Hundreds of thousands of Australian small businesses—from suburban cafes and local hairdressers to independent tradespeople—find themselves in the crosshairs of a major federal legislative push. The proposed "Digital Duty of Care" legislation, introduced to Parliament on October 15, is designed to bolster online safety by forcing digital services to take proactive measures against foreseeable harm. However, the broad scope of the bill has ignited a fierce debate over whether the government’s dragnet approach will inadvertently crush the very enterprises that form the backbone of the national economy.
As currently drafted, the legislation lacks an automatic exemption for small-to-medium enterprises (SMEs) based on their size or annual turnover. Industry advocates, led by the Council of Small Business Organisations Australia (COSBOA), are now sounding the alarm, warning that the bill’s requirement for annual risk assessments could impose an onerous, costly, and unnecessary regulatory burden on businesses that pose virtually no risk to the digital ecosystem.
The Core of the Legislation: A Duty to Protect
The Digital Duty of Care bill represents a significant shift in Australia’s approach to internet governance. Under the proposed framework, "covered online services" must implement systems and processes to prevent harm to users. While the intent is to ensure safer digital spaces, the language used to define these services is expansive. By failing to differentiate between multinational social media giants and a local plumber’s "set-and-forget" website, the government has created a scenario where a small business owner could be legally required to conduct and document annual risk assessments.
The bill dictates that these operators must:
- Identify and document potential online safety risks associated with their digital platforms.
- Retain these risk assessments for a minimum of six years.
- Provide these records to the eSafety Commissioner within 30 days of a formal request.
While the government has stated that low-risk websites will face "minimal obligations," critics argue that the lack of an explicit, statutory exemption creates a dangerous level of legal ambiguity.
A Chronology of the Legislative Push
The journey toward this legislation has been marked by a rapid escalation in concerns regarding digital safety, with the federal government under increasing pressure to rein in the harms propagated by major tech platforms.
- Mid-2024: Discussions surrounding the need for a stronger, "duty of care" model gain momentum in Canberra, focusing primarily on the algorithmic responsibilities of large social media platforms.
- October 15, 2025: The Digital Duty of Care legislation is formally introduced to Parliament. Initial industry analysis reveals that the definitions of "online services" are significantly broader than anticipated, encompassing almost any business with an active web presence.
- Late October 2025: COSBOA and other industry bodies begin raising alarms regarding the compliance costs for SMEs.
- Present Day: Industry stakeholders are lobbying for amendments, specifically seeking a carve-out for businesses with fewer than 50 employees or those with an annual turnover below $5 million.
The Financial Burden: Compliance Costs or Economic Drain?
The economic implications for small business owners are the primary point of contention. While the government has not yet released a detailed Regulatory Impact Statement (RIS) on the potential costs, those in the digital agency space are already crunching the numbers.
Karl Morris, managing director of the Geelong-based digital agency Goop Digital and deputy chair of the Geelong Chamber of Commerce, believes the compliance costs could be staggering. Managing a portfolio of approximately 800 websites for clients ranging from medical practices to funeral homes, Morris sees the "collateral damage" firsthand.
"We’re thinking probably a couple of hundred bucks [per business] at the entry-level, but it could easily escalate into the thousands if the requirements become granular," Morris told SmartCompany. "If you have to bring in legal consultants or professional compliance auditors to satisfy the eSafety Commissioner’s standards, you’re looking at a significant drain on a small business’s annual profit."
The issue is not just the immediate dollar cost; it is the opportunity cost. For many small businesses, a website is merely a digital shopfront. It provides a contact number, a list of services, and perhaps a location map. These sites are rarely interactive, do not host user-generated content, and have no mechanism for widespread harm. Requiring these owners to conduct annual audits is, according to critics, a "tick-the-box" exercise that offers no tangible safety benefit to the Australian public.
Official Responses and Industry Advocacy
The Council of Small Business Organisations Australia (COSBOA) has been the most vocal critic of the current drafting. CEO Skye Cappuccio has been clear in her assessment: the bill as it stands is ill-fitted for the small business sector.
"We are very concerned that, as drafted, the bill will increase the compliance burden on small businesses that are exceedingly low risk," Cappuccio stated. "A local hairdresser’s website is, by its very nature, low risk. Forcing these businesses to undertake annual risk assessments is not only a misallocation of their time and resources, but it also fundamentally misunderstands the digital footprint of the average Australian SME."
COSBOA is currently calling for:
- Statutory Exemptions: A formal exclusion for businesses that fall below certain turnover thresholds.
- Risk-Based Regulation: A shift in focus that prioritizes high-risk digital entities rather than blanket regulation.
- Transparency: A full, government-funded assessment of the total economic impact on the SME sector before the bill proceeds further.
The government maintains that the legislation is a necessary step in evolving the online safety landscape, but it faces a growing chorus of voices arguing that "regulating the risk" is far superior to "regulating every business that has a website."
The "Collateral Damage" Argument
The central tension in this debate is the disparity between the target and the net. The public, the government, and the opposition all agree that major digital platforms—those that host massive amounts of data, use complex algorithms, and facilitate global communication—should be held to a higher standard of care.
However, when a law is written so broadly that it captures a local accounting firm’s informational website, it loses its focus. Morris argues that the current approach is effectively treating a local cafe’s static landing page with the same regulatory scrutiny as a major social media platform.
"Small businesses are literally collateral damage in this whole thing," Morris noted. "We are creating a system where the smallest players are forced to spend time and money proving they aren’t doing anything wrong, while the major platforms continue to navigate the complexities of their own algorithms with far more resources at their disposal."
Implications for the Future of Australian E-Commerce
If the legislation passes in its current form, the implications for the Australian digital economy could be profound.
1. The Chilling Effect on Digital Adoption
For businesses that are already wary of the complexities of the internet, the threat of annual audits and potential penalties could discourage them from maintaining or updating their digital presence. In an era where a business’s survival often depends on its ability to reach customers online, this could lead to a stagnation in digital innovation among the smallest operators.
2. Market Consolidation for Compliance Services
While digital agencies like Goop Digital could theoretically benefit from offering "compliance assessment" services to their clients, there is a lack of enthusiasm for this new revenue stream. Many agencies recognize that forcing their clients to spend money on compliance rather than growth marketing or service improvement is ultimately bad for their own client retention.
3. A 12-Month Window for Change
The bill does currently propose a 12-month transition period before the obligations take full effect. This window provides a narrow opportunity for the government to engage with stakeholders and implement the necessary amendments to shield small businesses. Industry leaders are hoping this time will be used to refine the bill’s definitions to ensure that the "Duty of Care" applies to those who actually have the capacity to cause digital harm.
Conclusion: The Path Forward
The Digital Duty of Care legislation is intended to create a safer internet, but in its current form, it risks creating a more expensive and bureaucratic environment for Australia’s small business sector. The call for a "risk-based" approach is gaining traction for a reason: it acknowledges that while online safety is a paramount concern, it should not be achieved by placing an undue burden on the small business owners who drive the nation’s economic engine.
As the bill moves through the parliamentary process, the focus will remain on whether the government is willing to listen to the concerns of the SME sector. Whether through a turnover-based exemption, a headcount threshold, or a more precise definition of "covered services," a modification is essential. Without it, hundreds of thousands of Australian businesses face a future of unnecessary paperwork, potential fines, and a regulatory landscape that feels increasingly disconnected from the reality of running a small, local enterprise.
The message from the sector is clear: protect the public, but do not punish the small business owner in the process. Regulation must be proportionate, and in the case of the local cafe or the neighborhood tradie, the current proposal falls far short of that standard.
