Website features at a glance
| Feature | Effect on risk | Why |
|---|---|---|
| Pages of information | None | You wrote and control everything on them |
| Contact or enquiry form | None | Messages come to you and are not shown to other users |
| Booking system | None | No user content is published |
| Checkout and customer accounts | None on their own | Buying is not interaction between users |
| Newsletter sign-up | None | One-way communication from you |
| Live chat with your staff | Low | A private conversation between you and a customer |
| Public reviews or comments | Raises it | Other people can post material on your site |
| Forum, community or member area | Raises it more | Users interact with each other |
| Photo, video or file uploads others can see | Raises it more | Images and video carry the most serious harms |
| Messaging between users | Raises it more | Private contact, including between adults and children |
| AI chatbot | Raises it more | The Bill names AI services directly |
The risk ratings are our reading of the Bill, the submissions and the hearing evidence. eSafety has not published its criteria.
What does eSafety count as lowest risk?
eSafety told a Senate hearing on 10 November 2026 that its early criteria for the lowest-risk services are:
- no interaction between users
- no user messaging
- no interaction between adults and children
- no AI chatbot.
eSafety said these are early and it will consult before settling them. More on what was said.
Does a contact form count?
On our reading, a contact form does not raise your risk. What a visitor types goes to you and is not shown to anyone else. Your website is still an online service under the Bill, so a contact form does not take you out of scope. It simply adds nothing to the risk.
Does an online booking system count?
No more than a contact form. A booking system collects details and takes a time slot. Nothing the customer enters is published to other users. If your booking tool is run by another company, that company is responsible for its own service.
Does a checkout or customer login count?
Not on its own. Selling products and holding customer accounts is not interaction between users. Two things attached to shops can matter: customer reviews, and product recommendations tied to an account. See the guide for online shops.
Does live chat count?
Live chat staffed by people is low risk. It is a private conversation between your business and one customer. A chat window answered by AI is different, because the Bill lists services that generate material using AI. See the chatbot guide.
Do reviews and comments count?
Yes. Once the public can post on your site, other people's material appears under your name. That is the feature most small business sites have that raises their risk. See the guide to reviews and comments.
Does a forum or member area count?
Yes, and more than reviews. A forum or community lets users talk to each other, which is the first thing on eSafety's list. The risk rises again if members can send private messages or if some members are children. See the guide to forums, messaging and uploads.
Do photo and video uploads count?
Yes, if other users can see them. The most serious material the Bill deals with is images and video. An upload that only your staff see, such as a photo attached to a quote request, is closer to a contact form.
What about embedded videos, maps and social feeds?
On our reading, an embedded video, map or social media feed is content you have chosen to show. It is part of your site, and you can remove it. The comments and interaction happen on the other company's service, which carries its own duty.
Should I remove a feature to lower my risk?
Not yet. The Bill is not law, and nothing requires a change today. What is worth doing now is weighing up what each feature is worth to your business, so the decision is easy if the Bill passes.
Even then, the Bill asks for appropriate action to manage risk. It does not ask you to strip your site back. A feature that earns its place can stay with safeguards. A comment section nobody uses may not be worth keeping.
Sources
- Parliament of Australia: the Bill, its explanatory memorandum and progress
- Senate committee public hearing, Canberra, 10 November 2026 (our account is drawn from the broadcast; the official Hansard transcript was not yet published when we checked)
- Senate inquiry submissions: COSBOA (no. 65), the eSafety Commissioner (no. 129), the Department (no. 130) and DIGI (no. 90)
Last updated 14 November 2026