The Office of the Australian Information Commissioner has published an exposure draft of the landmark Children's Online Privacy Code, including new rules which require agencies and organisations to ensure they consider the best interests of children before collecting, using or disclosing their personal information.
The draft Code, which has been developed by the federal privacy regulator in consultation with children, young people, experts, parents and carers since parliament passed the Privacy and Other Legislation Amendment Act in 2024, contains new rules for the digital domain designed to create better online experiences for children and young people. Key provisions in the code include requirements to consider children's best interests, to obtain consent before using children's personal information for targeted advertising, and to enable children to request deletion of their personal information.
While many of the proposed new rules correspond with equivalent international instruments such as the UK's Age Appropriate Design Code, some novel protections seek to ensure that Australian children benefit from cutting-edge approaches to privacy protection. These include proposed rules that require online services to notify children when their parents are consenting to the collection of personal information on their behalf, and to notify children when other users, including parents, are tracking their geolocation on a service.
The Code is subject to public consultation, which opens today and runs for 60 days, invites children, parents and carers, industry and civil society and other interested parties to provide feedback on the draft Code, before it becomes law in December 2026.
The Code complements existing protections for children online such as Australia's world-first Social Media Minimum Age obligation, which came into effect in December 2025. Importantly, the Code will cover a much broader range of online spaces than social media platforms alone, ensuring children's privacy is protected when they're using games, streaming platforms, and educational tools.
The Code will apply to online services where children experience the highest privacy risks, including most apps, games and websites that children and teenagers use daily, as well as online services that are primarily concerned with the activities of children.
"It has been estimated that by the time a child turns 13, around 72 million pieces of data will have been collected about them, making them vulnerable to harms from data breaches, discrimination, algorithmic bias and targeted advertising of harmful products, amongst other risks" says Privacy Commissioner Carly Kind.
The Code creates an obligation for agencies and organisations to design their services in the best interests of children and young people to protect their personal information online.
"Importantly, the Code will not restrict or limit children and young people's participation in online spaces. Instead, it raises the standard for privacy protections in Australia and puts the onus on online services to do better when handling children's personal information online" Commissioner Kind says.
"Children play, learn, socialise and connect with family and culture online - it's important that children can participate without fear or exploitation. The Code will give confidence to parents that the apps, games and websites their children use are taking steps to protect children's privacy." says Kind.
Key obligations that the Code proposes to introduce are:
- Collection, use and disclosure of personal information must be consistent with the best interests of the child
- Direct marketing is only permissible with consent, when in the child's best interests and when the personal information is collected directly from the child (rather than third parties)
- More rights and controls for children including introducing a right to request destruction of their personal information
- Privacy notices and policies must be written in clear, accessible language that is age appropriate
- Stronger consent mechanisms, including telling a child when a parent consents on their behalf
To support consultation of the Code, the OAIC has launched a dedicated 'Privacy for Kids' website. You can access the Privacy for Kids webpage here: Privacy for Kids | OAIC .
The OAIC has developed a range of consultation materials to engage all stakeholders, including:
- Exposure Draft of the Children's Online Privacy Code
- Draft Explanatory Statement
- Short Guide to the Code (for younger children)
- Extended Guide to the Code (for older children and adults)
- Lesson plans and workshop materials
Children, young people, parents and carers are invited to share their feedback on the draft Code via dedicated workbooks. You can find out more about how to participate in the consultation on our website: Draft Children's Online Privacy Code (Consultation for Children, Young People, Parents and Carers) | OAIC
The OAIC will also be accepting written submissions and running several roundtables for industry, government, civil society and academic stakeholders. These stakeholders can find out more about how to participate in the consultation on our website: Draft Children's Online Privacy Code (consultation for industry, civil society, academia) | OAIC
The consultation is open until 5 June 2026.
Following the consultation, the OAIC will give consideration to any submissions made within the consultation period and working towards registering the Code on 10 December 2026.
Download
Background
- The Privacy and Other Legislation Amendment Act 2024 introduced a mandate for the OAIC to develop a Children's Online Privacy Code.
- The Code applies to entities covered by the Privacy Act 1988 (APP entities) if:
- they are a provider of a social media service, a relevant electronic service or designated internet service1
- the service is likely to be accessed by children
- the service is primarily concerned with the activities of children
- if the entity is not providing a health service
- The Code sets out how these online services must comply with the APPs and sets out additional requirements consistent with those existing principles.
- The code will be registered by 10 December 2026.
- To read more, visit Children's Online Privacy Code | OAIC .
