Source: The Conversation (Au and NZ)
Australia’s new Digital Duty of Care bill proposes a significant shift in online safety. Rather than simply responding to harmful content after it appears, platforms would be required to identify “all reasonably foreseeable risks” of harm in their services and take “effective measures” to tackle them.
The draft also brings a range of welcome legal protections and clauses to enable independent scrutiny of big tech platforms.
Among these, approved researchers and the eSafety Commissioner would be expressly permitted to use “sock puppet identities” to observe and test how platforms operate.
Critics have seized upon this provision to warn of government-sanctioned fake accounts, government surveillance, or to suggest ordinary Australians would need permission to remain anonymous online.
This is not what the draft bill states. Let’s unpack what the “sock puppets” provision actually entails.
What does the bill mean by a ‘sock puppet’?
Part of the concern may stem from the term itself. Online, a “sock puppet” often means a false identity deployed deceptively – to manipulate a discussion, make one person appear to be many, harass others, or disguise the source of a message.
The draft bill, however, separates the identity from how it’s used. It defines a sock puppet simply as a “false or fictitious identity” assumed while using, or doing anything in relation to, an online service.
It then sets out distinct purposes and limits for researchers and the eSafety Commissioner. Approved researchers must work at an Australian university and have ethics approval for their online safety research. They may create controlled accounts, observe and record what those accounts encounter, test platform features, and test how a service responds to particular actions.
For approved researchers, these accounts are not a licence to manipulate other users. They’re only allowed to engage with other users as much as it’s necessary to prevent the account from being closed, such as for inactivity.
Their main purpose is to observe and test the platform itself – a well-established research technique often called a “sock puppet audit” or “algorithmic audit”.
What is a ‘sock puppet’ audit?
Let’s say we want to know whether watching conspiracy videos leads a video platform to recommend more of them: the often discussed rabbit hole effect. Using a sock puppet audit, we can test whether particular behaviours lead a platform to steer users towards different content.
We create a set of otherwise identical accounts. Half watch the videos; half do not. We can then compare what the platform recommends to each group.
Researchers have used variations of this technique to study recommendation pathways on platforms including Twitter, YouTube and TikTok.
Sock puppet audits can also help us answer another important question: does the platform treat different kinds of users differently?
Researchers can create otherwise identical accounts that differ only in an assumed characteristic – such as age, gender, cultural identity, location, or interests – and compare their experiences. Do they receive different advertisements or recommendations? Are some directed towards different content or features? Do the platform’s safety systems intervene differently?
Pulling aside the curtain
In both types of audit, the fictitious identity is not there to fool the public. It’s allowing researchers to observe otherwise hidden differences in how platforms operate.
And those differences are difficult to study from the outside. Feeds, recommendations, advertising and safety systems respond dynamically to individual users. Platforms can see how these systems work across millions of users. Researchers, regulators and the public see only fragments.
Why does this type of research need legal protection? Because platforms ban fake accounts at their own discretion. And their terms of service, which typically require identifying personal information, have been used against researchers.
In 2023, X sued the Center for Countering Digital Hate for allegedly breaching X’s terms by scraping data to study hateful speech on the platform. While X was ultimately unsuccessful, Australia’s draft digital duty of care directly addresses this – platform rules wouldn’t be able to override researchers’ permission to use these identities. Researchers who use them in good faith would be protected from being sued under Australian law.
The duty of care doesn’t ban anonymous accounts
The proposed law also doesn’t ban anonymous or pseudonymous accounts for ordinary Australians. The word “anonymous” doesn’t even appear in the draft.
While the draft bill creates legal protections for limited use of sock puppets by approved researchers and the eSafety Commissioner, it doesn’t require everyone else to reveal their identity.
However, the eSafety Commissioner is given broader powers to perform its regulatory functions. This includes generating (legally permissible) material with or without AI, which can help the regulator to test a platform’s safeguards directly – for example, prompting an AI service to see whether it generates harmful material it otherwise claims to prevent.
Currently the list of permitted uses is “without limitation” and nothing in the draft requires eSafety to specifically report on how it uses these powers. The government should constrain the commissioner’s powers to generate material to clearly defined testing, and require regular public reporting.
But, as drafted, these provisions don’t give eSafety unrestricted power to covertly manipulate public debate. Instead they allow the regulator to test platforms and their claims, rather than simply take their word for it.
“Sock puppet” may be an unfortunate name for a research method. The term carries baggage associated with deception and manipulation. But used for carefully controlled research, its purpose is almost precisely the opposite: to expose critical public interest information about platforms that would otherwise remain hidden.
Daniel Angus receives funding from the Australian Research Council. He is a Chief Investigator with the ARC Centre of Excellence for Automated Decision Making & Society, and QUT Node Lead for the Australian Internet Observatory.
Timothy Graham receives funding from the Australian Research Council, from the Universities Australia-German Academic Exchange Service Joint Research Cooperation Scheme, and from Meta Platforms Technologies.
Original source: https://analysis1.mil-osi.com/2026/10/06/its-true-australia-wont-ban-sock-puppet-accounts-on-social-media-heres-why/