Children’s Online Privacy Code

The Privacy and Other Legislation Amendment Act 2024 (the Act) introduced a mandate for the Office of the Australian Information Commissioner (OAIC) to develop a Children’s Online Privacy Code (the Code), which will put children at the centre of privacy protections in Australia, leveraging insights from our international counterparts.

The Code will:

• specify how online services accessed by children must comply with the Australian Privacy Principles (APPs)

And may:

• impose additional requirements provided they are not inconsistent with the existing principles

September 2024: the Privacy and Other Legislation Amendment Bill introduced to Parliament. A short public consultation is held – read OAIC’s submission.

December 2024: Bill passed and received Royal Assent, becoming an Act.

December 2026: the Code will be in place by 10 December 2026.

January 2025 – present: phase 1 consultations with children, parents and relevant organisations focused on children's welfare.

The OAIC’s approach to developing the code will be based on research, evidence and extensive consultations.

As code developer, our ultimate objective is not to prevent children from engaging in the digital world, but rather to protect them within it through strengthened privacy protections for the handling of their personal information.

We want to ensure that the Code reflects the real experiences and needs of children and their families. That is why we will consult directly with children, parents and caregivers, alongside experts in child welfare, privacy and online safety. Their insights will help shape a code that allows children to engage in the digital world safely by setting high privacy standards for organisations that collect and use children’s personal information

To the extent possible, we will look to international frameworks, such as the UK’s Age Appropriate Design Code and Ireland’s Children’s Fundamentals for Data Processing, while recognising there are differences in the underlying legal frameworks and leverage the learnings of Australia’s international counterparts.

The OAIC are also mindful of broader government initiatives, including the introduction of a minimum age for access to social media and other relevant digital platforms, the age assurance trial, and the recently completed review of the Online Safety Act 2021 as well as the eSafety Commissioner’s ongoing work with industry codes and standards. The OAIC will continue working with stakeholders across government, industry and the community to ensure a consistent and complementary approach to addressing online harms for all Australians.

The Act requires that the OAIC make available a draft of the Code for public consultation, which will last at least 60 days, invite the public to make submissions, consider any submissions made within the specified period, consult with eSafety and the National Children’s Commissioner and register the Code within 2 years from the day of the Bill’s Royal Assent.^[1]

Ultimately, the content of the code will be determined through the code development process. The OAIC intends to adopt a transparent and collaborative approach. The OAIC will consult widely with children, parents, child development experts, child welfare advocates, civil society, other regulators and across the online industry to ensure different voices are heard and represented throughout the process.

To ensure broad engagement and feedback, our consultation process will take place in several phases, with ongoing engagement throughout each stage:

• Phase 1: initial discussion with children, parents and relevant organisations focused on children's welfare
  • Relevant parties in this process may include, but are not limited to:
    • children and young people
    • children’s rights, wellbeing, and protection groups
    • parents and carers and their representative groups
    • educators and frontline service workers
    • representatives of the LGBTIQ+ community
    • domestic and family violence groups
    • representatives of culturally and linguistically diverse communities
    • First Nations community representatives
• Phase 2: Engagement with civil society, academia and industry stakeholders to gather insights and perspectives.
  • Relevant parties in this process may include, but are not limited to:
    • consumer groups
    • digital rights and civil society groups representatives from academia
    • the tech sector
• Phase 3: A public consultation period on the draft code, lasting a minimum of 60 days

Ongoing: we will continue working with stakeholders across government to ensure a consistent and complementary approach to addressing online harms for all Australians throughout the code development process.

The Code applies to businesses or organisations covered by the Privacy Act 1988 (APP entities) if:

• they are a provider of a social media service, a relevant electronic service or designated internet service^[2]
• the service is likely to be accessed by children, and
• if the entity is not providing a health service.

The OAIC may also specify additional APP entities that must comply with the Code.

The Children’s Online Privacy Code is a special set of rules made to help keep kids safe when using the internet. It makes sure that organisations or companies who run apps, websites and games that kids might use take care of your personal information (like your name, age and what you like to do online).

How does it help me?

The Code is like a set of safety rules that organisations or businesses have to follow to protect kids online. Here is how it helps:

• Your personal information is kept safe: the Code makes sure that companies can’t just take your information without asking.
• It is all about privacy: it helps businesses make sure they don’t share your personal information with people who shouldn’t see it.
• It helps make the internet safer for you: the Code encourages companies to keep their websites and apps safe for you to use, so you can have fun online without worrying about your privacy.

Remember, while the Code helps protect your information, it’s still important to be careful when you’re online. Always talk to a trusted adult if something doesn’t feel right.

Passing of bill a significant step for Australia's privacy law: Read the OAIC’s statement, issued when the Privacy and Other Legislation Amendment Bill passed.

Better privacy protections for children are coming: Read the OAIC’s blog on the Children’s Online Privacy Code.

A safer internet doesn’t need to compromise privacy: Read the OAIC’s blog on the intersections between online safety and privacy.

^[1] The Privacy and Other Legislation Amendment Act 2024 (Cth) (Act) received Royal Assent on December 11 2024.

^[2] Social media service, relevant electronic service and designated internet service are all within the meaning of the Online Safety Act 2021.