Proposed Digital Duty of Care and Christian Schools

The Proposed Digital Duty of Care and Christian Schools

The Australian Government has released an exposure draft of the Online Safety Amendment (Digital Duty of Care) Bill 2026.

The proposed reforms would introduce a new overarching duty requiring providers of online services to proactively identify and mitigate foreseeable risks of serious harm to Australian users.

The legislation is primarily directed at online service providers, including social media, messaging and gaming services, apps, search services and emerging technologies such as artificial intelligence tools.

It is not primarily directed at schools. However, there are potential implications for Christian schools, particularly through the digital platforms schools use and the way online content is moderated.

There are other concerns that this bill’s scope is not strictly limited and does not have direct parliamentary oversight.

The current exposure draft fails to provide an objective legal limit to a Communication Minister’s powers to determine what is unlawful content. The Minister has suggested she is open to removing some of these powers, but other structural issues may remain in this bill.

Importantly, this is currently an exposure draft, has not been tabled in parliament for formal debate, and is not yet law. The Government is consulting widely, including with the general public, before legislation is introduced.

What is being proposed?

Under the proposed framework, organisations responsible for online services would be expected to take reasonable and proactive steps to provide a safe online environment.

In broad terms, the exposure draft legislation has these main parts:

Core duty and “safe online environment”: Online services must take reasonable measures to protect users from speciﬁed harms, document those measures, and keep them eﬀective over time. ^{[1] [2] [3]}
Categories of harm: The bill sets out “seriously harmful material and conduct” (for all users) and additional harms speciﬁcally for children/teenagers, including illegal content (e.g. child sexual abuse material, terrorism) and some non-criminal but harmful categories (e.g. pornography for under-16s, material encouraging eating disorders, bullying, and certain sexist/misogynist attitudes). ^{[4] [5] [2]}
Ministerial expansion of harms: The Communications Minister can, by the included legislative instrument, add further categories of “seriously harmful” or child-harmful material/conduct where satisﬁed it “may cause serious harm”, without returning to Parliament to amend the primary Act.^{[5] [2]}
Risk assessments and safety-by-design: Providers must conduct written risk assessments identifying foreseeable risks (including content, design features, systems, and aﬀected people), assess likelihood/severity, implement mitigation measures, and review them; eSafety can set requirements for how these are done.^{[3] [6] [2]}
Recommender systems and “My Feed, My Way”: The draft targets algorithmic features (recommender systems, endless feeds, etc.) as having potential “negative behavioural impacts”, especially for children, and contemplates ministerial rules requiring “user empowerment tools” that aﬀect what content is recommended, including an opt-out from personalised recommendations. ^{[6] [7] [1] [4]}
Enforcement toolkit for eSafety: The Commissioner gets stronger powers to issue remedial directions, compel information/documents, examine witnesses, seek civil penalties (up to ~$109.2 million), publish transparency reports, and require Australian points of contact.^{[8][1] [3]}
Faster takedowns and link deletion: Existing removal timelines are tightened (e.g. some 48-hour windows cut to 24 hours); the Commissioner can more easily act on reposted/altered versions of previously removed material and can order search engines to stop providing links to certain harmful material.^{[3] [6]}
Limited carve-outs: There is an express protection for lawful private adult communications, but no equivalent ironclad protection for lawful public political or religious speech.^{[9] [3]}

What could this mean for Christian schools?

For most Christian schools, the immediate regulatory impact is likely to be limited.

Schools using third-party platforms would generally not be expected to assume responsibility for the design or operation of those platforms.

However, the definition of an “online service” will be important.

Schools increasingly operate their own digital environments, including learning management systems, student and parent portals, websites and apps, online discussion forums, livestreaming services and virtual classrooms.

Christian schools support strong and effective measures to protect children from genuine online harm.

At the same time, the proposed framework needs to distinguish clearly between harmful conduct and lawful religious and educational expression.

Terms such as “harm”, “serious harm” and “safe online environment” need sufficient clarity so that platforms are not encouraged to remove lawful content simply because it addresses difficult or contested issues.

The current exposure draft fails to provide an objective legal limit to a Communication Minister’s powers to determine what is unlawful content.

Section 25C of the Online Safety Act defines “seriously harmful material and conduct” as including child sexual abuse and exploitation, grooming, material encouraging sexual or extreme violence, explicit threats of rape or death, material encouraging suicide or self-harm, terrorist material and material encouraging criminal offences.

In paragraph 25C(1)(m) the definition of harm also includes “any other material or conduct” as determined under the next subsection.

And, according to subsection 25C(2), the Communications Minister (‘the Minister’) may, by the provided legislative instrument, determine additional material or conduct that the Minister is satisfied “may cause serious harm”.

An indication of how broadly this could expand can be deduced from the following section that deals with conduct considered harmful to children. This section captures material or conduct that “encourages or promotes hostile attitudes towards women or gender equality”, as per paragraph 25D(1)(c).

It is unclear in the bill what a “hostile attitude” means and whether platforms would be legally bound to block children seeing content on biological or social differences between men and women, opposing biological males in women’s private spaces or sport, or supporting only protective and healing treatments for people confused about their gender or sexuality.

This issue of legislative overreach was thrown into the spotlight when, on September 9, the Communications Minister Anika Wells said on a News24 TV program that “the test for what would constitute a new serious harm would ultimately, I guess, be made by me.”

It is also unclear how platforms can mitigate the risk of increased government intervention, costly court procedures and fines due to allowing content classified as ‘child-harm’ to be viewed by someone aged under 16.

The well-known failures of the current social media ban, wherein up to 85% of teenagers are still on social media, means it is unclear if platforms will be overzealous in their content moderation to ensure that they are not subjected to damaging enforcement actions.

In December 2025, Human Rights Commissioner Lorraine Finlay argued that Australia’s under-16 social media ban risked creating widespread surveillance, while also creating valuable databases of personal, financial and identity information, including millions of Australian adults, that are vulnerable to breaches. Ms Finlay argued, “We’re moving to a world where the law requires you to be profiled in order to participate.”¹⁰

Could a school be “responsible” in this proposed legislation?

According to the exposure draft’s current wording in Section 25A, an online service provided by a school could be captured.

Section 25A focuses on the nature and functionality of the service, rather than whether the provider is a commercial technology company, school, charity, or government body.

There is no automatic exclusion for schools, educational services, small providers, or closed user groups.

Under s 25A(2), the responsible person includes:

the person providing the service; and
anyone positioned to exercise day-to-day control over it.

Where a school develops, hosts, or directly operates its own website, portal, LMS, or messaging platform, the school would likely be responsible.

The position is less clear with third-party software. For example:

the technology company may provide the underlying platform;
the school may control its particular environment, accounts, permissions, content, and student access; and
both may potentially be responsible, depending on how the relevant “service” is identified and who exercises day-to-day control.

The use of “each” in s 25A(2) appears to contemplate more than one responsible person.

The draft does not clearly explain whether routine tenant administration by a school constitutes day-to-day control of a separate online service. Nor does it expressly protect individual principals, ICT managers, or other staff from being characterised as responsible where they have operational control. These points require clarification.

Merely directing students to an independently operated third-party service would be less likely to make the school its provider.

The position changes where the school contracts for, configures, brands, administers, or substantively controls a dedicated school instance.

No automatic educational exemption

Section 25A(3) only gives the Minister a discretion to exempt services that:

pose little risk to Australian users; or
are used minimally in Australia.

A school cannot simply assess itself as low-risk and claim the exemption. An exemption would need to be made by legislative instrument and could be partial or conditional.

Before making it, the Minister must seek and consider the Commissioner’s advice under s 27B.

A small, single-school portal might have an argument that it is used minimally in Australia. However:

“used minimally” is undefined;
a small number of users may still use the service intensively;
the users are predominantly children, whom the draft treats as requiring additional protection; and
a nationally supplied LMS may be assessed as one broadly used service rather than hundreds of small school environments.

The exemption power could therefore assist schools, but provides no certainty unless an express class exemption is made.

Consequences if captured

A school responsible for a covered service could be required to:

ensure, so far as reasonably practicable, a safe online environment under s 26;
manage relevant design features and implement required controls under s 26(3)(a), including making moderation requests within 48 hours;
conduct written risk assessments at least annually and before relevant service changes under s 26A;
document mitigation measures and their expected effectiveness;
retain assessments for six years; and
provide assessments within 30 days of a request.

Proportionality under s 25H should reduce what is reasonably required of a small school service, but it does not remove the mandatory risk-assessment requirement. Relief from that requirement would apparently require an exemption under s 25A(3).

Two further issues are particularly relevant to schools:

The private-communications exclusion in s 26(7) applies only to lawful private communications solely between consenting adults. It does not exempt student-to-student or teacher-to-student communications.
There is no express educational-purpose protection for legitimate curriculum content dealing with sexuality, eating disorders, violence, crime, terrorism, or contested social issues. Context may affect whether content “encourages” or “promotes” harm, but the draft does not expressly say so. This drafting risk has also been identified in external legal analysis. ^[6]

Overall assessment

The clearest interpretation of this exposure draft is that school-provided websites, portals, learning platforms, communication tools, and some AI tools would be captured unless expressly exempted.

The draft’s breadth appears capable of making schools regulated online-service providers, even though the policy materials principally discuss technology companies and services across the technology stack. The Government’s earlier policy paper expressly contemplated broad application to all services already within the Act. ^[7]

For independent and Christian schools, the strongest drafting requests include:

an express exclusion or proportionate class exemption for school-operated educational services;
clarification that procuring or administering third-party software does not automatically make a school responsible for the underlying service;
clear confirmation that the principal regulatory duty rests with organisations that design, operate and control online services, rather than schools that simply use those services;
appropriate recognition of educational settings and the role of schools in teaching, pastoral care and community communication;
moderation systems that take account of context, educational purpose, age, intent and audience;
appropriate protection for freedom of religion, freedom of expression, privacy and access to information;
protection for lawful religious teaching and faith-based educational content;
strong student privacy protections, particularly in relation to identity and biometric information;
proportionate requirements that do not impose major-platform compliance obligations on individual schools or small school networks; and
clear guidance and practical support for schools as the reforms are implemented.

What do schools need to do now?

No immediate compliance action is required. The proposal remains an exposure draft and may change following consultation.

Schools should nevertheless continue to maintain strong online safety, privacy and digital-use practices.

Christian Schools Australia, and many other partners, will monitor the development of the Bill and engage with the Government as the proposal progresses.

The central principle guiding our advocacy is straightforward: protecting children online and protecting lawful faith-based education should not be competing objectives.

A well-designed Digital Duty of Care should be strictly limited and have direct parliament oversight. It should address harmful conduct and unsafe platform design while ensuring that lawful religious teaching, pastoral care and educational discussion remain protected.

References: