As we have written about before, the Australian government is proposing legislation that would put the design and operation of online platforms under direct supervision by the eSafety Commissioner. While the Bill has improved since September’s exposure draft, core problems remain. The Minister can no longer unilaterally add new categories of “seriously harmful” material, and the covert powers behind September’s “sock puppet” headlines (a story we first broke last month) have been narrowed.

Unfortunately, core problems remain. The Bill drops the draft’s explicit privacy safeguard, even as it encourages more extensive age checks that may involve biometric data. It also makes eSafety an “enforcement body” under the Privacy Act, able to collect sensitive information without consent, and lets it share what it gathers with any Commonwealth agency without independent approval.

Below is our submission on the Bill as passed by the House of Representatives, lodged on 29 October 2026:

TO: Senate Environment and Communications Legislation Committee

FROM: liber-net

CONTACT: Andrew Lowenthal, CEO

DATE: 29 October 2026

RE: Bill as passed by the House of Representatives on 28 October 2026

Dear Committee,

liber-net is a digital civil-liberties organisation defending freedom of expression and digital rights. We urge the Committee to recommend that the Senate reject the Digital Duty of Care (DDoC) Bill in its entirety.

The DDoC pushes far beyond Australia’s existing, more targeted online safety rules to impose an unprecedented anticipatory duty on platforms at the systems level.

The duty relies on convoluted and contestable concepts of harm and safety, backed by extraordinary surveillance and investigatory powers. The substantial penalties for non-compliance will also likely pressure platforms to pre-emptively suppress lawful expression of Australian citizens.

Beyond our concerns with the legislation itself, our recent investigations raise serious questions about the public campaign surrounding the DDoC. The Albanese government and mining billionaire Andrew Forrest have financed a large network of researchers, civil society organisations and media productions that, we argue, has steered public attention towards the Government’s My Feed, My Way messaging at the expense of scrutiny of the Bill’s more consequential powers. [Our full investigation is available here.]

Given the involvement of public money and the national broadcaster, we recommend that the Committee investigate the extent of private financial influence over the development and promotion of the Bill, including funding relationships, government consultations, and potential conflicts of interest involving publicly funded media. Parliament should scrutinise these matters before considering whether to grant such extensive new regulatory powers.

We acknowledge improvements since the September exposure draft: the Minister can no longer add categories of seriously harmful material by instrument, covert AI-generation powers have been narrowed, and feed-choice tools have been strengthened. However, many of the Bill’s underlying problems remain, and we therefore maintain our recommendation that it be rejected in its entirety.

Our principal concerns include:

1. Lack of privacy safeguards

Although section 26A retains a general requirement for safety measures to be proportionate to the risk of harm, the revised Bill removes the September draft’s express requirement to consider whether those measures would disproportionately intrude on users’ privacy.

This is a significant omission, given that compliance may encourage more monitoring of user behaviour and collection of personal information. General proportionality to safety risks is not a substitute for an explicit privacy safeguard, making this one of the revised Bill’s most significant regressions for digital rights.

This concern is compounded by the Bill’s age-assurance provisions. The legislation’s different protections for children and adults create incentives for more extensive age-assurance controls, potentially involving biometric data, which is classified as “sensitive information” under Australian privacy law when used in specified ways. The Bill thus encourages greater collection of sensitive data just as it removes the express requirement to consider such privacy risks.

2. Expanded surveillance and information-sharing powers

The Bill designates the eSafety Commissioner as an “enforcement body” under the Privacy Act 1988, allowing it to collect “sensitive information” without consent where reasonably necessary for, or directly related to, its functions. It also enables other entities to disclose personal information for enforcement-related activities conducted by or on behalf of eSafety.

Under the Privacy Act, these activities expressly include “surveillance activities, intelligence gathering activities or monitoring activities”. We also note that eSafety’s “functions” and “enforcement-related activities” will be expanded to become extremely broad under the DDoC, leaving significant room for privacy violations against Australian citizens.

The Bill also significantly expands eSafety’s information-sharing powers. Amendments to section 212 of the Online Safety Act 2021 broaden the existing list of authorised recipients to include any “Commonwealth entity”, potentially allowing information obtained through eSafety’s investigations and compulsory powers to circulate across a far wider range of government agencies.

The Commissioner need only be satisfied that the disclosure will enable or assist the receiving entity to perform one of its functions or powers. The provision does not require consent or prior independent approval, and any conditions on further handling of the information are discretionary.

Taken together with compulsory information-gathering powers and covert accounts, these changes create substantially broader avenues for obtaining, using and sharing Australians’ personal information, including sensitive information.

We consider these powers disproportionate to a civil online safety regulator’s remit and insufficiently protected by independent oversight. Replacing existing industry codes and standards with a general preventative duty compounds these concerns, removes established regulatory detail, and leaves considerable discretion over compliance boundaries to the regulator.

3. A dangerous precedent for online expression

There should be a strong presumption against allowing governments to intrude into the digital architecture that determines what information reaches Australian citizens. The systems that effectively control how content is distributed are central to the free exchange of ideas and the functioning of a democratic society. Granting the state broad authority to reshape these systems establishes a potentially dangerous precedent.

Once the principle of government intervention in the architecture of online expression is accepted, the boundaries of that intervention may become increasingly difficult to contain. Parliament should approach this prospect with considerable caution, rather than treating it as an ordinary extension of existing online-safety regulation.

4. An attempted manufacturing of consensus

liber-net’s investigation has exposed an extensive network of funding, institutional access, and aligned advocacy behind the campaign for the Digital Duty of Care. This network extends into taxpayer-funded media, the national broadcaster and prominent advocacy organisations with substantial financial ties to the Albanese government and mining billionaire Andrew Forrest’s Minderoo Foundation.

These relationships raise serious questions about the public campaign’s independence and the extent to which an apparent groundswell of support has been shaped by powerful political and financial interests. We urge the Committee to recommend that the Senate reject the Digital Duty of Care Bill in its entirety as well as to  undertake a thorough investigation into the financial, institutional and regulatory relationships surrounding its development and promotion. liber-net stands ready to provide evidence, assist the Committee, and pursue further lines of inquiry.

Parliament should not grant the state sweeping new powers over the digital architecture through which Australians communicate and receive information without first establishing their necessity, proportionality and implications for fundamental freedoms.

The Senate should not legislate first and investigate later.

Submitted by liber-net  |  Andrew Lowenthal, CEO