By the time a child turns 13, it is estimated that up to 72 million data points may have been gathered about them.
They may use your educational app to learn maths, play your online game where they chat with other players, complete their homework through your online platform, watch content through a streaming service or create a profile on your app.
Australia’s Children’s Online Privacy Code is being introduced in December 2026, to provide stronger protection for children’s personal information while they participate in the digital world.
If your business operates an online service that children are likely to use, now is the time to review your Privacy Policy and how you collect, use and store children’s personal information.
What is the Children's Online Privacy Code?
The Children’s Online Privacy Code is being developed by the Office of the Australian Information Commissioner (OAIC) and is planned to sit under Australia’s existing Privacy Act 1988.
Its purpose is to strengthen how children’s personal information is protected online and the final Code must be registered by 10 December 2026.
What types of businesses could be affected by the Children's Online Privacy Code?
Depending on whether the business and service fall within the scope of the Code, it could potentially affect businesses operating services such as:
- educational apps for children (since they usually create individual student profiles and records their progress);
- online games (with chat functionality to communicate with other players);
- tutoring or homework platforms for school aged students (including student information and learning results);
- streaming services (due to collecting information about what they watch and how long for);
- apps that allow children to create profiles, upload photographs or communicate with other users; or
If you’re unsure whether the Children’s Online Privacy Code applies to your business, our privacy lawyers can help you understand your obligations and what you may need to do to prepare.
Does the Children's Online Privacy Code apply to overseas businesses?
Potentially, yes. The fact that a business is based overseas does not necessarily mean Australia’s privacy laws cannot apply to it.
The Privacy Act 1988 has extra-territorial provisions that extend its operation to organisations outside Australia where they have an Australian link.
For an overseas organisation, this includes circumstances where it carries on business in Australia.
Whether the Privacy Act and ultimately the Children’s Online Privacy Code apply will depend on the circumstances of the business and service. If you require an Australian lawyer who understands how to apply the upcoming code, contact us.
What personal information should online businesses be looking at?
Now is a good time to understand what information your online service collects about children and what happens to that information.
Depending on the service, your business may be collecting information such as:
- names and dates of birth;
- email addresses and contact details;
- school information;
- photographs and videos;
- location information;
- online activity;
- messages and interactions;
- interests and preferences; and
- information about how the child uses your app, game, website or platform.
Businesses should understand why the information is collected, where it is stored, who has access to it, whether it is shared with third parties and how long it is kept.
For some businesses, answering those questions may uncover data practices they weren’t fully aware of.
How can my business prepare for the Children's Online Privacy Code?
A good place to start is understanding what personal information your online service currently collects about children and what happens to that information.
Understanding your current privacy practices is an important first step in identifying what may need to change once the final Children’s Online Privacy Code is registered.
We are already working with businesses that operate educational apps and online games for children to help them prepare for the upcoming Children’s Online Privacy Code.
This involves looking at what information they collect about children, how information is being used and stored, what information can be shared and what legal changes may be required.
What are the penalties for breaching children's privacy laws?
The potential consequences are another reason businesses are taking preparation seriously.
The Children’s Online Privacy Code will operate within the existing regulatory framework of the Privacy Act 1988 (Cth).
For a serious interference with privacy, the maximum civil penalty for a company can be the greatest of:
- $50 million;
- three times the value of the benefit obtained from the contravention; or
- if the value of that benefit cannot be determined, 30% of the company’s adjusted turnover during the relevant breach turnover period.
Children’s information is important. When considering whether an interference with privacy is serious, the Privacy Act specifically allows a court to consider whether the person affected is a child or a person experiencing vulnerability.
When should businesses start preparing for the Children's Online Privacy Code?
Now. The final Children’s Online Privacy Code must be registered by 10 December 2026.
You don’t need to wait until December to start understanding your existing privacy practices.
We help you understand whether the Children’s Online Privacy Code applies to your business, review how children’s personal information is currently being handled and identify areas that may need attention before the new requirements take effect.
Contact us today to give your business time to understand its legal obligations and make considered changes, rather than discovering privacy problems after the new rules apply.
About the Author
Farrah Motley
Contact an Australian Business Lawyer Today.
Contact us for a free consultation
