Australia Children's Online Privacy Code
OAIC code required under the 2024 Privacy Act reforms, to be registered by 10 December 2026: applies the Australian Privacy Principles to services likely to be accessed by children, with design, consent and default-setting requirements.
| Jurisdiction | Australia |
|---|---|
| Category | Privacy & Data Protection |
| Status | Upcoming |
| Effective date | |
| Latest development |
Analysis
The Children’s Online Privacy Code (COPC) is an APP code under the Privacy Act 1988, mandated by the Privacy and Other Legislation Amendment Act 2024, and must be developed and registered by 10 December 2026 by the OAIC. According to the OAIC, the Code applies to social media services, relevant electronic services and designated internet services likely to be accessed by children, and specifies how these entities must comply with the Australian Privacy Principles (APPs) when handling children’s personal information, including additional requirements on design, consent and default settings.Children's Online Privacy Code – OAIC Privacy for Kids – Children’s Online Privacy Code – OAIC Privacy and Other Legislation Amendment Act 2024 – ATO Privacy and Other Legislation Amendment Bill 2024 – Parliament of Australia
Key Requirements
Below are the main proposed requirements of the Children’s Online Privacy Code, as reflected in the OAIC exposure draft and related materials. Until the Code is formally registered, these are draft obligations, but they are authoritative indicators of the final regime.
- Applicability to online services likely to be accessed by children
- The Code applies to APP entities (agencies and organisations regulated by the Privacy Act 1988) that provide:
- Social media services
- Relevant electronic services (e.g., messaging apps, online games with communication functions, as defined in the Online Safety Act 2021)
- Designated internet services (e.g., websites and platforms for storing/sharing content, as defined in the Online Safety Act 2021) where the service is likely to be accessed by children or primarily concerns children’s activities.Children's Online Privacy Code – OAIC Children's privacy: what's next for the upcoming OAIC code? – Allens Better privacy protections for children are coming – OAIC
- Best interests of the child as a central principle
- The exposure draft requires that collection, use and disclosure of children’s personal information must be consistent with the best interests of the child, placing children at the centre of privacy protections.OAIC releases Exposure Draft of the Children's Online Privacy Code Official Exposure Draft of the Children's Online Privacy Code – OAIC Better privacy protections for children are coming – OAIC
- Stronger rules for direct marketing and targeted advertising
- Direct marketing and targeted advertising using children’s personal information generally require:
- Consent, and
- That such marketing is in the child’s best interests, and
- That the personal information is collected directly from the child rather than third parties. These provisions significantly tighten the conditions under which services may engage in targeted advertising to children.OAIC releases Exposure Draft of the Children's Online Privacy Code Official Exposure Draft of the Children's Online Privacy Code – OAIC Children's Online Privacy Code – OAIC
- Enhanced rights and controls for children (including deletion)
- The draft Code provides new rights and controls for children, including a right to request destruction or deletion of their personal information held by services covered by the Code.OAIC releases Exposure Draft of the Children's Online Privacy Code Extended guide to the Children's Online Privacy Code – OAIC Children's Online Privacy Code: Public Consultation Report – OAIC
- Age‑appropriate, clear privacy notices and policies
- Entities must provide privacy notices and policies in clear, accessible language appropriate to the age of children using the service, to ensure that children can understand how their data is handled.OAIC releases Exposure Draft of the Children's Online Privacy Code Extended guide to the Children's Online Privacy Code – OAIC Privacy for Kids – Children’s Online Privacy Code – OAIC
- Stronger consent mechanisms (including parental consent)
- The Code anticipates stronger consent mechanisms, including:
- Clear communication when a parent or guardian consents on a child’s behalf; and
- Requirements to design consent flows that are comprehensible and meaningful for children.OAIC releases Exposure Draft of the Children's Online Privacy Code Official Exposure Draft of the Children's Online Privacy Code – OAIC Children's Online Privacy Code – OAIC
- Application of Australian Privacy Principles (APPs) to children’s data
- The Code is an APP code that specifies how APPs must be applied to children’s personal information for covered services, effectively operationalising existing principles (such as notice, consent, security, access, correction, and limitation of use/disclosure) in a child‑specific context.Children's Online Privacy Code – OAIC Better privacy protections for children are coming – OAIC Children's privacy: what's next for the upcoming OAIC code? – Allens
- Design and default‑setting obligations (child‑centric design)
- OAIC materials emphasise that services must embed privacy for children in design and default settings, consistent with the Code’s mandate to put children at the centre of online privacy protections.Children's Online Privacy Code – OAIC Extended guide to the Children's Online Privacy Code – OAIC Australian Privacy Act Reform: What Changed in 2024 and 2025 – Cybernion
Compliance Challenges
While the Code is still being finalised, several common compliance challenges are already evident from OAIC consultations and industry analysis.
- Determining when a service is “likely to be accessed by children”
- Many providers struggle to assess whether their service falls within the scope of the Code, especially for general‑audience platforms with significant child usage. The OAIC has noted that the Code will apply to a wide range of internet services likely to be accessed by children, not just child‑specific apps.Better privacy protections for children are coming – OAIC Children's Online Privacy Code – OAIC Children's privacy: what's next for the upcoming OAIC code? – Allens
- Implementing robust and reliable age assurance
- To apply child‑specific rules, services typically need some form of age assurance (age estimation or verification), which raises technical, privacy and usability challenges. Industry commentary on the Code highlights the difficulty in developing age‑appropriate mechanisms without over‑collecting data or creating barriers for users.Children's privacy: what's next for the upcoming OAIC code? – Allens Better privacy protections for children are coming – OAIC Australian Privacy Act Reform: What Changed in 2024 and 2025 – Cybernion
- Reconciling advertising‑driven business models with best interests of the child
- Entities reliant on personalised advertising may need to fundamentally change tracking and profiling practices, as the Code restricts direct marketing to children to situations where consent is obtained and the practice is in the child’s best interests.OAIC releases Exposure Draft of the Children's Online Privacy Code Children's Online Privacy Code – OAIC Children's privacy: what's next for the upcoming OAIC code? – Allens
- Designing truly age‑appropriate notices and consent flows
- Creating layered, child‑friendly privacy notices that meet legal requirements while being understandable for various age groups is a non‑trivial design challenge often highlighted in OAIC educational materials.Extended guide to the Children's Online Privacy Code – OAIC Privacy for Kids – Children’s Online Privacy Code – OAIC Children's Online Privacy Code – OAIC
- Operationalising deletion rights and controls for children
- Providing effective mechanisms for children to request deletion of their personal information, and ensuring that deletion is propagated across systems and third‑party partners, requires significant data‑governance maturity.OAIC releases Exposure Draft of the Children's Online Privacy Code Children's Online Privacy Code: Public Consultation Report – OAIC Australian Privacy Act Reform: What Changed in 2024 and 2025 – Cybernion
- Real examples and case‑style insights
- While the Code is still under development, industry law firms and privacy‑consultancy analyses provide scenario‑based guidance illustrating challenges for social media platforms, gaming services and messaging apps, particularly around age assurance and targeted advertising.Children's privacy: what's next for the upcoming OAIC code? – Allens What Australia's proposed online privacy code for children means for service providers – Pinsent Masons Australian Privacy Act Reform: What Changed in 2024 and 2025 – Cybernion
Implementation Best Practices
Below are practical steps organisations can take to prepare for the Code, anchored in OAIC guidance and industry frameworks.
- Map services and data flows involving children
- Conduct a data mapping exercise to identify where children’s personal information is collected, used, disclosed and stored across apps, games, websites and messaging platforms likely to be accessed by children.Children's Online Privacy Code – OAIC Better privacy protections for children are coming – OAIC Australian Privacy Act Reform: What Changed in 2024 and 2025 – Cybernion
- Embed “best interests of the child” into governance
- Update internal privacy governance frameworks to explicitly reference the best interests of the child standard for any decision involving children’s data, aligning with the core principle of the Code.OAIC releases Exposure Draft of the Children's Online Privacy Code Children's Online Privacy Code – OAIC Better privacy protections for children are coming – OAIC
- Develop or strengthen age‑assurance mechanisms
- Implement proportionate age‑assurance techniques, such as age‑gating, age estimation or verification, calibrated to the service’s risk profile and consistent with privacy‑by‑design principles.Children's privacy: what's next for the upcoming OAIC code? – Allens What Australia's proposed online privacy code for children means for service providers – Pinsent Masons Better privacy protections for children are coming – OAIC
- Redesign consent and privacy notices for children
- Create age‑appropriate privacy notices using plain language, visual cues and layered information, as encouraged by OAIC’s child‑oriented guides.Extended guide to the Children's Online Privacy Code – OAIC Privacy for Kids – Children’s Online Privacy Code – OAIC Children's Online Privacy Code – OAIC
- Implement deletion and control mechanisms
- Build processes and user interfaces that allow children to request deletion or destruction of their personal information, and ensure these requests propagate through back‑end systems and third‑party processors.OAIC releases Exposure Draft of the Children's Online Privacy Code Children's Online Privacy Code: Public Consultation Report – OAIC Better privacy protections for children are coming – OAIC
- Align with APPs and existing OAIC privacy‑by‑design guidance
- Ensure that child‑specific measures
Recent developments
- — Integrity Institute publication summarising its 2026-06-04 submission to the OAIC on the draft Children’s Online Privacy Code, raising platform governance and enforcement considerations and illustrating civil society reaction to the proposed rules.[14] (source)
- — Analysis of the exposure draft of the Privacy (Children's Online Privacy) Code 2026, outlining scope, which online service providers are covered, consultation timeline to 2026-06-05, and the requirement to register the final Code by 2026-12-10, alongside new ADM disclosure obligations.[11] (source)
- — Law firm briefing on the Draft Children’s Online Privacy Code explaining proposed protections, expected material impact on online services used by children, and urging potentially in-scope organisations to participate in the OAIC consultation before 2026-06-05.[12] (source)
- — OAIC social post promoting the public consultation on the exposure draft of the Children’s Online Privacy Code, inviting stakeholders to participate between 2026-03-31 and 2026-06-05 and to attend a public webinar explaining the draft Code.[8] (source)
- — News article reporting that the OAIC has published the exposure draft of the Privacy (Children’s Online Privacy) Code 2026, describing new obligations for social media and other online services accessed by children and noting the 60‑day public consultation period ending 2026-06-05 and planned registration on 2026-12-10.[13] (source)
- — OAIC media release announcing the exposure draft of the Children’s Online Privacy Code, highlighting new rules to prioritise children’s best interests in collection, use and disclosure of their personal information, and opening a 60‑day public consultation running from 2026-03-31 to 2026-06-05 before planned commencement in December 2026.[6] (source)
- — Regulatory tracking note summarising the OAIC’s consultation on the exposure draft of the Privacy (Children’s Online Privacy) Code 2026, with emphasis on proposed age‑verification requirements and key dates: consultation opened 2026-03-31 and closed 2026-06-05.[5] (source)
- — OAIC “Privacy for Kids” page presenting the official exposure draft of the Children’s Online Privacy Code and inviting submissions from industry, civil society and other stakeholders as part of the public consultation running to 2026-06-05.[3] (source)
- — Extended OAIC guide explaining in accessible language how the Children’s Online Privacy Code will protect children’s data online and how children, young people and parents can engage with the consultation on the draft Code.[7] (source)
- — OAIC register entry for the Children’s Online Privacy Code describing the multi‑phase consultation process, Phase 3 consultations from 2026-03-31 to 2026-06-05, and confirming that the Code must be finalised and registered by 2026-12-10, with commencement on 2026-12-10.[1] (source)
Related regulations
- Australia Cyber Security Act 2024 (Ransomware Payment Reporting) — Australia, Active, effective 2026-01-01
- Australia Online Safety Amendment (Social Media Minimum Age) Act 2024 — Australia, Active, effective 2025-12-10
- Australia Privacy Amendment (Personal Data Protection) Bill 2026 (Tranche 2 exposure draft) — Australia, Proposed
- UK Data Protection Act 2018 — United Kingdom, Active
- Texas Data Privacy and Security Act (TDPSA) — Texas, Active, effective 2024-07-01
- General Data Protection Law (LGPD) — Brazil, Active, effective 2020-09-18
- COPPA (Children's Online Privacy Protection Act) — United States, Active
- Oregon Consumer Privacy Act (OCPA) — Oregon, Active, effective 2024-07-01
Put it into practice
- Generate the policy: COPPA policy generator (generatepolicy.com)
- Buy the policy pack: Privacy Program Bundle (cyberpolicy.shop)
- Build it yourself: 2026 US Privacy Program Workbook (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates