Children’s Online Privacy Code: What Online Service Providers Need to Know
What has happened?
The Privacy and Other Legislation Amendment Act 2024 (Cth) (POLA Act) introduced a requirement for the Office of the Australian Information Commissioner (OAIC) to develop a Children’s Online Privacy Code (Code).
The primary objective of the Code is to improve privacy protections for children online. An Exposure Draft of the Code (draft Code) was released for review and public consultation in March 2026. The draft Code is a significant development for Australian privacy law as it lifts the privacy bar for online services that collect or handle children’s personal information.
The draft Code must be finalised and registered by 10 December 2026.
Key takeaways
The draft Code will significantly re-shape the approach to protecting children’s online privacy in Australia. Provided the draft Code is registered as currently drafted, it will add another layer of protection to children navigating online services, alongside the social media age restriction ban and tranche 2 privacy reforms.
APP entities that provide online services likely to be accessed by children, or concern the activities of children, will need to place the best interests of a child at the heart of their information collection and handling practices. This will likely prompt a material mindset shift and the implementation of new child friendly privacy practices.
Online services should start assessing whether the draft Code will apply to their service and where privacy practices need modification or uplift to be compliant with the draft Code.
What is changing?
Organisations and agencies bound by the Privacy Act 1988 (Cth) (Privacy Act) (ie APP entities) that provide online services likely to be accessed by children or are primarily concerned with the activities of children will be required to comply with the draft Code, in addition to the Australian Privacy Principles (APPs).
Organisations bound by the Code
The draft Code will apply to APP entities that provide online services, namely:
social media services: platforms where people can connect, share content and interact with others (for example, discussion forums and review platforms).
relevant electronic services: online services that let people communicate with each other (for example, messaging apps, email services and online games with a chat function).
designated internet services: online services that allow users to access or receive material over the internet (for example, cloud storage, streaming platforms and consumer IoT devices).
Importantly, the draft Code will apply to the specific services provided by an APP entity, rather than all of the services of the entity as a whole. Even if an organisation generally does not offer services to children, but offers a dedicated service likely to be accessed by children, the organisation will be bound by the draft Code in relation to the service accessed by children.
While the draft Code has the potential to encompass a broad range of online services, it only applies to services:
likely to be accessed by children (for example, children’s versions of apps or websites); or
primarily concern the activities of children (for example, early childhood development apps, online school management systems and internet connected baby monitors).
Further, the draft Code will not apply to an entity providing a health service or a carriage service provider.
Key obligations
The draft Code sets out key requirements online services must comply with when collecting and handling the personal information about a child. These requirements relate to:
age verification;
data minimisation;
acting in the best interests of a child;
consent and assent;
transparency and notification;
access and information request procedures;
opt out mechanisms;
destruction requests;
child friendly inquiry and complaints processes;
mandatory privacy impact assessments; and
annual privacy education and training.
Why these changes matter
The draft Code significantly lifts the bar for privacy best practice in Australia.
The draft Code will require online services to modify existing privacy practices to better protect children’s privacy. For instance:
privacy policies must be child friendly;
privacy practices, procedures and systems must be reviewed annually;
information access and complaints processes must be accessible to children;
privacy impact assessments will be mandatory; and
privacy education and training must be conducted annually for staff who have regular or frequent access to children’s personal information.
There will likely be a grace period for online services to be compliant with the draft Code. Nevertheless, online services should start preparing for the draft Code now. Early preparation will help identify operational gaps, prioritise implementation activities and reduce the risk of non-compliance once the draft Code comes into effect.
If you would like to learn more about the draft Code or need help assessing how it may impact your business, contact O’Dowd Legal for a complimentary and confidential discussion.