Who must comply with Children's Online Privacy Code 2026?

OAIC developing a mandatory children's online privacy code — must be registered by 10 December 2026 (commencement not yet fixed).

Privacy and Other Legislation Amendment Act 2024 requires the OAIC to develop a binding Code addressing children's privacy online and register it by 10 December 2026. Consultation ran in three phases from January 2025 to June 2026. Per the OAIC, the Code binds APP entities that provide a social media service, a relevant electronic service or a designated internet service (as defined in the Online Safety Act 2021) that is likely to be accessed by children or is primarily concerned with children's activities — unless the entity is providing a health service. The OAIC may specify additional APP entities. The Code's commencement date is not yet fixed — the Code will set it.

Applies when the business has APP-entity status (turnover > $3M or a s 6D(4) carve-out) and an online service likely to be accessed by children and not a health service. Where the business has APP-entity status (turnover > $3M or a s 6D(4) carve-out) and not a health service and children's data or an approved childcare service or a school, check whether you provide an app, website, game or other online service likely to be accessed by children.

How the regulator frames it: APP entities providing social media, relevant electronic or designated internet services likely to be accessed by children (not health service providers).

What triggers it: Online service availability to children.

Jurisdiction: Commonwealth law, so the test is the same in every state and territory.

Outcome across the 35 industries Rules Mate maps (35 of 35: no).

The answer is the same in every industry: no. Industry does not change who must comply.

Structure does not change the answer across all industries: for every structure the answer is "no".

Size does not change the answer across all industries: at every size band the answer is "no".

Each line is one run of the Rules Mate applicability engine for a single business profile, with the reason the engine gives:

• Pty Ltd company in real estate agents with 6–19 employees, turnover $1M–$3M: does not apply. Requires APP-entity status (turnover > $3M or a s 6D(4) carve-out) and an online service likely to be accessed by children and not a health service.

Starting from a small or large professional services company that does not otherwise meet the test, each of these single facts changes the engine's answer:

• The business holds children's personal information: it becomes worth checking, because it applies only if you provide an app, website, game or other online service likely to be accessed by children.

The engine shows this obligation as "check whether this applies" when a business has APP-entity status (turnover > $3M or a s 6D(4) carve-out) and not a health service and children's data or an approved childcare service or a school. It then applies only if you provide an app, website, game or other online service likely to be accessed by children. That fact is not something Rules Mate can infer from industry, structure or size.

When due

Code to be registered by 10 December 2026; obligations apply from the commencement date the Code sets (not yet fixed).

Frequency

Ongoing

Evidence to keep

Age verification + default privacy + parental consent records.

In force from

10 December 2026

Status

Upcoming (not yet in force)

Priority

High

No maximum penalty is recorded for this obligation in the Rules Mate corpus; check the regulator source below.

Rules Mate has not yet classified the audit or assurance level for this obligation. Any audit, review or certification requirement is set by the regulator source listed below.

• Children's Online Privacy Code registration deadline: 10 December 2026 (one-off). Deadline for the OAIC to register the binding Children's Online Privacy Code. The Code's own commencement date is not yet fixed — it may apply later than 10 December 2026.

• APP 3 collection of sensitive information: APP 3 bars collecting sensitive information — health, race, religion, sexual orientation and more — without consent. What counts as sensitive, the exceptions and penalties.
• Automated decision-making transparency in your privacy policy (APP 1.7–1.9): From 10 December 2026, APP entities that use computer programs to make or substantially assist decisions that significantly affect individuals must say so in their APP privacy policy.
• Notifiable Data Breach (NDB) scheme: Under the NDB scheme, APP entities must notify the OAIC and affected individuals of an eligible data breach likely to cause serious harm — assessed within 30 days.
• APP 12 & APP 13 access and correction requests: Individuals can ask to access (APP 12) and correct (APP 13) the personal information you hold — the strict response times, allowable refusals and how to comply.
• APP 7 direct marketing: consent, opt-out & when you can't message (2026): APP 7 restricts using or disclosing personal information for direct marketing and requires a simple opt-out — when it applies, the exceptions and penalties.

Rules Mate tracks 20 published obligations tagged "privacy", 3 of them rated critical. For a professional services Pty Ltd company with 6–19 employees operating in every state, 4 of those apply outright. This obligation is rated high priority, and is an ongoing duty.

Regulated by Office of the Australian Information Commissioner.

OAIC: Privacy and freedom of information regulator. Administers the Privacy Act 1988, the Notifiable Data Breaches scheme, and the Australian Privacy Principles.

• Office of the Australian Information Commissioner

Privacy Act 1988: Federal privacy Act.

• Privacy Act 1988

Free tools that help with this obligation:

• Privacy Act 2026 readiness
• NDB notification timer
• Marketing compliance check (Spam Act)