Children's Online Privacy Code — what's coming in 2026-27

What the Act requires

The Privacy and Other Legislation Amendment Act 2024 amended the Privacy Act 1988 (Cth) to introduce a Children's Online Privacy Code. This amendment received Royal Assent on 10 December 2024.

The Information Commissioner is responsible for developing the Code. This must be completed within 24 months of commencement, meaning the Code is expected to be finalised by 10 December 2026.

Once developed, the Children's Online Privacy Code will operate as a binding APP Code under Part IIIB of the Privacy Act.

Who the Code will apply to

The Children’s Online Privacy Code applies to Australian APP entities providing specific online services. These services include social media services, relevant electronic services, and designated internet services. The Code’s scope is determined by whether these services are likely to be accessed by children.

For the purposes of the Code, a ‘child’ is defined as an individual under the age of 18. This broad definition means that services are not limited to those specifically targeted at children; any service likely to be accessed by someone under 18 falls within the Code’s reach.

The definitions of social media services, relevant electronic services, and designated internet services are established within the Online Safety Act 2021 (Cth) and are used to determine which entities are subject to the Code.

What the Code is expected to cover

The Children’s Online Privacy Code will address how the Australian Privacy Principles (APPs) apply when handling children’s personal information. This means organisations will need to carefully consider their obligations under the APPs in relation to online services and products directed at, or likely to be accessed by, children.

The Code is likely to include requirements around collection minimisation, default privacy settings, restrictions on profiling and targeted advertising, and the implementation of parental controls. These areas are intended to provide greater protections for children’s privacy online.

The Office of the Australian Information Commissioner (OAIC) released a discussion paper in 2025 to inform the development of the Code. The OAIC is required to consult publicly before the Code is registered.

Interaction with the social media minimum age

The Online Safety Amendment (Social Media Minimum Age) Act 2024 establishes a 16-year minimum age for using age-restricted social media platforms. This legislation will be in effect from 10 December 2025.

The minimum age framework operates separately from the Children's Online Privacy Code. It is important to understand that these are distinct requirements, and compliance with one does not automatically guarantee compliance with the other.

Services required to implement age assurance measures under the minimum age framework will also need to address their obligations under the Children's Online Privacy Code once the Code is registered.