Australia is set to introduce a Children’s Online Privacy Code aimed at enhancing privacy protections for children engaging with digital platforms.
The Privacy and Other Legislation Amendment Bill 2024 mandates that the Office of the Australian Information Commissioner (OAIC) will develop this code, which will apply to online services likely to be accessed by children, including social media platforms, apps, games, websites, and messaging services.
The code will outline how these services must comply with the Australian Privacy Principles (APPs), ensuring children’s personal information is handled with heightened privacy standards.
The OAIC has been allocated funding to draft the code, with a requirement to register it by December 10, 2026 (i.e., this is when it is expected to come into effect). The code’s implementation reflects a global trend towards strengthening online privacy laws to safeguard children’s digital experiences.
The OAIC has commenced consultation, beginning with young people and their guardians. The Privacy Commissioner posted about these meetings last week.
Consultations are now into phase 2, according to the OAIC’s timeline. Over 70 civil society representatives and academics came together on Monday in Sydney to consider how the APPs might be interpreted under the code to enhance children’s privacy. Participants heard from Carly Kind, Kate Bower and other OAIC leaders on how the OAIC was approaching the development of the code, before debating how the APPs should be interpreted in the code.
Some of the critical issues that elevenM considers will require resolution include:
- The ultimate scope of entities bound by the code, noting both that entities providing a health service are excluded, and the OAIC may specify the inclusion of APP entities or classes of entities who would otherwise not be caught by the definition.
- The fact that the code drafting must progress in the absence of some of the significant reforms that have been parked for possible inclusion or exclusion via ‘Tranche 2’ including the ‘fair and reasonable’ test and the broadening of the definition of ‘personal information’. How can we future proof the code if one progresses without the other?
- The clash between the human rights of autonomy and self-determination of the child (to make their own decisions about collections, uses and disclosures of their personal information, including whether they want personalised marketing) and the fiduciary duty of a parent to protect from harm and act in the best interests of the child.
- Additional thorny issues like the challenges of replicating online the human judgment required to assess age-based capacity and the fact that vulnerability is a state of being which can fluctuate rather than being a label applied statically to a person or group of people.
- The need for consent to be voluntary and timely, meaning consenting to any and all collections, uses and disclosures forever should not be the only way young people can participate in these online activities.
- Flaws in the prevailing model requiring individuals to read lengthy, complex notices and policies, prompting consideration of how platforms and services could be compelled to offer better, more engaging ways to inform children about privacy matters.
- Balancing the desire for children and young people to establish a digital presence and engage with peers and the community while also protecting them from misuse of their personal information.
- Other practical consent issues, such as the circumstances in which both child and parent or guardian should consent, and the need for a right of deletion for previous collections to which a parent consented, when a child has capacity.
Next steps are industry consultations, followed by an issues paper expected later this year and a draft code in early 2026.
elevenM looks forward to continuing to advocate to protect children online.
*Credit to @john pane for the digital treehouse analogy.
Contact us
If you’re interested in talking to us about how your services consider and engage with privacy protections, get in touch.