The Office of the Australian Information Commissioner has released an exposure draft of the Children’s Online Privacy Code, introducing proposed rules that require organisations to prioritise the best interests of children before collecting, using or disclosing their personal information.
Developed following the passage of the Privacy and Other Legislation Amendment Act in 2024, the draft code sets out new standards for the digital environment aimed at improving online experiences for children and young people.
Key measures include mandatory consideration of children’s best interests, consent requirements for targeted advertising, and new rights allowing children to request deletion of their personal data.
While many provisions align with international frameworks such as the UK’s Age Appropriate Design Code, the Australian proposal includes additional safeguards.
These include requirements for online services to notify children when parents consent to data collection on their behalf, and when their geolocation is being tracked by other users, including parents.
John Livingstone, Head of Digital Policy at UNICEF Australia, says Children’s data is being collected and used at unprecedented levels.
“The draft Code recognises that young people’s information needs extra care, and should not be collected, shared or sold without strong safeguards in place,” said Livingstone
Public consultation on the draft opens today and will run for 60 days, inviting input from children, parents, carers, industry and civil society before the code is finalised, with implementation targeted for December 2026.
The proposed code expands on existing protections, including Australia’s Social Media Minimum Age law introduced in December 2025, by applying to a broader range of digital services such as games, streaming platforms and educational tools.
The rules are expected to cover most apps, websites and online services frequently used by children and teenagers, particularly those presenting higher privacy risks.
“It has been estimated that by the time a child turns 13, around 72 million pieces of data will have been collected about them, making them vulnerable to harms from data breaches, discrimination, algorithmic bias and targeted advertising of harmful products, amongst other risks,” says Privacy Commissioner Carly Kind.
The draft code places new obligations on organisations to design services that actively protect children’s personal information.
“Importantly, the Code will not restrict or limit children and young people’s participation in online spaces,” said Kind
“Instead, it raises the standard for privacy protections in Australia and puts the onus on online services to do better when handling children’s personal information online,”
“Children play, learn, socialise and connect with family and culture online – it’s important that children can participate without fear or exploitation”
“The Code will give confidence to parents that the apps, games and websites their children use are taking steps to protect children’s privacy,” she said
The draft introduces obligations requiring organisations to ensure data collection aligns with a child’s best interests, alongside stricter rules governing direct marketing.
It also expands children’s rights to request deletion of their data, mandates clearer age-appropriate privacy notices, and strengthens consent mechanisms, including notifying children when parental consent is provided.
To support consultation, the ” website alongside a suite of materials including draft documents, guides for different age groups, and educational resources such as lesson plans and workshops.
Submissions will be accepted until 5 June 2026, after which the regulator will review feedback ahead of progressing toward formal registration of the code by 10 December 2026.
