Children’s Online Privacy Code

The Privacy and Other Legislation Amendment Act 2024 (the Act) introduced a mandate for the Office of the Australian Information Commissioner (OAIC) to develop a Children’s Online Privacy Code (the Code), which will put children at the centre of privacy protections in Australia, leveraging insights from our international counterparts.

The Code will:

• specify how online services accessed by children must comply with the Australian Privacy Principles (APPs)

And may:

• impose additional requirements provided they are not inconsistent with the existing principles

September 2024: the Privacy and Other Legislation Amendment Bill introduced to Parliament. A short public consultation is held – read OAIC’s submission.

December 2024: Bill passed and received Royal Assent, becoming an Act.

December 2026: the Code will be in place by 10 December 2026.

January 2025 – August 2025: phase 1 consultations with children, parents and relevant organisations focused on children's welfare.

April 2025 – August 2025: phase 2 consultations with industry stakeholders, civil society and academia.

December 2026: the Code will be in place by 10 December 2026.

The OAIC’s approach to developing the code will be based on research, evidence and extensive consultations.

As code developer, our ultimate objective is not to prevent children from engaging in the digital world, but rather to protect them within it through strengthened privacy protections for the handling of their personal information.

We want to ensure that the Code reflects the real experiences and needs of children and their families. That is why we will consult directly with children, parents and caregivers, alongside experts in child welfare, privacy and online safety. Their insights will help shape a code that allows children to engage in the digital world safely by setting high privacy standards for organisations that collect and use children’s personal information

To the extent possible, we will look to international frameworks, such as the UK’s Age Appropriate Design Code and Ireland’s Children’s Fundamentals for Data Processing, while recognising there are differences in the underlying legal frameworks and leverage the learnings of Australia’s international counterparts.

The OAIC are also mindful of broader government initiatives, including the introduction of a minimum age for access to social media and other relevant digital platforms, the age assurance trial, and the recently completed review of the Online Safety Act 2021 as well as the eSafety Commissioner’s ongoing work with industry codes and standards. The OAIC will continue working with stakeholders across government, industry and the community to ensure a consistent and complementary approach to addressing online harms for all Australians.

The Act requires that the OAIC make available a draft of the Code for public consultation, which will last at least 60 days, invite the public to make submissions, consider any submissions made within the specified period, consult with eSafety and the National Children’s Commissioner and register the Code within 2 years from the day of the Bill’s Royal Assent.^[1]

Ultimately, the content of the code will be determined through the code development process. The OAIC intends to adopt a transparent and collaborative approach. The OAIC will consult widely with children, parents, child development experts, child welfare advocates, civil society, other regulators and across the online industry to ensure different voices are heard and represented throughout the process.

To ensure broad engagement and feedback, our consultation process will take place in several phases, with ongoing engagement throughout each stage:

• Phase 1: initial discussion with children, parents and relevant organisations focused on children's welfare
  • Relevant parties in this process may include, but are not limited to:
    • children and young people
    • children’s rights, wellbeing, and protection groups
    • parents and carers and their representative groups
    • educators and frontline service workers
    • representatives of the LGBTIQ+ community
    • domestic and family violence groups
    • representatives of culturally and linguistically diverse communities
    • First Nations community representatives
• Phase 2: Engagement with civil society, academia and industry stakeholders to gather insights and perspectives.
  • Relevant parties in this process may include, but are not limited to:
    • consumer groups
    • digital rights and civil society groups representatives from academia
    • the tech sector
• Phase 3: A public consultation period on the draft code, lasting a minimum of 60 days

Ongoing: we will continue working with stakeholders across government to ensure a consistent and complementary approach to addressing online harms for all Australians throughout the code development process.

The Code applies to businesses or organisations covered by the Privacy Act 1988 (APP entities) if:

• they are a provider of a social media service, a relevant electronic service or designated internet service^[2]
• the service is likely to be accessed by children, and
• if the entity is not providing a health service.

The OAIC may also specify additional APP entities that must comply with the Code.

The Code is like a set of rules that organisations have to follow to protect children’s privacy online. It makes sure that organisations who run apps, websites and games that kids might use take care of your personal information (like your name, age and what you like to do online).

How does it help me?

We are writing the Code to help make the internet a place that protects your privacy rights.

The Code is different from the social media restrictions that says children under 16 shouldn’t be allowed to use social media.

This Code isn’t about keeping you off the internet, instead, it’s about making sure websites, apps, games, streaming services and social media follow rules to help keep your personal information private and protected.

Remember, while the Code helps protect your information, it’s still important to be careful when you’re online. Always talk to a trusted adult if something doesn’t feel right.

Sunshine and double rainbows – building a better online environment for children and young people: Read the OAIC’s blog on our consultation approach for developing the Children’s Online Privacy Code.

Reset.Tech Australia has been organising a range of research and consultation events and activities around the Children’s Online Privacy Code. Read the documents the summaries and notes from these.

Better privacy protections for children are coming: Read the OAIC’s blog on the Children’s Online Privacy Code.

Passing of bill a significant step for Australia's privacy law: Read the OAIC’s statement, issued when the Privacy and Other Legislation Amendment Bill passed.

A safer internet doesn’t need to compromise privacy: Read the OAIC’s blog on the intersections between online safety and privacy.

^[1] The Privacy and Other Legislation Amendment Act 2024 (Cth) (Act) received Royal Assent on December 11 2024.

^[2] Social media service, relevant electronic service and designated internet service are all within the meaning of the Online Safety Act 2021.

^[3]What is a health service provider?