Sunshine and double rainbows – building a better online environment for children and young people

Every child in Australia has grown up in the shadow of social media.

Teenagers turning 18 in 2025 have only ever known a world with Facebook – it became available to users over 13 in September 2006, a few months before our newest adults were born.

But being online is more than just social media, and to say that young people spend much of their lives online these days is an understatement.

Whether it’s learning, socialising, playing, relaxing or connecting with family and culture, children today are often expert-level internet users. My own kids tell me this is a vast improvement on the analogue world I grew up in, or as they somewhat rudely call it, ‘the olden days’. But it’s not all sunshine and ‘double rainbows’.

As our children grow, so too do the vast stores of their data and personal information held by businesses, government agencies and others. It is estimated that by the time a child turns 13, there will be 72 million pieces of data already collected about them.

This means that children and young people are subject to potentially harmful – but commonplace – data practices such as profiling, direct marketing and targeted advertising, as well as emerging harms from artificial intelligence (AI). These include the use of personal information to train models and the regurgitation of revealing personal information in outputs from generative AI.

This high level of data collection also leaves children and young people vulnerable to risks such as data breaches, identity theft, discrimination and algorithmic bias – all of which can lead to serious harms, such as financial and reputational damage.

This is why the Privacy and Other Legislation Amendment Act 2024 introduced a mandate for our office (the OAIC) to develop a Children’s Online Privacy Code.

The code is being designed to strengthen privacy protections for children and young people, and to do so we are undertaking extensive consultations to ensure it meets community expectations and delivers on its promise to make the online environment better for children and young people.

We’re adopting a phased approach to consultation to ensure that the development of the code is informed by a wide range of voices, but we’re starting with our most important stakeholders, children and young people themselves, and hope to bring their voices to further stages of consultation.

Listening to young people

Our consultation approach is informed by the Convention of the Rights of the Child guiding principles, which include the best interests of the child as a primary consideration and the right of children to express their views freely on matters affecting them. As such, we are listening to the voices of young people before we speak about them to others, and we are committed to ensuring all children have a voice in shaping the code

We recognise that children and young people benefit from and rely on being online for many of their daily activities – so we want to hear from them directly about what they want and need from the code, and what their expectations are for how businesses and organisations covered by the code collect and use their information.

We also recognise the importance of digital inclusion, and acknowledge that First Nations, rural and regional children and others, may have specific concerns and needs that we will consider when developing the code and through our consultations.

We are working with several civil society organisations, children's welfare groups and academic experts to facilitate conversations across Australia with kids of all ages. We’ll be using a variety of qualitative and quantitative methods, including surveys, postcards to the commissioner and targeted workshops with children between the ages of 13 to 17 with a range of different experiences and from different backgrounds.

Discussion papers to support engagement

To support meaningful participation and ensure that every child has a chance to have a say, we are also developing 3 discussion papers, one for children in school years 3 to 6 , one for children in school years 7 to 12, and one for parents. These will present scenarios and discussion prompts to help guide conversations. This approach is based on learnings from our international counterparts, who found when developing their own children’s codes that educating children and parents about privacy helps them engage with the issues and think about what protections they want for themselves or their children.

Drafts of these papers are currently under review by experts in child and parent engagement, and we plan to publish them on our website soon.

To complement the discussion papers and consultations, we have been engaging with people in a range of areas, such as children’s rights, wellbeing and protection groups, parents and carers and their representative groups, educators and frontline service workers, representatives of the LGBTQI+ community, domestic and family violence groups, representatives of culturally and linguistically diverse communities, and First Nations community representatives.

While the consultation process is structured into phases, each phase marks the beginning of engagement with those groups, and these conversations will continue throughout the code’s development.

Civil society, academia and industry engagement

Last week, we worked with Reset.Tech, the Australian Child Rights Taskforce and the Young and Resilient Research Centre at Western Sydney University to hold an event with academia and civil society groups that specialise in children's welfare or digital privacy, to discuss key issues and gather early insights.

We heard from attendees that there is a need for more awareness and education for children and their parents about privacy risks, privacy rights and how organisations are using children’s data.

We also heard about the importance of organisations using a child rights lens to design and develop online services likely to be accessed by children.

Next, we will broaden our focus to include industry stakeholders. During this phase, our engagement will build on learnings from our conversations with children, young people and child rights and welfare advocates to support the development of the code to ensure it is practical, effective and responsive to the needs of children and the wider community. We will also work collaboratively with experts and industry to support the code with broader initiatives that improve protections for children and young people online.

We’ll be updating our website with more information as our plans progress, and we will be hosting a webinar on our next steps in our consultation for interested stakeholders in mid-May.

Public consultations in 2026

In 2026, we will release a draft of the code for public consultation. This consultation will run for at least 60 days, allowing the public and all interested stakeholders to review and provide feedback on the draft.

We are committed to an inclusive and transparent process that centres the best interests of the child. We will continue working with stakeholders across sectors and throughout all phases of development. This sustained engagement will ensure the Children's Online Privacy Code is robust, well-informed and reflects the needs of all Australians.