-
On this page
What is the Children’s Online Privacy Code?
The Privacy and Other Legislation Amendment Act 2024 (the Act) introduced a mandate for the Office of the Australian Information Commissioner (OAIC) to develop a Children’s Online Privacy Code (the Code), which will put children at the centre of privacy protections in Australia, leveraging insights from our international counterparts.
The Code will:
- specify how online services - like apps, games, and websites - accessed by children or concerning the activities of children, must comply with the Australian Privacy Principles (APPs)
And may:
- impose additional requirements provided they are not inconsistent with the existing principles
Key milestones
September 2024: the Privacy and Other Legislation Amendment Bill introduced to Parliament. A short public consultation is held – read OAIC’s submission.
December 2024: Bill passed and received Royal Assent, becoming an Act.
December 2026: the Code will be in place by 10 December 2026.
January 2025 – August 2025: Phase 1 consultations with children, parents and relevant organisations focused on children's welfare.
April 2025 – August 2025: Phase 2 consultations with industry stakeholders, civil society and academia.
April 2026 and May 2026: Phase 3 consultations – Details coming soon.
December 2026: the Code will be in place by 10 December 2026.
Our approach to developing the Code
The OAIC’s approach to developing the Code will be based on research, evidence and extensive consultations.
As Code developer, our ultimate objective is not to prevent children from engaging in the digital world, but rather to protect them within it through strengthened privacy protections for the handling of their personal information.
We want to ensure that the Code reflects the real experiences and needs of children and their families. That is why we continue to consult directly with children, parents and caregivers, alongside experts in child welfare, privacy and online safety. Their insights will help shape a code that allows children to engage in the digital world safely by setting high privacy standards for organisations that collect and use children’s personal information
To the extent possible, we continue to look to international frameworks, such as the UK’s Age Appropriate Design Code and Ireland’s Children’s Fundamentals for Data Processing, while recognising there are differences in the underlying legal frameworks and leverage the learnings of Australia’s international counterparts.
The OAIC is also mindful of broader government initiatives, including the introduction of the Social Media Minimum Age scheme, the completed Online Safety Act 2021 review and the Unlawful and Age-restricted material Codes registered by the eSafety Commissioner. The OAIC will continue working with stakeholders across government, industry and the community to ensure a consistent and complementary approach to addressing online harms for all Australians.
The Act requires that the OAIC make available a draft of the Code for public consultation, which will last at least 60 days, invite the public to make submissions, consider any submissions made within the specified period, consult with eSafety and the National Children’s Commissioner and register the Code within 2 years from the day of the Bill’s Royal Assent.[1]
Ultimately, the content of the code will be determined through the code development process. The OAIC intends to adopt a transparent and collaborative approach. The OAIC will continue to consult widely with children, parents, child development experts, child welfare advocates, civil society, other regulators and across the online industry to ensure different voices are heard and represented throughout the process.
Consultation timelines
To ensure broad engagement and feedback, our consultation process has taken place in several phases, with ongoing engagement throughout each stage:
Completed: Phase 1 (January to August 2025)
Initial discussions with children, parents and relevant organisations focused on children's welfare. This included:
- 337 children, young people and parents/carers responded to our online worksheets in June 2025.
- We met with relevant national and international parties in this process including, but are not limited to
- international counterparts
- eSafety Commissioner
- children’s rights, wellbeing, and protection groups
- educators and frontline service workers
- out-of-home care groups
- representatives of culturally and linguistically diverse communities
- First Nations community representatives
Completed: Phase 2 (April to August 2025)
Engagement with civil society, academia and industry stakeholders to gather insights and perspectives. This included:
- 167 virtual attendees to the OAIC’s public webinar about the Code in May 2025.
- 61 submissions in response to our Children’s Online Privacy Code Issues Paper.
- 70 participants in a one-day workshop (April 2025) in which digital rights and civil society representatives from academia gave feedback.
- 32 industry stakeholders, including representatives from the tech, education, gaming, retail, and telecommunications sectors, attended three industry roundtable discussions in July 2025.
Coming soon: Phase 3 (April and May 2026):
A public consultation period on the draft Code, lasting a minimum of 60 days. Details coming soon.
The OAIC will once again seek feedback from children, young people and parents and carers as well as from academia, civil society, government, industry and other interested stakeholders.
Ongoing: we will continue working with stakeholders across government to ensure a consistent and complementary approach to addressing online harms for all Australians throughout the code development process.
Who will be bound by the Code?
The Code applies to businesses or organisations covered by the Privacy Act 1988 (APP entities) if:
- they are a provider of a social media service, a relevant electronic service or designated internet service[2]
- the service is likely to be accessed by children, and
- if the entity is not providing a health service.
The OAIC may also specify additional APP entities that must comply with the Code.
What is a social media service, a relevant electronic service and a designated internet service?
Social media services: these are platforms where people can connect, share content and interact with others. This includes social networks public media-sharing sites, discussion forums and review platforms.
Relevant electronic services: these are online services that let people communicate with each other. This includes messaging apps, email services, video calling platforms and online games where players can chat.
Designated internet services: this covers online services that allows users to access or receive material over the internet. (e.g. cloud storage, websites that let users receive/access content, streaming platforms, consumer IoT devices).
Note: These examples are only for the purposes of the Children’s Online Privacy Code.
For kids
The Code is a set of special rules that online services like apps, games and websites must follow to protect children’s privacy online. It makes sure that online services that children use or concern the activities you do, take care of your personal information.
Personal information is things like your name, address, email, phone number, school, date of birth, photos or videos of you, location, and online activity.
Protecting your personal information online is one important step to protecting your online privacy.
How does it help me?
We are writing the Code to help make the internet a place that protects your online privacy.
The Code is different from the social media restrictions that removed under 16 year old children from age-restricted social media platforms.
This Code isn’t about keeping you off the internet, instead, it’s about making sure online services like apps, games, and websites follow extra rules to help keep your personal information private and protected.
Remember, while the Code helps protect your information, it’s still important to be careful when you’re online. Always talk to a trusted adult if something doesn’t feel right.
More information
Children’s Online Privacy Code: Public Consultation Report: Read the report that summarises the key themes reflected in the perspectives of 337 children, young people and parents/carers who responded to our 2025 consultation.
Children’s Online Privacy Code - children’s consultation report: Read the child-friendly report on what we heard from children and young people in our 2025 consultation.
Sunshine and double rainbows – building a better online environment for children and young people: Read the OAIC’s blog on our consultation approach for developing the Children’s Online Privacy Code.
Better privacy protections for children are coming: Read the OAIC’s blog on the Children’s Online Privacy Code.
Passing of bill a significant step for Australia's privacy law: Read the OAIC’s statement, issued when the Privacy and Other Legislation Amendment Bill passed.
A safer internet doesn’t need to compromise privacy: Read the OAIC’s blog on the intersections between online safety and privacy.
[1] The Privacy and Other Legislation Amendment Act 2024 (Cth) (Act) received Royal Assent on December 11 2024.
[2] Social media service, relevant electronic service and designated internet service are all within the meaning of the Online Safety Act 2021.
