how they handle content reports, audit logs, safety controls, age-related protections and incident escalation. Confirm what your business can configure and what remains the supplier’s responsibility. A vendor’s feature list is not a substitute for understanding your own users and risks.

5. Keep marketing channels resilient

The proposed feed-choice rule is another reason to diversify. Make your website the reliable source of service information, and use channels where customers have clearly agreed to hear from you. A well-planned Hobart business website can give customers a stable destination when platform feeds change. For text campaigns, the separate SMS Sender ID rules for Australian businesses are also worth checking; they address identity and trust rather than the Digital Duty of Care.

6. Watch the parliamentary process

Assign one person to monitor the Bill, eSafety guidance and any final rules. Recheck the scope, definitions, exemptions, commencement dates and transitional periods after passage. If your organisation operates a platform, app or user community, obtain advice that reflects the final legislation and your actual service design.

What not to do

• Do not describe the Bill as current law. It was introduced on 15 October 2026 and still requires parliamentary consideration.
• Do not assume a social-media policy covers your own product. A platform account, a public forum and an AI feature create different risks.
• Do not collect more personal data “just in case”. Safety measures still need to respect privacy and data-minimisation principles.
• Do not rely only on automated moderation. High-risk reports need clear human escalation and review.
• Do not promise compliance before the final requirements exist. Document sensible preparation and revisit it when authoritative guidance is available.

A practical Hobart example

Imagine a Tasmanian tourism operator launching an app where visitors can create profiles, upload photos, message local guides and receive AI-generated itinerary suggestions. That service is more complex than the operator’s brochure website. A sensible pre-launch review would test reporting tools, block-and-mute controls, moderation queues, youth access, AI guardrails, response ownership and vendor escalation.

By contrast, a small accommodation business using a third-party booking engine and publishing its own room information would start with a lighter review: check the booking provider’s terms and safety contacts, secure the website, make complaints easy and keep customer communications clear. The final Bill and rules—not the size of the business alone—will determine formal obligations.

Frequently asked questions

Is Australia’s Digital Duty of Care law already in force?

No. The Bill was introduced to Parliament on 15 October 2026. It must complete the parliamentary process and receive Royal Assent before it becomes an Act. Detailed rules and commencement arrangements may also be required.

Will every Australian small-business website need a risk assessment?

The government’s published material focuses on providers of online services such as social media, games, apps and AI chatbots. It does not support treating every brochure website as if it were a large digital platform. Businesses with interactive services, user-generated content or under-18 users should examine the final scope more closely.

What is a following-only social media feed?

It is a feed centred on accounts and pages a user chooses to follow, rather than content selected primarily by a recommendation algorithm. The government is consulting on a proposed rule that would require social media providers to offer Australian logged-in users that choice.

Should a Hobart business change its social strategy now?

Not on the basis of predicted algorithm changes. The practical move is to reduce dependence on any single platform: keep your website useful, build consent-based customer channels and measure which sources generate real enquiries or sales.

Where should businesses follow updates?

Use the Australian Parliament’s bill records, the Department of Infrastructure and Communications website and eSafety guidance. Check publication dates and distinguish an exposure draft, an introduced bill, an amended bill and an enacted law.

The bottom line

The Digital Duty of Care Bill signals a stronger prevention-first approach to online safety in Australia. Most ordinary Hobart business websites are not the main target described by government, but businesses operating apps, communities, AI features or user-to-user services have good reason to map risks and responsibilities now. Keep the work proportionate, follow the Bill’s progress and base any formal compliance decision on the final law.