Online Safety Amendment (Digital Duty of Care) Bill 2026

Milton Dick

The question now is that the amendments circulated by the honourable member for Bradfield be agreed to.

Member for Bradfield's circulated amendments—

(1) Schedule 2, item 6, page 33 (before line 22), before the definition of data access rules, insert:

annual global turnover, of a body corporate for an income year, has the meaning prescribed by the rules for the purposes of this definition.

(2) Schedule 2, item 6, page 34 (after line 8), after the definition of harmful to children, insert:

income year has the same meaning as in the Income Tax Assessment Act 1997.

(3) Schedule 2, item 8, page 45 (lines 14 to 17), omit section 26C, substitute:

26C Compliance with the digital duty of care

(1) A person must not fail to comply with the person's digital duty of care.

Civil penalty:

(a) if the person is not a body corporate—60,000 penalty units; or

(b) if the person is a body corporate—the greater of:

(i) 300,000 penalty units; and

(ii) 5% of the person's annual global turnover for the income year in which the contravention of this subsection occurs.

(2) Despite paragraph 82(5)(a) of the Regulatory Powers Act, the pecuniary penalty payable by a body corporate for a contravention of subsection (1) of this section must not be more than the pecuniary penalty specified in paragraph (1)(b) of this section.

(4) Schedule 2, item 8, page 48 (line 31), omit the penalty, substitute:

Civil penalty:

(a) if the person is not a body corporate—60,000 penalty units; or

(b) if the person is a body corporate—the greater of:

(i) 300,000 penalty units; and

(ii) 5% of the person's annual global turnover for the income year in which the contravention of this subsection occurs.

(5) Schedule 2, item 8, page 48 (after line 31), after subsection 27B(1), insert:

(1A) Despite paragraph 82(5)(a) of the Regulatory Powers Act, the pecuniary penalty payable by a body corporate for a contravention of subsection (1) of this section must not be more than the pecuniary penalty specified in paragraph (1)(b) of this section.

Nicolette Boele

I rise to speak to the amendment that I've moved. A duty of care is only as strong as the consequences for breaching it, and, under this bill, the maximum penalty for a company that breaches its duty of care is around $109 million. For almost any Australian business, this would be ruinous, but we're not talking about almost any business. Last year, Meta took in more than US$200 billion in revenue. That means it brings in $109 million in about three hours. If a company can earn back their fine before lunch, it doesn't deter any behaviour; it's just a small additional cost to doing business. This amendment lifts the maximum penalty for a company that breaches the duty of care or fails to meet its risk assessment and user empowerment obligations to the greater of around $109 million or five per cent of annual global turnover. This isn't radical; it's catching up. In the EU, fines can reach six per cent of global turnover; in the UK, it's 10 per cent of worldwide revenue. Canada is proposing up to three per cent and five per cent for criminal fines. New Zealand is proposing up to 10 per cent of worldwide revenue. Australia has led the world on online safety. We shouldn't now be too soft on these companies when they breach their obligations.

I've heard three objections to this amendment. Firstly, it's the reputational risk, not the dollar figure, that drives compliance. Well, I can say that social media companies are among the least trusted industries in the world. They have gone through scandal after scandal, and their behaviour hasn't changed. Reputation clearly isn't doing the work. Secondly, there is no precedent for penalties based on global turnover. Well, courts in the UK and Europe are already working through exactly these cases. The point of these penalties is not to raise revenue; the point is to encourage and drive compliance. The bigger the stick, the less likely we are to ever need to use it. And thirdly, this could strain our relationship with the United States. This is a maximum of up to five per cent. The courts keep full discretion to impose lower penalties. It applies to every company equally, wherever it's headquartered, and it's entirely reasonable for Australia to set Australian laws to protect Australian children. So, paired with a private right to action, which I urge the government and the Senate to take up, enforcement would rest with Australians themselves, not just the government.

I would like to commend the member for Curtin for leading the charge on the crossbench's advocacy on this issue. She was initially going to introduce this amendment alongside the range of other amendments that she's proposing but was generous enough to suggest that I introduce it instead. Parents in my electorate tell me they feel powerless against these platforms. This bill tells those parents that the platforms now owe their children a duty of care. This amendment makes sure that the platforms take that duty seriously. I commend the government's work on this critical legislation, and I urge the government to adopt and implement my amendment.

Anika Wells

I thank the member for Bradfield for her amendment to increase maximum penalties. The bill proposes $109.2 million, which is consistent with other consumer protection fines in Australia. While that may seem like a negligible amount for $1 billion company who did just unblushingly pay $25.6 billion in fines to New Mexico a few weeks ago, it's important to remember we're not doing this alone. This is supposed to be a global coalition. It's having a cumulative effect. There is a global reckoning coming. This is part of it. We're leading the way. We do want to see behavioural change from these companies. That is our shared end goal. Thank you.

Colin Boyce

There being no further speakers, I'll put the question. The question is that the amendments moved by the member for Bradfield be agreed to.

Question negatived.

The question now is that the amendments circulated by the member for Fowler be agreed to.

Member for Fowler's circulated amendments—

(1) Schedule 2, item 6, page 34 (after line 20), after the definition of seriously harmful material or conduct, insert:

small business entity: a person is a small business entity at a time if the person is a small business entity (within the meaning of the Income Tax Assessment Act 1997) for the income year (within the meaning of that Act) in which the time occurs.

(2) Schedule 2, item 8, page 36 (after line 13), at the end of Division 1, add:

25AA Small business entities

Exemption

(1) This Part does not apply in relation to a person who is responsible for an online service if the person is a small business entity.

When the exemption does not apply

(2) Subsection (1) does not apply in relation to an online service if the online service:

(a) allows end-users to post, share or send material to other end-users, or to communicate in other ways with other end-users; or

(b) provides, or links to, pornography; or

(c) generates, enables end-users to generate, provides, or links to, AI-generated nudity; or

(d) is targeted at children.

(3) If the Commissioner is satisfied that an online service poses a material risk of serious harm to users of the service in Australia, the Commissioner may declare, in writing, that subsection (1) does not apply in relation to the online service. The declaration has effect according to its terms.

(4) The Commissioner must ensure that a declaration made under subsection (3) is published on the Commissioner's website as soon as is practicable after the declaration is made.

(5) A declaration made by the Commissioner under subsection (3) is not a legislative instrument.

Interpretation

(6) In this section:

AI-generated nudity means an image or video that:

(a) is generated or altered, wholly or partly, using artificial intelligence; and

(b) depicts, or appears to depict, a person in a state of nudity, whether:

(i) the person is real or fictional; or

(ii) the depiction is realistic or non-realistic.

(3) Schedule 2, item 8, page 45 (lines 8 to 9) omit subsection 26A(3), substitute:

(3) For the purposes of subsection (1), the cost of the action or measures:

(a) must not be taken into account if the person responsible for the online service is not a small business entity; and

(b) must be taken into account if the person responsible for the online service is a small business entity.

(4) Schedule 2, Part 3, page 83 (after line 22), at the end of the Part, add:

58 Delayed application to small business entities

Small business cost assessment

(1) The Minister who administers the Online Safety Act 2021 must cause an independent assessment to be conducted of the likely costs for small business entities of complying with Part 2 of the Online Safety Act 2021 (as amended by Part 1 of this Schedule).

(2) The person conducting the assessment must give the Minister a written report of the assessment.

(3) The Minister must cause a copy of the report of the assessment to be tabled in each House of the Parliament within 15 sitting days of that House after the Minister receives the report.

Delayed application of amendments

(4) If a responsible entity for an online service is a small business entity, Part 2 of the Online Safety Act 2021 (as amended by Part 1 of this Schedule) applies in relation to the responsible entity after the end of the period of 6 months beginning on the first day on which a copy of the report of the assessment has been tabled in both Houses of the Parliament as mentioned in subitem (3).

Note: Section 25AA of the Online Safety Act 2021 (as amended by Part 1 of this Schedule) provides for an exemption from Part 2 of that Act for small business entities in certain circumstances. Nothing in this subitem affects that exemption. The effect of this subitem is that, for small business entities that are not covered by that exemption, Part 2 of that Act will apply to those entities only after the end of the 6-month period mentioned in this subitem.

Interpretation

(5) A term that is used in this item that is defined in the Online Safety Act 2021 (as amended by Part 1 of this Schedule) has the same meaning in this item as it has in that Act.

Long debate text truncated.