Who decides what Australians don't see?

Two decisions sit between a post and your screen.

Choosing a feed matters. But it answers only one part of the question. Before a service orders posts, it has already decided which posts are eligible to appear there. Something can remain available at an exact address while being excluded from search or recommendations.

Lens calls these two decisions eligibility and ranking. They are an explanatory distinction, not two stages every platform implements in the same way. The announced feed choice chiefly concerns ranking and the sources of recommendations. It does not, by itself, settle which material safety systems will allow into that pool.

The warning comes from the government's own analysis.

The Office of Impact Analysis records a risk identified by the department: services, including low-risk ones, may become more cautious than intended and moderate content more stringently. The proposed response is regulatory guidance intended to align risk assessments with community expectations.

That acknowledgement supports a serious question about unnecessary restriction. It does not show that this law has already suppressed a post, that suppression is inevitable, or that the government intends to silence critics. It identifies an unintended consequence that the final framework must manage.

There is a substantial case for changing the incentives.

An online service can profit from repeated engagement while leaving users to report harm after it happens. The government's case is that responsibility should move upstream, into the design and operation of the service. Risk assessment and mitigation would become continuing obligations rather than relying only on responses to individual complaints.

The Australian Human Rights Commission has supported a duty of care in principle, while insisting on expression, privacy, information access and other safeguards. Its submission predates this draft and is not an endorsement of its final wording. But it demonstrates that safety and lawful expression need not be rival objectives.

The proposed duty is broad, but it is not unlimited.

Proposed section 26 requires those responsible for an online service to ensure a safe online environment so far as reasonably practicable. Section 25H supplies the test: likelihood and seriousness of harm, what the provider knows or should know, available and suitable measures, costs and privacy impacts. Costs and privacy consequences are weighed against the risk, including whether they are grossly disproportionate.

Section 26A requires a written assessment of reasonably foreseeable risks, the content, features and systems that create them, likelihood, severity and the effectiveness of mitigation. It also requires regular review and reassessment. This reaches how a service works, not only a list of prohibited posts.

Sections 25B and 25F–25G connect the safety obligation to design features. The listed features include recommendations, logged-in features, endless feeds, feedback and time-limited material. The draft differentiates protection for Australians generally, for children, and operation of negatively affecting features on social media for under-16s. It would be inaccurate to describe every recommendation to an adult as prohibited.

Read the verbs as carefully as the subjects.

Section 25C covers child sexual exploitation and abuse; grooming; encouragement, promotion, incitement or instruction of sexual violence and extreme violence or cruelty; explicit violent threats; seriously harmful menacing or harassment; suicide, self-harm, sadistic online exploitation and animal harm; specified terrorism-related material; criminal-offence encouragement, promotion, incitement or instruction; illicit-drug encouragement or instruction; and abhorrent violent conduct. The precise verbs differ between paragraphs. The linked draft is the controlling text.

The criminal-offence paragraph does not say that reporting a crime or discussing civil disobedience automatically qualifies. Context matters. The operational question is how a platform distinguishes documentation, fiction, satire, education and political argument from encouragement or instruction—and what it does when classification is uncertain.

Section 25D separately addresses children. It includes pornography; encouragement or instruction of disordered eating; encouragement of hostility towards women or gender equality; glorifying crime or encouraging dangerous stunts or harmful practices; abuse, harassment or bullying; other material capable of serious harm; and additional categories made under its mechanism. These are not automatic findings about every game, film, health lesson or gender-policy debate.

A minister could expand categories. Parliament retains a role.

Sections 25C(2) and 25D(2) allow additional categories through legislative instruments, subject to the minister's satisfaction about the specified harm. Section 27B requires the minister to seek and consider the eSafety Commissioner's advice for those determinations. Seeking advice is not the same as securing the Commissioner's consent.

The ordinary federal process includes registration, tabling and parliamentary disallowance. Instruments normally must be tabled within six sitting days of registration. A disallowance notice can normally be given within 15 sitting days after tabling; a further 15-sitting-day period governs its resolution. This is scrutiny after an instrument is made, rather than passing a new bill through both houses for each category.

General consultation requirements are not an absolute public veto. The parliamentary explanation of sections 17 and 19 distinguishes appropriate consultation from the validity of an instrument when consultation does not occur. The scope, exemptions and process of any actual instrument must be checked when it exists. Lens's policy question is whether categories affecting expression merit clearer safeguards in the primary law.

Private adult communication has an express exception.

Section 26(7) says the duty does not require action concerning lawful communications occurring privately solely between consenting adults. In the proposed duty-of-care Part, Lens found no equivalent general carve-out specifically labelled for journalism, political expression, satire or artistic expression.

That is a bounded textual finding. The whole draft does contain the word journalist: proposed section 204(5) protects confidential source identity against a particular information requirement. It is a different protection. Neither the absence of a word from Part 2 nor the presence of a source shield settles all protection for lawful speech.

Two mistakes can have different consequences.

Suppose a service is uncertain about a lawful documentary clip. Keeping it might be defensible, but the service may fear that its handling of similar material will later count against its safety systems. Removing or demoting it may appear easier. This is a hypothetical mechanism, not a report of a platform decision under a law that has not been enacted.

The draft gives the duty real enforcement consequences: section 26B carries a civil penalty of 60,000 penalty units, as does failure to comply with a section 26D remedial direction. This does not mean each controversial post automatically attracts that penalty.

The other side is not empty. Section 26F requires equal access to complaint and dispute processes for prescribed classes of services, with requirements set by the Commissioner. Breach carries 6,000 penalty units; section 26G supports remedial directions. But the draft itself does not spell out a universal end-user entitlement to reasons and restoration for every lawful post unnecessarily restricted. Which disputes are covered, by which services and under what requirements, remains consequential.

A missing recommendation is harder to challenge than a removal notice.

Removal, age restriction, demonetisation, reduced search visibility, exclusion from recommendations, account restrictions and geographic restrictions have different effects. None can be treated as proof of unlawful conduct just because a user dislikes the outcome.

For each intervention, the practical test is the same: would the affected person be told it happened, receive a meaningful reason, learn whether automation was involved, and have a usable route to challenge it? The draft does not itself guarantee that full sequence for every intervention. Later complaint-process and publication requirements could matter greatly.

A statutory power to ask for information is different from a user automatically receiving a notice. And an appeal to a platform is different from an affordable independent decision about restoring reach. Contract and consumer-law remedies may depend on the platform's promises and circumstances; this investigation does not establish a universal Australian right to be recommended.

There are tools for oversight. Their use is not automatic.

Sections 192C–192D allow eSafety to require transparency reports about service safety, compliance, measures, systems and specified metrics. Those broad powers could support questions about errors and successful appeals where they relate to the statutory purpose. The draft does not mandate a standard public tally of lawful posts mistakenly restricted, separated by journalism, politics or art.

Section 192G permits publication of a report or summary, with restrictions for confidential, personal and prescribed information. Sections 192M–192N allow requirements for providers to publish information. A power to require and publish information is not a promise that every report will be public.

Sections 205B–205F enable research data-access schemes under later rules. Eligibility includes employment at an Australian university, approval and relevant ethics requirements. This is a potentially valuable route to examining systems, but it is not immediate open access for any reader or independent journalist. Nor is statutory research access an independent audit that has already occurred.

Review rights also need the correct owner attached. For example, proposed section 220(23) provides tribunal review of a transparency notice decision. That protects against regulatory decisions; it does not create an appeal for every user whose post was demoted.

This reaches beyond the familiar social apps.

Section 25A expressly includes internet carriage, social media, relevant electronic services, designated internet services, hosting, search and app distribution, alongside specified equipment-related services. Messaging, games and websites must be assessed against their actual functions and the linked service definitions, rather than their marketing label.

AI is not merely an inference from political speeches. Paragraph 25A(1)(j) expressly includes a service allowing users both to generate material using AI and to share it through the listed kinds of services. An AI product could also fall within another category. That establishes a route to coverage, not a conclusion that every model, offline tool or feature of ChatGPT, Gemini, Claude or Grok has identical obligations.

Could safety obligations affect what an AI service provides to Australians? Potentially, for covered services and material within the duty. Which outputs or features change remains unestablished. No provider-specific Australian response was tested for this investigation.

The Constitution is a limit on government power, not a guaranteed audience.

Australia's implied freedom of political communication is not a personal constitutional entitlement to say anything anywhere. It constrains governmental power to preserve the system of representative and responsible government. The High Court's Banerji judgment examines a burden, its legitimate purpose and whether its justification satisfies the applicable constitutional test.

A challenge involving regulatory incentives would need to establish the law's relevant operation or effect and the burden and justification—not merely point to a platform's disputed decision. Proportionality and less restrictive alternatives can matter. The implied freedom does not itself operate as a general command that a private platform must carry or recommend a user's post. Lens makes no prediction that this draft would be invalid.

Overseas systems show concrete safeguards worth comparing.

The UK's Online Safety Act includes expression and privacy duties in sections 22 and 33, complaints in section 21, and specific protections for democratic, news-publisher and journalistic content in sections 17–19. Those latter provisions concern Category 1 services. Scope and commencement matter: their appearance in the Act is not evidence that every service already provides each safeguard.

The EU Digital Services Act makes restrictions more inspectable. Article 17 addresses statements of reasons for hosting-service restrictions, including visibility and monetisation decisions; Articles 20–21 address internal complaints and certified out-of-court dispute settlement for covered online platforms. The service categories and exceptions matter, including Article 19's small-platform rule.

Articles 14 and 34–35 connect moderation and systemic-risk management with fundamental rights, while Article 40 provides research access for the largest services. These are different legal mechanisms, not a single benchmark that Australia has either copied or failed.

There is evidence that appeals change outcomes. The European Commission reported in February 2026 that 30% of 165 million appealed moderation decisions had been reversed. Those are appealed decisions, a selected group. The figure is not a 30% error rate for all posts, and it does not show that the DSA caused the original restrictions. Ofcom's guidance also recognises over-removal risks; that acknowledgement is not an estimate of their frequency.

The consultation can ask for measurable protections.

The useful questions are specific. Should reasons accompany material restrictions on lawful content, including loss of visibility? Which users should have independent review? Should transparency distinguish safety-driven restrictions from ordinary ranking decisions, report successful appeals and measure false positives? What must a provider retain so that an unseen decision can later be examined?

Those are Lens's policy questions, not claims that every restriction is improper or every platform should distribute everything. The draft already has meaningful tools. The unresolved issue is what obligations ensure those tools protect lawful expression in practice as well as safety.

The department accepts feedback by email at digitaldutyofcare@communications.gov.au, no longer than five pages, by 12pm on Tuesday 22 September 2026. The inspected notice does not specify a time zone. It says individual comments will not be published, although aggregated feedback may be. Check the current notice before submitting.