Children’s Online Privacy Code
A binding privacy code for online services children are likely to use, due for registration by 10 December 2026. Best interests of the child, strict data minimisation, consent for marketing. Exposure draft consulted; final code pending.
- Status
- Proposed · Australia (Commonwealth) · OAIC
- Applies to
- APP entities providing social media, messaging, gaming, streaming and other online services likely to be accessed by children, or aimed at children. Health service providers excluded.
- Key date
- 10 December 2026: Registration deadline
- Primary source
- Official document →
- Last reviewed
- 28 September 2026
What it is
A code the OAIC is required to make under the Privacy and Other Legislation Amendment Act 2024, setting out how the Australian Privacy Principles apply to online services that children are likely to use. It is a registered APP code, so once in force a breach is an interference with privacy with the same penalties as any other. The exposure draft was published on 31 March 2026, consultation closed on 5 June 2026 after more than 550 submissions, and the Act requires the code to be registered by 10 December 2026. It sits beside the social media minimum age law in force since December 2025 and the draft Digital Duty of Care, and covers a wider range of services than either: games, streaming, education tools, messaging and cloud services, not only social media.
What it requires
As drafted: every collection, use and disclosure of a child’s personal information must be consistent with the best interests of the child; a service may collect only what is strictly necessary to provide it; no direct marketing to children without consent that is voluntary, informed, specific, current and unambiguous, and even then only where it serves the child’s interests; privacy notices and policies written in plain, age-appropriate language; a right for children to ask for their personal information to be destroyed; notice to children when a parent consents on their behalf; and notice when other users can see a child’s location. The final code may tighten or loosen any of these; the direction is not in doubt.
Does this reach your business?
If the Privacy Act covers you and children are likely to use your online service, yes, and “likely to” is the test, not “designed for”. A consumer app, a game, a streaming or education service, a community platform or a chatbot open to the public can all qualify. It does not apply to health service providers, to businesses below the Privacy Act’s turnover threshold (unless otherwise covered), or to internal tools and business-to-business services. If an AI feature sits inside a service children reach, the code governs the personal information that AI feature collects and uses about them.
What we recommend
Our advice is to settle one question now: could a child reasonably be using our service? If the answer is yes, list what personal information the service collects from users, strike out anything not strictly necessary, and check whether any marketing, profiling or recommendation feature uses that information, because those are the provisions with the least room to manoeuvre. Rewrite the privacy notice in language a fourteen-year-old could follow. Then watch for the final code in December and read the commencement provisions first; if there is a transition period, that is your deadline.
Questions people ask
The Act requires the OAIC to register it by 10 December 2026. Whether obligations start that day or after a transition period will be set out in the final code.
Privacy Act entities that provide social media, messaging, gaming, streaming, education and other online services that children are likely to access or that are aimed at children. Health service providers are excluded.
No. It covers a wider range of online services than the social media minimum age law, including games, streaming and educational tools.
As drafted: act in the best interests of the child, collect only what is strictly necessary, no direct marketing without proper consent, age-appropriate privacy notices, and a right for children to have their information destroyed.