Does the Digital Duty of Care apply to online shops?

What the Bill says: The Bill does not mention online shops or any website platform by name. A shop website is an online service like any other, and the duty sits with whoever provides it and whoever has the greatest day-to-day control (section 25B).
Our reading: A store on Shopify, WooCommerce, Wix or Squarespace is likely covered, and the store owner is the responsible person. A store with only products and a checkout is at the low-risk end.
Not yet decided: Whether low-risk shops will be exempted from written risk assessments, and where customer reviews sit on eSafety's risk scale.

Is a basic online shop low risk?

On what has been said so far, yes. A shop where customers browse, pay and get an order email has no interaction between users, no messaging and no chatbot. Those are eSafety's early criteria for the lowest-risk services. The Department expects sites like this to face a short checkbox assessment.

Is Shopify, Wix or Squarespace responsible instead of me?

No. The Bill puts the duty on the provider of a service and on whoever has the greatest day-to-day control of it. For your shop, that is you. The platform is responsible for its own service. Building on a platform does not move the duty off your business.

Does it matter if I use WooCommerce or WordPress?

The Bill does not distinguish between website tools. With self-hosted software such as WordPress and WooCommerce you control more, including plugins for reviews, forums and chat. Check which of those are switched on. Features left on by default still count.

What if I only sell on eBay, Etsy, Amazon or Facebook Marketplace?

Then you are a user of someone else's service, and the marketplace carries the duty for it. A seller account or store page on a marketplace is not your own online service. This changes if you also run your own website.

What if my shop also has a blog or news section?

Articles you write yourself add no risk, because they are your own content. The comment box underneath them is what matters. Many shop themes switch blog comments on by default.

Example

A homewares shop sells through a checkout and posts a monthly news article. With comments off, it has no user content and sits at the low-risk end. With comments on, anyone can publish under each article, and the shop moves to moderate risk. If the Bill passes, the owner can switch comments off or hold them for approval. For now it is enough to know they are on.

Do product reviews change things?

Yes. Product reviews let customers publish on your site. Holding them for approval and giving people a way to report one are the main safeguards. See the guide to reviews and comments.

Are "you might also like" product recommendations a problem?

Mostly no. The Bill's strict rule on recommender features applies only to social media services. A shop must still protect children from harms linked to its design features in general, so note recommendations in your risk assessment. See the detail.

What if I sell products for children?

Selling children's products to parents does not by itself mean children use your site. What matters is whether children are likely to be users. If they are, the Bill expects you to consider harms specific to them.

What if I sell alcohol, vapes or other adult products?

Age-restricted products already have their own laws. Under the Bill, material that is harmful to children is a central concern, so a shop showing adult products should expect to explain how it keeps children away from them. We rate age-restricted content as higher risk in our checker.

Do shop apps and plugins matter?

Yes, when they add a feature on the list: review apps, community apps, wishlists that are public, and AI shopping assistants. Make a list of installed apps and note what each lets a customer do. See which features raise risk.

Sources

Last updated 14 November 2026