- What the Bill says
- It applies to every person responsible for an online service, which includes websites and apps that people in Australia can use (section 25B). There is no threshold for business size, turnover or user numbers.
- Our reading
- A small business that runs its own website or app is likely covered. A business that only has a page on someone else's platform is a user of that platform, and the duty for it sits with the platform.
- Not yet decided
- Whether low-risk websites will be exempted, and what a low-risk site would have to record. The Minister can make exemptions only after the Bill is law.
The table shows how common setups are likely to be treated. This is our reading of the Bill as passed by the House of Representatives. It has not been tested by eSafety or a court.
| Your setup | Likely in scope? | What it means |
|---|---|---|
| Brochure website with a contact or booking form | Likely | Lowest risk. A short risk assessment. See what one might look like |
| Online shop | Likely | Low risk unless customers can post reviews or content |
| Site with public reviews or comments | Likely | You would need a way to report and remove harmful posts |
| Forum, community or member area | Likely | Higher risk, because users interact with each other |
| Site with an AI chatbot | Yes | The Bill names AI services directly. The highest-risk feature for most small sites |
| Facebook or Instagram page only | No | The platform provides the service and carries the duty for it. You are a user |
| You host or manage websites for others | Yes | Hosting is its own category |
Does it apply to a brochure website?
Likely yes. A website that only shows information and takes enquiries still falls within "designated internet services", and the Bill has no size threshold. The work should be small: a short risk assessment that records the low risk and how you handle problems.
Sites like this are the obvious candidates if the Minister makes an exemption for low-risk services. See the latest on the exemption.
Does it apply to my Facebook or Instagram page?
No, on the Bill's wording. The duty falls on the person responsible for an online service: its provider, and whoever has the greatest day-to-day control of it (section 25B). For Facebook and Instagram that is the platform. A business with a page or account is a user of the service.
The same applies to a Google Business Profile, a LinkedIn page, a YouTube channel or a TikTok account. Two practical points remain:
- The platform's own rules may change as it meets its duty, which could affect what you can post and how comments are handled.
- Moderating comments on your page is still good practice, and other laws such as defamation already apply to them.
If you also run your own website, the Bill is likely to apply to that.
Does it apply if my site is on Wix, Squarespace, Shopify or WordPress?
Likely yes. The Bill does not mention any website platform, and which one you use makes no difference to whether it applies. On our reading, building your site with a website builder does not move the duty: you still provide your website to the public, and the platform is responsible for its own service.
We name these platforms only as familiar examples. The same reasoning applies to any website builder or hosting company.
Does it apply to sole traders?
Yes, on the Bill's wording. It applies to the person responsible for an online service, whatever their business structure. Maximum penalties for individuals are lower than for companies.
Who is responsible if an agency built or runs my website?
On our reading, you are, as the provider of the site. The Bill also names the person with the greatest degree of day-to-day control. If an agency or IT provider administers your site, they may be responsible alongside you. The explanatory memorandum says this rule gives no defence to liability. On our reading, that means a contract cannot move the duty off either of you.
A written agreement is still worth having. It should say who controls what, who does the risk assessment and who keeps the records. Who is responsible can turn on the exact arrangement, so this is a point to check with a lawyer.
Does a "recommended for you" section count?
Mostly no, for an ordinary business website. The Bill has two separate rules about design features, and only one of them reaches beyond social media.
- The strict rule is for social media only. Section 25C says that on a social media service, children under 16 must not have access to design features with "negative behavioural impacts". Recommender features are on that list. This rule does not apply to a website that is not a social media service.
- The general rule applies to everyone. Every covered service must protect children from harms associated with its design features. The Bill does not define "design features" here, so it has its ordinary meaning.
The Bill's definition of a recommender feature is wide: a feature that picks material using information linked to a user's account and shows it to that user. COSBOA told the Senate inquiry this could describe a shop that shows tailored products to logged-in customers. The Department told the Senate hearing on 10 November 2026 that the negative behavioural impacts rule relates specifically to social media.
In practice, a product recommendation panel would be something to note in your risk assessment under the general rule. It would not be banned for under-16s unless your service is a social media service.
Does it matter who uses my site?
Yes. The Bill gives children extra protection. If your users include under-18s, as with sports clubs, tutoring or hobby groups, your risk assessment needs to consider harms specific to them.
Sources
Last updated 14 November 2026