What marketers must know about the upcoming online child protection code

With the Australian Government’s ban on social media for children due to come into play on 10 December, social media platforms are squarely in the regulatory crosshairs. But another government initiative is in the wings that could have far-reaching implications for brands with online content ‘likely to be accessed by children’.

Tami Iseli

02 November 2025

4 minute read

In 2023, Human Rights Watch examined 165 different edtech products sanctioned by governments around the world during the COVID-19 lockdowns. It found that all but 12 of them collected and sold children’s data.

This finding was shared in a session at the recent SXSW Sydney conference, where a panel of commentators explored the question of whether we are doing enough to protect the safety of children online. While the government’s impending social media ban for under-16s has occupied the lion’s share of headlines, there’s a new regulatory code currently under development that could have implications well beyond social media. 

The Children’s Online Privacy Code is a new set of rules being developed by the Office of the Australian Information Commissioner (OAIC) to protect the personal information of young people online. Due for release in late 2026, the code will apply to websites, apps, games and other platforms that are ‘likely to be accessed by children’. 

Why is the code being developed?

The code is the result of recommendations that came out of a review of the Privacy Act in 2023. As part of the reform process, the OAIC undertook a significant consultation process that included consulting with children. One of the OAIC’s key findings was that the children themselves wanted increased control over their information, particularly around targeted advertising and the collection of geolocation data. 

The code is in line with similar regulatory reforms happening overseas, including the UK’s Age Appropriate Design Code, which came into force in 2021.

Who will be affected?

Aside from social media platforms, the code will apply to ‘relevant electronic services’ – such as apps and online games with chat functions, as well as websites where users store and share content – including news and education sites. The code may also apply to other sorts of internet-enabled devices that collect personal information, like smart toys and wearables. Health service providers will be exempt to avoid impacting the provision of essential health services. 

According to an Issues Paper released by the OAIC in August this year, the test of ‘likely to be accessed by children’ will consider factors such as: the nature and content of the service, whether it has a particular appeal to children, current evidence on user behaviour and whether any measures are in place to effectively prevent access by children. 

What obligations is the code likely to impose?

Broadly speaking, the code will focus on data control and transparency. 

Data control: The code will give children more control over their data, so any actions you can take to facilitate that control will stand you in good stead for when it arrives. This may include giving children the right to direct that their data be deleted, or deleting it automatically after a period of inactivity. The code may also require online privacy settings to reflect a ‘privacy by default’ framework, with geolocation turned off by default.

Transparency: The spirit of the code is to enable children to better understand how their data is being used. This may lead to the imposition of more prescriptive requirements for the presentation of privacy and collection notices for children, including the mandatory use of user-friendly layouts and icons to improve readability.

What can you do to prepare?

While it’s not yet possible to know exactly what additional requirements may come with the code, there are some basic steps that brands can – and should – be taking to make the internet a safer place for children.

Ensure compliance with existing principles: At a minimum, you should ensure that your brand is compliant with the existing Australian Privacy Principles. Although it’s too early to predict exactly what the code will entail, any additional requirements it imposes must be consistent with the existing Privacy Principles. In other words, the code has to operate within the current framework that allows companies to collect information based on consent or reasonable expectation.

Go beyond existing requirements: If you think the code might apply to your product or service, start putting measures in place to offer better data protection and facilitate greater transparency. Conduct an audit to see where you can improve, including research on what your global competitors are doing (particularly in the UK), and get these ideas into your development roadmap early. 

Get involved in the process: The OAIC is seeking submissions on critical focus areas, including which services should be covered and how existing privacy principles can be enhanced. A draft of the code will be released for further consultation early next year.

Keep Reading

Want more? Here are some other blog posts you might be interested in.