The Office of the Australian Information Commissioner (OAIC) has published an exposure draft of the Children’s Online Privacy Code, proposing new requirements for agencies and organisations to consider children’s best interests before collecting, using or disclosing their personal information.
The code was developed following the passage of the Privacy and Other Legislation Amendment Act in 2024, and the OAIC said it was informed by consultation with children, young people, experts, parents and carers.
Under the draft, organisations would need consent before using children’s personal information for targeted advertising, and would be required to provide children with a mechanism to request deletion of their personal information.
The OAIC said the proposals align with international approaches such as the UK’s Age Appropriate Design Code, while also including additional measures. These include requiring online services to notify children when parents consent to the collection of personal information on their behalf, and to notify children when other users, including parents, are tracking their geolocation on a service.
Privacy Commissioner Carly Kind said the scale of data collection on children increases their exposure to privacy and safety risks. “It has been estimated that by the time a child turns 13, around 72 million pieces of data will have been collected about them, making them vulnerable to harms from data breaches, discrimination, algorithmic bias and targeted advertising of harmful products, amongst other risks,” Kind said.
The OAIC said the code is intended to raise expectations on service design and data handling, rather than restrict participation by children and young people in online spaces. “Importantly, the Code will not restrict or limit children and young people’s participation in online spaces. Instead, it raises the standard for privacy protections in Australia and puts the onus on online services to do better when handling children’s personal information online,” Kind said.
Proposed obligations listed in the draft include requirements that collection, use and disclosure of personal information be consistent with a child’s best interests; that direct marketing be permitted only with consent, in the child’s best interests, and where the information is collected directly from the child; that privacy notices be written in clear, age-appropriate language; and that consent mechanisms be strengthened, including by informing children when a parent provides consent on their behalf.
The OAIC said the code would apply beyond social media platforms, covering a broader range of online services where children face higher privacy risks, including most apps, games and websites used by children and teenagers, as well as services primarily concerned with children’s activities.
Public consultation opened on 31 March 2026 and will run for 60 days, with the OAIC stating it is seeking feedback from children, parents and carers, industry, civil society and other stakeholders. The OAIC said consultation will remain open until 5 June 2026.
The OAIC said it plans to consider submissions and work towards registering the code on 10 December 2026, ahead of it becoming law in December 2026.
