NableU submission — Online Safety Amendment (Digital Duty of Care) Bill 2026

Title: NableU submission — Online Safety Amendment (Digital Duty of Care) Bill 2026 Receiving body: Senate Environment and Communications Legislation Committee Inquiry: Online Safety Amendment (Digital Duty of Care) Bill 2026 Jurisdiction: Australia Closing date: 30 October 2026 Organisation: NableU Community Systems Incorporated ABN: 20 437 808 371 Representative: Nathan Organ, Founder

Executive summary

NableU Community Systems Incorporated opposes the Online Safety Amendment (Digital Duty of Care) Bill 2026 in its present form and asks the Committee to recommend that Parliament reject it. The proposed framework is too broad, its central obligations insufficiently bounded, and the safeguards for lawful expression, privacy, accessibility, individual agency and small community services inadequate. These are structural defects. They should be resolved in legislation before Parliament confers substantial new powers on a regulator or expects services to comply.

NableU is an Australian, disability-led public-benefit organisation developing participant-controlled support matching, accessible community infrastructure, online communications and governed AI assistance. Our constitutional objects include human rights, dignity, agency, autonomy, cognitive equity, cognitive sovereignty, disability inclusion, research and public policy advocacy. Our work makes the interaction between safety rules and access to support concrete: where an online service enables someone to find a support worker, communicate a disability-related need, challenge a provider or join a trusted community, wrongful restriction of that service can itself cause harm.

We support enforceable action against child sexual exploitation, grooming, credible threats, non-consensual intimate imagery, severe harassment and other demonstrable harms. We also support genuine user control over recommendation systems, stronger complaint handling and effective remedies. Parliament need not choose between online safety and civil liberty. A well-designed scheme can protect both. The current Bill has not yet achieved that balance.

The principal concerns are:

1. An imprecise duty coupled with a high penalty ceiling. Proposed sections 26 and 26A require a safe online environment and appropriate and effective measures, while proposed subsection 26A(3) excludes cost when judging those measures. This risks incentivising excessive content removal and disproportionate obligations.
2. Broad categories of lawful material. The child-harm categories in proposed section 25E include concepts requiring judgments about attitude, ideology and psychological effect. The Bill does not establish sufficiently precise context, seriousness and causal thresholds to prevent over-removal of legitimate debate and support information.
3. Failure to differentiate risk and capacity. Duties potentially extending across social media, hosting, search, games and AI services can capture small Australian not-for-profits that neither create large-scale amplification systems nor have the resources of dominant platforms.
4. Insufficient attention to disability and cognitive equity. The scheme should expressly assess the harm caused by erroneous exclusion, identification requirements, inaccessible complaints, automated misclassification and loss of assistive community services.
5. Oversight and remedy gaps. Expanded investigatory and research powers need privacy controls, while users require independent remedies when platforms incorrectly suppress speech or terminate access.
6. Unproven replacement of targeted protections. Parliament should not retire established codes and standards until an itemised analysis demonstrates equal or stronger protection for serious online harms.
7. Evidence integrity and adult access. Parliament must distinguish experimental recommendation audits from representative population evidence and require safeguards against unnecessary identification or blanket restrictions where a user's age is unknown.

1. NableU's interest and expertise

NableU is an incorporated Australian community organisation established to reduce barriers experienced by people with disability, neurodivergent people, people with cognitive and executive-function support needs, and their families. We design digital systems around clear authority, informed and revocable consent, accessible communication, minimal unnecessary identity collection, traceable evidence and reviewable safeguarding decisions. [1]

Our principal software programme is an NDIS and community-support ecosystem where participants can discover suitable workers, manage relationships, communicate, plan services and develop practical independence. Its wider programme includes local NableHoods, community participation, career support and carefully bounded AI assistance. The safeguarding design differentiates observed risk from low evidence and insists that algorithmic recommendations do not acquire authority over people merely by appearing confident. [2]

This perspective is directly relevant to the proposed duty. A platform used to access disability support has a safety profile fundamentally different from a mass-recommendation entertainment platform. Its regulatory assessment must include the consequences of denying support, autonomy and participation as well as the consequences of exposure to harmful content. A regime that encourages systems to remove people, speech or functionality without reliable reasons can undermine the protective purpose of the law.

2. The central duty must be objectively bounded and practicable

The Bill's proposed section 26 imposes the overarching digital duty of care. Proposed section 26A describes the steps and measures by which compliance is assessed. The introduced Bill uses an 'appropriate and effective' test in place of the earlier exposure draft's 'reasonably practicable' formulation, and proposed subsection 26A(3) excludes cost as a relevant consideration in that assessment. [5, 8]

Safety obligations must be enforceable, but they must also be possible to interpret and discharge. A service cannot guarantee that no harmful conduct will ever occur. Reasonable and effective protection requires analysis of the service's actual features, what it can control, the likelihood and severity of the relevant harm, available alternatives, the competing rights affected and the proportionality of the response.

The Government has announced maximum civil penalties of $109.2 million for non-compliance. [3] Coupling this scale of liability with uncertain operational requirements produces a predictable incentive: when providers cannot confidently distinguish lawful disagreement from regulated harm, they may block speech, require broader identity evidence, restrict interaction or withdraw services altogether. Those consequences are particularly severe for organisations that depend on trusted online participation rather than advertising or engagement-based revenue.

NableU recommends that section 26 be reframed as a duty to take reasonable and proportionate measures to prevent or mitigate clearly defined, reasonably foreseeable serious harm within the provider's practical control. Section 26A should expressly require consideration of effectiveness, feasibility, alternative approaches, freedom of expression, privacy, accessibility, disability inclusion, and the risk of harm from excessive restriction. Remove the cost exclusion in proposed subsection 26A(3): cost should not excuse wilful neglect of serious harm, but refusing to consider it at all is unsound regulatory design.

3. Protect lawful expression, public debate and access to knowledge

The proposed section 25E categories for harm to children include material or conduct encouraging or promoting hostile attitudes towards women or gender equality. Protecting children from targeted abuse and the normalisation of violence is legitimate. However, 'hostile attitudes' is not a sufficiently determinate criterion for platform-wide speech governance without a clear connection to serious harm and explicit consideration of context. [3, 5]

Platforms will encounter political argument, philosophical disagreement, historical analysis, satire, personal testimony, health and medical debate, religion, disability advocacy and discussion of sex and gender. A legal obligation that does not clearly distinguish such expression from abuse invites automated or defensive removal. The concern is indirect suppression through provider incentives, not the assertion that the Bill itself criminalises disagreement.

A rights-protective rule should evaluate the actual conduct, audience, context, severity, intent where relevant, and the evidence connecting content to a defined harm. It should expressly protect good-faith public-interest discussion, factual reporting, academic work, artistic expression, support-seeking and evidence-based criticism of public authorities and service providers. Exclusions for professional news and entertainment material, including those addressed in proposed section 25F, should not imply that unlicensed community reporting or grassroots advocacy is unworthy of equivalent contextual safeguards.

This issue is not confined to one point of politics. Any government can inherit and reinterpret broad powers. Parliament should legislate standards that remain fair when opinions, regulators and governments change. The Australian Human Rights Commission's response to the September exposure draft likewise called for clearer harm definitions, tighter ministerial rule-making and explicit human rights consideration in risk assessment. [6]

3.1 Distinguish hostility towards people from disagreement about policy

The attitude-based category in proposed subsection 25E(1)(c) requires particular scrutiny. Support for women's equal civic standing does not entail agreement with every quota, institutional practice, educational policy or interpretation advanced in the name of gender equality. Criticism of such measures must not, by itself, establish hostility towards women or danger to children. [5]

The legislation should require a context-sensitive assessment of the conduct and its connection to demonstrable serious harm. It should distinguish threats, incitement and targeted abuse from lawful political disagreement, philosophical inquiry, satire, research, testimony and criticism of government. Those protections must apply to community members and independent advocates as well as recognised media organisations.

3.2 Constrain predictive and residual harm categories

The residual category in proposed subsection 25E(1)(f), concerning other material or conduct that may cause serious harm to children, must be bounded by evidence of seriousness, probability and causal connection. A theoretical possibility should not be enough to justify restricting lawful participation. Parliament should specify the threshold and require reasons that an affected person can understand and independently challenge. [5]

A finding that an opinion is objectionable cannot substitute for evidence that it creates a sufficiently serious and reasonably foreseeable risk. This safeguard should sit in the operative legislation, not depend on assurances about how the present Government intends the power to be used.

3.3 Preserve lawful health information and support-seeking

The framework must distinguish encouragement of self-harm, coercion and targeted harassment from lawful health information, prevention work and help-seeking. Palliative Care Australia's response to the exposure draft identified the risk that reliable information about lawful voluntary assisted dying could be caught and requested an explicit exclusion. [15] This illustrates the need for precise, context-sensitive safeguards. NableU supports protecting legitimate access to health information without providing a defence for abuse or coercion.

4. Evidence integrity: the 23-minute claim and recommendation research

On ABC Insiders on 30 August 2026, the Minister for Social Services described a new account created by a young Australian boy as receiving violent misogynistic material after an average of 23 minutes. The published transcript does not identify the underlying study. The Committee should require the Government to table that source and any additional evidence supporting its population-level characterisation. [12]

Dublin City University's April 2024 report, Recommending Toxicity, used ten artificial accounts across TikTok and YouTube Shorts, including two controls. Researchers deliberately searched, watched and liked selected content in the experimental accounts. It reports exposure to broadly coded toxic material within 23 minutes; that is not a representative Australian average. Its coding extended beyond violence to alpha masculinity, anti-feminism and right-wing content. The authors caution that their generic accounts do not represent all boys or men. [13]

This design can reveal recommendation feedback loops under specified conditions. It does not itself establish population-average exposure, changes in users' attitudes or a causal increase in violence. Those are different research questions. A small or artificial-account study is not inherently worthless, but its results must be stated at the level its design supports.

If the DCU report underlies the ministerial statistic, its experimental scope, content categories and distinction between an upper-bound exposure time and an average must be accurately represented. If another study underlies the claim, the Government should identify it. The Committee should not have to infer the evidentiary basis for a central public justification of coercive regulation.

NableU requests an evidence schedule separating material encountered; recommendation behaviour observed; demonstrated injury; and the effectiveness of the proposed legal remedy. It should identify definitions, sampling, control conditions, uncertainty, generalisability, causal limitations and independent replication. The Government should explain how each proposed restriction addresses the demonstrated mechanism and why less restrictive alternatives are inadequate.

An association between selected content and algorithmic amplification does not, without further evidence, establish that the Bill's chosen restrictions will reduce violence or other serious harm. The Committee should require that additional link, together with measures of wrongful restriction, disability exclusion and privacy costs. Evidence-based regulation requires scrutiny of the intervention as well as the problem.

5. Adult access, age assurance and the pressure to over-restrict

A duty to protect children from broad categories of content raises a practical question for services with mixed-age audiences or users whose age is unknown. A provider may respond by demanding age evidence, restricting the material for everyone, or removing the feature altogether. This is a foreseeable compliance incentive; it should not be confused with an assertion that the Bill expressly requires every Australian to provide government identification.

In the Minister for Communications' National Press Club address on 15 October 2026, the Government expressly defended adults' ability to consume contested viewpoints, criticise government and choose their feeds. [14] NableU asks Parliament to give those assurances enforceable effect. Adult access, privacy and lawful pseudonymous participation should not depend on a provider's willingness to absorb uncertain enforcement risk.

Any replacement framework should require the least intrusive effective age-assurance approach, accessible alternatives, limits on collection and retention, and protection against unnecessary linkage of age information to identity or activity. A provider should be required to consider narrower feature-level or audience-level safeguards before blanket removal of lawful content. A person's refusal or inability to provide excessive identity information must not automatically be treated as misconduct.

For disability-focused services, these requirements are practical. A participant may need to contact a worker, seek advice or challenge a provider without disclosing additional sensitive information. Regulatory risk assessments must include interruption of that access, the cognitive burden of verification, and accessible review when age estimation or account restrictions are wrong. Protective measures should reduce demonstrable harm without turning essential digital participation into a permission contingent on unnecessary disclosure.

6. Disability, neurodivergence and cognitive equity must be built into the test of safety

Digital access is often a condition of real-world participation. People with disability may depend on online services to obtain support, raise safeguarding concerns, coordinate an appointment, exercise consumer choice, access plain-language information and find peers who understand their experiences. The United Nations Convention on the Rights of Persons with Disabilities recognises accessibility, freedom of expression and access to information, and participation in public life; Australian policy should give those rights practical effect. [7]

NableU identifies five foreseeable design failures requiring explicit legislative treatment:

• Over-classification of communication. Direct or unconventional phrasing, distress, trauma disclosures and neurodivergent communication styles can be falsely classified as aggressive or dangerous when assessed without context.
• Loss of access to essential networks. An automated suspension may prevent a participant from contacting a support worker, reading an agreed support plan or escalating a safety issue.
• Procedural exclusion. Systems that rely on telephone calls, rapid responses, complex forms or unclear notices prevent some users from contesting decisions despite technically offering an appeal.
• Unnecessary identification. Broad age or identity checks can expose sensitive disability or family information, create disproportionate barriers and deter legitimate participation.
• False risk presentation. Treating a lack of rating, documentary evidence or conventional communication as proof of danger can penalise newly registered workers and participants without an evidentiary basis.

The risk assessment duty should therefore assess not only exposure to prohibited material or conduct, but the risks created by mitigation measures themselves. A proportionate framework should require disability-inclusive consultation and testing, accessible reasons, supported decision-making, human reconsideration of consequential automated actions, plain-language communication, and data-minimising alternatives. These requirements should be enforceable, not merely aspirational guidance.

7. Small not-for-profit and community services require a distinct compliance pathway

The introduced framework has potentially broad reach across multiple types of digital service. A service's existence on the internet does not make its risk profile equivalent to a platform operating global recommendation infrastructure. [4, 8]

For example, a small community organisation may host an invitation-based discussion space with human moderators, no behavioural advertising, minimal recommendation algorithms and strong consent boundaries. A requirement designed for a global platform's trust-and-safety department could consume resources intended for accessibility, safeguarding and direct support. If compliance costs become an entry barrier, the regime can unintentionally strengthen dominant platforms and reduce the diversity of Australian services.

NableU recommends statutory risk tiers based on functionality, reach, user population, demonstrable harm and the service's actual ability to control that harm. Low-risk not-for-profit services need simplified assessments, meaningful exemptions or safe harbours, free and accessible regulatory guidance, staged implementation and an opportunity to remedy deficiencies before severe enforcement. These adjustments should be in the Act rather than dependent entirely upon discretionary future ministerial exemptions.

An organisation's small size should not excuse serious misconduct or neglect; a service that creates a substantial risk must address it. Proportionality means the obligation should correspond to the risk and capacity actually present, not to a nominal category shared with much larger companies.

8. Privacy and investigative powers must be constrained

The Bill proposes expanded regulatory powers and a researcher-access framework, including provisions addressing decision-making algorithms and pseudonymous investigation. Independent evaluation can identify genuine safety defects. But sensitive support systems cannot be treated as unrestricted research datasets. [5, 9]

A participant's disability profile, support relationship, location, communications and safeguarding history may be highly sensitive. The default expectation should remain data minimisation, secure handling, explicit purposes and narrow access authority. Bulk or speculative collection, insecure onward sharing and unnecessary persistence create risks that a general safety duty may otherwise fail to account for.

NableU recommends statutory necessity and proportionality requirements for access requests; independent approval for intrusive activity; limits on researcher access to personal or sensitive communications; documented and auditable use of assumed identities; access controls and retention limits; prompt notification where consistent with a lawful investigation; and independent review of demands and remedial directions. Algorithm inspection should focus on necessary compliance evidence without indiscriminately exposing users' private records or commercially sensitive systems.

9. Complaints and appeals need independent, accessible remedies

Platforms can cause serious harm through inaction, but also through inaccurate moderation and arbitrary exclusion. Both failures deserve remedies. An internal complaint pathway is insufficient when the service making the contested decision also controls the evidence, process, timetable and outcome.

On 15 October 2026 the Telecommunications Industry Ombudsman called for free, independent dispute resolution within the proposed framework. On 28 October, federal crossbench members publicly advanced an external ombudsman model for digital-platform disputes. [10, 11] NableU supports a statutory independent pathway capable of reviewing both wrongful failure to act and wrongful content removal, account restriction or loss of access.

Users should receive intelligible reasons; the policy, evidence and rule applied; a right to submit additional context; accessible written communication; reasonable timeframes; a human reviewer for consequential decisions; and a free external escalation mechanism with power to recommend or require practical remedies. Exceptions for urgent safety and lawful confidentiality can be narrowly defined.

For a disabled person who cannot use a telephone, a nominal complaints line is not a functional remedy. For someone whose account is the gateway to support services, a months-long review may be no remedy at all. Accessible and timely resolution should be a statutory design requirement.

10. Preserve demonstrated protections during the regulatory transition

The proposed replacement of the Basic Online Safety Expectations and existing industry codes and standards with a wider duty warrants close scrutiny. Current protections address specific serious harms, including child sexual abuse material and terrorist or extreme violence material. [4, 9] Replacing detailed obligations with a high-level duty could improve regulatory coherence, but it must not leave an enforceability gap.

Before repeal or transition, the Government should table a provision-by-provision equivalence assessment identifying each current protection, the new provision or instrument that replaces it, the enforceable test, responsible regulator, commencement date, and how continuity will be verified. Protections should remain in force until equivalent or superior safeguards have commenced and been independently assessed.

The Committee should also require publication of the delegated instruments and guidance that will materially determine service obligations, meaningful consultation with small operators and disability communities, and a clear commencement timetable. Significant substantive duties should be enacted or subject to parliamentary disallowance, rather than left to guidelines that cannot be effectively challenged by Parliament.

11. Requested recommendations

NableU requests that the Committee recommend the following actions to Parliament:

1. Reject the Bill as introduced. Require a replacement developed through a human-rights, disability-accessibility and small-service impact process, rather than attempting to resolve the core defects solely through later guidance.
2. Rewrite proposed sections 26 and 26A around reasonable and proportionate measures against defined, reasonably foreseeable serious harm within a provider's control; expressly include impact on lawful expression, privacy, disability access and mitigation-caused exclusion.
3. Remove proposed subsection 26A(3) so feasibility and cost may be assessed alongside severity, likelihood and effectiveness, without permitting a cost-based excuse for serious and preventable harms.
4. Clarify section 25E and related definitions, particularly subsections 25E(1)(c) and 25E(1)(f), by requiring an objective serious-harm threshold, a demonstrable causal connection, proportionate likelihood assessment and contextual review. Disagreement with a policy advanced as promoting equality must not itself establish hostility towards women. Protect lawful political, scientific, journalistic, religious, artistic, academic and disability-rights discussion, whether published by institutions or community members.
5. Introduce statutory low-risk and community-service pathways with proportionate risk assessments, staged commencement, published safe harbours and non-punitive first-response remediation for minor compliance deficiencies.
6. Embed cognitive accessibility and non-discrimination, including accessible notices, written communication options, supported decision-making, human review and an explicit duty to assess the harm caused by wrongful exclusion and excessive verification.
7. Protect privacy by design, prohibiting identity or sensitive-data collection beyond what is necessary and proportionate, and placing independent oversight, retention limits and review rights around researcher and regulator access.
8. Create free independent digital-platform dispute resolution, with enforceable timelines and remedies for both under-removal of serious harm and over-removal of lawful content or access.
9. Retain existing targeted safeguards through transition until Parliament receives and independently assesses a complete equivalence schedule; make major delegated standards subject to meaningful parliamentary scrutiny.
10. Require an independent statutory review after commencement, using published measures of serious-harm reduction, erroneous restriction, accessibility failures, privacy impacts, compliance cost and market concentration, with specific evidence from disability-led and small Australian services.
11. Require an auditable evidence schedule, including the source of the public 23-minute claim, separating experimental observations from population estimates, exposure from demonstrated injury, and recommendation behaviour from behavioural causation. Assess whether each proposed legal remedy is effective and less restrictive alternatives are inadequate.
12. Protect adult access and privacy in age assurance, requiring accessible, proportionate and data-minimising methods; meaningful alternatives to excessive identity disclosure; protections for lawful pseudonymous participation; and effective review of age-related or blanket restrictions.

12. Conclusion

NableU asks the Committee to consider the long-term institutional consequences of the powers Parliament is being asked to create. Broad safety duties can be implemented in ways that protect people, or in ways that concentrate discretion, suppress lawful discussion and make essential digital participation harder. The distinction must be secured by the legislation itself.

We favour enforceable, evidence-based protections against genuine harm. We reject a scheme in which unclear obligations, exclusion of practical feasibility and severe penalties encourage defensive censorship or drive smaller community infrastructure out of operation. Safety is incomplete when it protects users from one class of risk by stripping them of agency, communication, privacy or access to support.

NableU therefore requests that the Committee recommend that the Online Safety Amendment (Digital Duty of Care) Bill 2026 not be passed in its current form. We seek a revised framework that protects Australians from serious online harm while preserving the fundamental conditions of human participation: dignity, autonomy, cognitive equity, accessibility, due process and freedom of expression.

The organisation welcomes an opportunity to provide further written evidence and to participate remotely in a public hearing if invited. Written correspondence is preferred.

Nathan Organ Founder For and on behalf of NableU Community Systems Incorporated NSW Incorporated Association INC2601035 https://nableu.org

References

[1] NableU Community Systems Incorporated, Constitution, adopted 31 July 2026, cl 3.1(a)–(g); incorporation issued by NSW Fair Trading 4 August 2026, INC2601035.

[2] NableU, Current product principles and governance, `README.md` and `docs/TRUST_DISPLAY_SEMANTICS.md`, repository: https://github.com/norgan/NableU (accessed 28 October 2026).

[3] Australian Government, Department of Infrastructure, Digital duty of care bill introduced, 20 October 2026: https://www.infrastructure.gov.au/department/media/news/digital-duty-care-bill-introduced

[4] Australian Government, Department of Infrastructure, Digital Duty of Care (introduced 15 October 2026): https://www.infrastructure.gov.au/media-communications/internet/online-safety/digital-duty-care

[5] Parliament of Australia, Online Safety Amendment (Digital Duty of Care) Bill 2026, first reading, bill r7553 (15 October 2026): https://www.aph.gov.au/Parliamentary_Business/Bills_Legislation/Bills_Search_Results/Result?bId=r7553

[6] Australian Human Rights Commission, Digital Duty of Care Exposure Bill, 23 September 2026 (comments on the earlier exposure draft): https://humanrights.gov.au/our-work/submissions/technology-and-human-rights/digital-duty-of-care-exposure-bill

[7] United Nations, Convention on the Rights of Persons with Disabilities, arts 9, 21 and 29; Australian Government implementation context: https://www.ag.gov.au/rights-and-protections/publications/australian-government-implementation-article-33-crpd

[8] Pinsent Masons, Digital duty of care legislation introduced into Australian parliament, 21 October 2026 (introduced-Bill scope, obligation and cost analysis): https://www.pinsentmasons.com/out-law/news/digitial-duty-of-care-legislation

[9] Digital Rights Watch and Wotton Kearney, Digital Duty of Care Submission Guide, update 23 October 2026 (introduced-Bill changes distinguished from September exposure draft): https://digitalrightswatch.org.au/2026/10/22/digital-duty-of-care-submission-guide/

[10] Telecommunications Industry Ombudsman, Digital Duty of Care must give Australians somewhere independent to turn when online services fail, 15 October 2026: https://www.tio.com.au/news/digital-duty-of-care-must-give-australians-somewhere-independent-to-turn-when-online-services

[11] ABC News, Clare Armstrong, Australians could get free avenue to challenge big tech under crossbench digital duty of care amendment, 28 October 2026: https://www.abc.net.au/news/2026-10-28/crossbench-push-for-labor-to-challenge-big-tech/107316400

[12] Department of Social Services Ministers, Minister Plibersek interview on ABC Insiders with David Speers, 30 August 2026; opening exchange on social media and the 23-minute claim: https://ministers.dss.gov.au/transcripts/19251

[13] Catherine Baker, Debbie Ging and Maja Brandt Andreasen, Recommending Toxicity, DCU Anti-Bullying Centre, Dublin City University, April 2024; research design, experiment procedure, time of first exposure and methodological limitations: https://www.dcu.ie/antibullyingcentre/recommending-toxicity

[14] Minister for Communications, Address to the National Press Club, 15 October 2026; assurances concerning adult expression and user choice: https://minister.infrastructure.gov.au/wells/speech/address-national-press-club

[15] Palliative Care Australia, Exposure Draft Online Safety Amendment (Digital Duty of Care) Bill 2026, submission dated 23 September 2026; access to lawful voluntary assisted dying information (earlier exposure draft): https://palliativecare.org.au/submission/exposure-draft-online-safety-amendment-digital-duty-care-bill-2026/