The Children's Online Privacy Code: where it stands before the December deadline

Australia is about to get its first privacy rules written specifically for children online. The Privacy and Other Legislation Amendment Act 2024, which passed in December 2024, requires the Office of the Australian Information Commissioner (OAIC) to develop a Children’s Online Privacy Code and to finalise and register it by 10 December 2026.

The OAIC released an exposure draft on 31 March 2026, and public consultation closed on 5 June 2026. The OAIC is now considering submissions and carrying out a regulatory impact analysis, including a cost-benefit analysis. As at the date of this article, the Code has not been registered. What follows describes the draft. The final Code may differ.

The statutory basis

The 2024 Act did three relevant things. It introduced a definition of a child into the Privacy Act for the first time, being an individual under 18. It required the OAIC to develop a Children’s Online Privacy Code. And it set the process: the OAIC must publish a draft for public consultation for at least 60 days, consult the eSafety Commissioner and the National Children’s Commissioner, and register the Code within two years of Royal Assent.

The Code will be an APP code, which is a legislative instrument under the Privacy Act. An APP code sets out how one or more of the Australian Privacy Principles apply to particular entities or information, and can add requirements that are not inconsistent with the APPs. A breach of a registered APP code is an interference with privacy, so the same enforcement framework applies, including civil penalties.

Who it is expected to cover

According to the OAIC, the Code will apply to APP entities that meet three conditions:

• they provide a social media service, a relevant electronic service or a designated internet service, each as defined in the Online Safety Act 2021
• the service is likely to be accessed by children, or is primarily concerned with children’s activities
• they are not providing a health service.

The OAIC can also specify other APP entities that must comply.

The Online Safety Act categories are wide. Relevant electronic services include services for communicating by email, instant messaging, SMS, MMS or online chat, and services for playing online games with other users. Designated internet services include many websites and apps. Combined with a “likely to be accessed by children” test, the Code could reach general-audience platforms used by teenagers, not only services designed for young children. Commentators, including Allens, have noted the breadth of the test. The OAIC may issue guidelines to help entities assess whether a service is likely to be accessed by children.

How the OAIC got here

The OAIC ran the development in three phases:

Phase	Period	What happened
1. Children, young people and parents	January to August 2025	Consultation with children, young people, parents, carers and child welfare organisations. 337 participants responded to online worksheets in June 2025.
2. Industry, civil society and academia	April to August 2025	Issues Paper released 12 June 2025, with submissions closing 31 July 2025 (61 written submissions), plus workshops, a webinar and industry roundtables.
3. Exposure draft	31 March to 5 June 2026	Public consultation on the draft Code and Explanatory Statement. The OAIC reports 425 submissions from children, parents and carers, 135 written stakeholder submissions and 13 drawings from younger children.

Children and parents were consulted through dedicated workbooks and lesson plans, alongside written submissions and roundtables for organisations. Privacy Commissioner Carly Kind said on release of the draft that “the Code will not restrict or limit children and young people’s participation in online spaces.”

What the exposure draft proposes

The draft is detailed. The main proposed obligations are these.

Best interests of the child. Collecting a child’s personal information would need to be consistent with the best interests of the child (draft s 10). Using or disclosing it would require both the child’s consent and consistency with their best interests (draft s 11). Allens notes this would effectively remove reliance on reasonable expectations as a basis for secondary use.

Privacy-protective defaults. By default, an entity could collect, use or disclose a child’s personal information only where strictly necessary to provide its service (draft s 9). Children would need clear, simple and accessible controls over non-essential handling. Commentators have observed that this would affect default-on targeted advertising, personalisation and recommender systems, and could require existing accounts to be reset.

Age assurance. Entities would need to take reasonable steps to ascertain users’ ages before collecting personal information, collecting only what is necessary for that purpose (draft s 8). The alternative is to apply the Code’s protections to all users.

Consent. Under the draft, children aged 15 and over could consent for themselves. For children under 15, a parent’s consent would be required, and the entity would need to take reasonable steps to confirm parental responsibility. Consent must be voluntary, informed, current, specific and unambiguous, with no pre-ticked boxes or bundled consent. For some higher-risk handling of an under-15’s information, the draft would require the child’s assent as well as parental consent.

Age-appropriate notices and policies. Notices, consent requests and privacy policies would need to be age appropriate. Where a service targets an age range, information must suit the youngest child in it. Otherwise, the draft sets a baseline of a child aged 10 to 12. Children would also need to be told when a parent, or another user, can monitor their geolocation through the service (draft s 33).

Restrictions on direct marketing. On top of APP 7, direct marketing to a child would require consent, consistency with the child’s best interests and that the information was collected directly from the child.

Rights and governance. Children, or parents on their behalf, could request destruction of their personal information (draft s 32), described by Allens as a stricter obligation than APP 11. Entities would need to complete a privacy impact assessment before launching a new service likely to be accessed by children, or making a significant change affecting children’s privacy, and keep a published register of those assessments (draft ss 38 and 39). Practices would need to be reviewed at least annually, with records available to the Commissioner (draft s 25). The draft also includes training obligations.

What is not yet known

The commencement provision in the exposure draft is marked “to be drafted”, so there is no confirmed date from which the obligations apply. The OAIC invited submissions on a transition period. Registration by 10 December 2026 does not necessarily mean every obligation applies on that day.

The final Code may also narrow, expand or reword the draft obligations following consultation. Organisations should plan against the direction of the draft, not its exact wording.

Practical preparation

The work that takes longest is the work that does not depend on the final wording. Deciding which services are in scope, and why, needs product, marketing and legal input and an evidence base: audience data, content, design features and marketing channels. Mapping what each service collects by default, and why, takes time in mature products where data flows have accumulated.

Product teams also need lead time. Changes to defaults, age assurance, consent flows and notices touch design, engineering and analytics, and are rarely quick. Building privacy impact assessments into the release process now means they will not become a bottleneck once the Code applies.

Finally, assign ownership. A named executive accountable for children’s privacy, with a clear decision record, is the foundation for everything the Code is likely to require.

General information, not legal advice. The Children’s Online Privacy Code is a draft and has not been registered. Confirm how it applies to your organisation with your legal adviser once the final Code is published.