- What the Bill says
- The Bill requires appropriate action to protect users from harmful material and conduct, in proportion to the risk (sections 26 and 26A). It names no particular feature as prohibited.
- Our reading
- Forums, messaging between users and uploads that others can see put a site at the higher-risk end. They are the first things on eSafety's early list of what a lowest-risk site does not have.
- Not yet decided
- What eSafety will expect of a small site that has these features. Its guidance and risk assessment requirements are not published.
Why do these features raise risk more than reviews?
Because the harm can happen between users, out of your sight. A review sits in public where you can read it. A forum thread can turn on one member, a private message is seen only by the person who receives it, and an uploaded image can be harmful in ways text cannot. The Bill is concerned with conduct as well as material.
Do I need to change anything now?
No. As at 14 November 2026 the Bill is not law, and nothing here is required. The practices below are how these features are managed safely. They are worth knowing now so you can weigh up each feature, and they would matter if the Bill passes.
How would a small business manage a forum or member area?
- Weigh up what it is worth. A busy forum can justify the work. A quiet one may not.
- Publish short rules that say what is not allowed and what happens when someone breaks them.
- Name a moderator and decide how often they look.
- Hold a new member's first posts for approval.
- Put a report link on every post, and make sure reports reach a person.
- Be able to remove a post and suspend a member quickly, and keep a note when you do.
How would a small business manage messaging between users?
- Ask whether users need to message each other at all. Messages to your business are low risk. Messages between members are not.
- Give users a way to block and report another user.
- Avoid private messaging between adults and children. It is one of eSafety's early markers of risk, and it is poor child-safety practice under any law.
- Limit who can start a conversation, for example to members who share a class or a booking.
- Know what you can see. Check whether your platform lets an administrator review reported messages.
How would a small business manage photo, video and file uploads?
- Separate private from public. A photo sent to your staff with a quote request is close to a contact form. A photo other users can see is not.
- Hold public uploads for approval before they appear.
- Restrict file types and sizes to what you need.
- Take extra care with images of children. Follow your consent policy online as you would in print.
- Remove a harmful upload straight away and record the date.
What changes if children use these features?
The risk rises again. Children get extra protection under the Bill, and adults and children interacting is on eSafety's early list of what a lowest-risk site does not have. A tutoring portal, a junior club members' area or a gaming community should plan for stricter settings than a site for adults.
What if the forum or chat is run by another company?
A community hosted on another company's platform, such as a Facebook group or a third-party chat app, is that company's online service. You are a user of it. A forum or chat plugin installed on your own website is part of your site.
What should I write down?
For each feature, record what it lets users do, who looks after it, how a problem is reported, and what you do when one is. Those notes are the core of a risk assessment for these features. See a worked example.
Is this legal advice on how to comply?
No. These are sensible practices for running community features safely, and they line up with what the Bill is concerned about. eSafety has not said what it will require. Treat this as direction to start from.
Sources
Last updated 14 November 2026