Children’s Online Privacy Code: does it apply to your business?

By the ITLAW Team · General information, not legal advice

The Privacy and Other Legislation Amendment Act 2024 required the Office of the Australian Information Commissioner to develop a Children’s Online Privacy Code. The OAIC released an exposure draft on 31 March 2026 and consulted until 5 June 2026. The finished Code must be registered by 10 December 2026, although the OAIC has not yet confirmed when it will commence.

Who is likely to be covered

The Code applies to businesses already covered by the Privacy Act (APP entities) that provide online services such as social media, apps, games and websites that are likely to be accessed by children or are primarily concerned with children’s activities. Businesses that are not APP entities, for example many small businesses, are generally outside the Code unless an exception to the small business exemption applies. See our small business exemption guide.

What the draft requires

• considering the best interests of the child when handling children’s personal information
• privacy-protective default settings, in line with the “high privacy by default” approach of the UK Children’s Code
• clear, age-appropriate privacy information
• limits on collection, use and disclosure, including for targeted advertising
• easier ways for children and parents to have information deleted

The final Code may differ from the draft, so businesses should check the registered version.

How it fits with the under-16 social media rules

The Code sits alongside the social media minimum age obligation that took effect in December 2025. The two regimes are separate: one is about account access for age-restricted platforms, the other about how children’s personal information is handled across a wider range of online services. See our article on the under-16 rules.

How to prepare

• Work out whether children are likely to use your service, even if it is not aimed at them.
• Map what personal information you collect from younger users.
• Review default privacy settings and advertising practices.
• Rewrite privacy notices in language a child can understand.
• Plan for deletion requests.

Frequently asked questions

When does the Children’s Online Privacy Code start?

The Code must be registered by 10 December 2026. The commencement date and any transition period had not been confirmed when this article was written.

Does the Code apply to small businesses?

Generally only to businesses covered by the Privacy Act. Many small businesses are exempt, but some, such as health service providers, are covered regardless of turnover.

What happens if a business breaches the Code?

Once registered, a breach of the Code will be treated as an interference with privacy, with the OAIC’s usual enforcement powers and penalties available.