Key takeaway
- The OAIC must register the Children’s Online Privacy Code (the Privacy (Children’s Online Privacy) Code 2026) by 10 December 2026.
- Registration is not commencement: the commencement date and any transition period have not been confirmed.
- The Code applies to APP entities providing an in-scope online service that is likely to be accessed by children. Health services are carved out.
- “Likely to be accessed” turns on who actually uses your service, not your terms of use or a minimum-age clause.
The registration deadline is not discretionary; it comes from the Privacy and Other Legislation Amendment Act 2024. What is still open is the detail, and one point that is widely misread: registration is not commencement. The Code’s commencement date and any transition period have not been confirmed. Planning on the assumption of a generous runway after December 2026 is a risk, not a strategy, and the exposure draft contemplates technical, process and policy changes that are not quick to implement.
For businesses in scope, the sensible approach is to begin scoping and remediation now, then true up against the registered text.
Who Is Likely in Scope
In short: an in-scope online service that is likely to be accessed by children, unless it is a health service.
The trigger is narrower than “any website” and wider than “apps for kids”. On the exposure draft, the Code applies to an APP entity that provides a social media service, a relevant electronic service or a designated internet service, terms borrowed from the Online Safety Act 2021 (Cth), where that service is likely to be accessed by children or primarily concerns the activities of children. Entities providing a health service are carved out. “Likely to be accessed” turns on the reality of your user base, not your terms of use. A minimum-age clause in the T&Cs is not an answer if your analytics, support tickets and content mix all say otherwise. Streaming platforms, games, general consumer apps and education-adjacent services with mixed-age audiences all warrant a documented scope assessment, as does any service that has quietly become popular with teenagers.
Most of our clients read “children’s online privacy” and stop, on the reasonable view that an MSP, mining or defence business does not run a children’s service. The exceptions are worth ten minutes. Apprenticeship and school-leaver recruitment portals, scholarship and community-program applications run by resources companies, and family-member registration flows inside employee benefit platforms all collect personal information from people under 18 through an online service. Whether that makes the service “likely to be accessed by children” is a genuine question, and a cheaper one to ask now than after the Code is registered.
| Key terms, defined
Likely to be accessed by children: assessed on your actual user base (analytics, support tickets, content mix), not just whether you target children or set a minimum age. In-scope online service: a social media service, relevant electronic service or designated internet service: categories borrowed from the Online Safety Act 2021 (Cth). Registration vs commencement: registration is the OAIC formally making the Code by 10 December 2026; commencement is when obligations take effect, which may be later and is not yet confirmed. |
What “Alignment Now” Looks Like
The UK’s Age Appropriate Design Code has already established the practical vocabulary regulators in this space use: privacy by default for younger users, data minimisation, parental controls appropriate to age, and design choices that don’t nudge children toward reduced privacy settings. Benchmarking against that Code now gives Australian businesses a defensible starting position. But treat it as a floor rather than a substitute: the OAIC has been explicit that the Australian Code includes protections developed for the local context, and it operates through the Australian Privacy Principles rather than the UK GDPR. Work done against the AADC will transfer; it will not discharge the obligation.
Practical Steps Before December 2026
Work through this before the registration deadline of 10 December 2026:
- Assess honestly whether your service could reasonably be accessed by children, not just whether it targets them.
- Review default privacy settings and consent flows for anything that could apply to a younger user base.
- Benchmark your current practices against the UK Age Appropriate Design Code as an interim standard.
- Document the scope assessment and the reasoning behind it; if the answer is “not in scope”, that conclusion is the thing you will need to defend.
- Map where children’s personal information actually flows, including to third-party software development kits (SDKs), analytics and advertising partners.
- Watch for registration, and separately for the commencement date and any transition period; those have not yet been confirmed.
If you would rather not run the scope assessment in-house, legal as a service can provide support in assessing the scope, documenting the reasoning, and benchmarking your practices against the interim standard.
Frequently Asked Questions
When must the Children’s Online Privacy Code be registered?
The OAIC must register it by 10 December 2026, a fixed deadline set by the Privacy and Other Legislation Amendment Act 2024. The exposure draft was released on 31 March 2026, and consultation closed on 5 June 2026.
Does registration mean the Code is in force?
No. Registration and commencement are different. As of writing, the Code’s commencement date and any transition period have not been confirmed, so a long runway after December 2026 cannot be assumed.
Who does the Children’s Online Privacy Code apply to?
On the exposure draft, it applies to an APP entity providing a social media service, relevant electronic service or designated internet service that is likely to be accessed by children or primarily concerns children’s activities. Health services are excluded.
What does “likely to be accessed by children” mean?
It turns on the reality of your user base, not your terms of use. A minimum-age clause does not settle the question if your analytics, support tickets and content mix show younger users are present.
My business is not a children’s service. Could it still be in scope?
Possibly. Apprenticeship and school-leaver portals, scholarship and community-program applications, and family-registration flows in benefit platforms all collect information from people under 18 online. A documented scope assessment is the way to answer this.
Related reading: The ADM Clock Is Already Running: December 2026 Deadline for AI-Driven Decisions.
Disclaimer
This article is general information only and is not legal advice. This article discusses the exposure draft of the Privacy (Children’s Online Privacy) Code 2026 released on 31 March 2026. The Code had not been registered at the time of writing, and its final requirements may differ from the draft discussed here. Obtain advice specific to your service and circumstances before acting.
Source: Office of the Australian Information Commissioner, Children’s Online Privacy Code, https://www.oaic.gov.au/privacy/privacy-registers/privacy-codes/childrens-online-privacy-code