Australia’s privacy regulator has released draft rules that would force apps, games, streaming platforms and educational tools to overhaul how they handle children’s personal information, in the most significant expansion of online protections for minors since the social media age ban took effect last year.
The Office of the Australian Information Commissioner on Monday published the exposure draft of the Children’s Online Privacy Code, which would require online services to act in a child’s best interests before collecting, using or sharing their data – and give children a new right to demand permanent deletion of their personal information.
Privacy Commissioner Carly Kind said that an estimated 72 million pieces of data were collected about a child by the time they turned 13, leaving them exposed to data breaches, discrimination, algorithmic bias and targeted advertising of harmful products.
“It is critically important that we protect these rights, so that children can develop their capacity to choose how they want to engage in the digital world, what information about themselves they want to share and with whom,” Kind told this masthead.
The code goes well beyond the under-16s social media ban, which took effect in December 2025 and applied only to age-restricted social media platforms. The new rules would cover games, streaming platforms and educational tools – meaning services such as Roblox, YouTube, Spotify and school-issued apps would all be affected.
Sarah Davies, chief executive of the Alannah & Madeline Foundation – a charity that works to prevent violence against children – said the code was the first piece of serious legislative reform to target the drivers of online harms rather than responding to symptoms.
“What this online children’s privacy code is saying is, you can’t do that. You cannot exploit children and their data,” Davies said.
She described the code’s two-step consent mechanism for under-15s – where a child must first assent before a parent or carer confirms – as “genius”, noting that if a child says no, the answer is no regardless of what the parent decides. Davies said she anticipated resistance from big tech during consultation. “They have had years and years and years to deal with this. They have known exactly what they’ve been doing,” she said.
Professor Dan Angus, director of the QUT Digital Media Research Centre, said the code reversed the onus onto platforms to justify why they needed children’s data. He said the approach was pragmatic, unlike what he described as “the fantasy land of the social media ban where the policymakers expected all under-16s to simply go and touch grass”.
Digital Rights Watch head of policy Tom Sulston said the code exposed weaknesses in Australia’s broader privacy framework. Protections available to children under the draft – including the best-interests test and the right to deletion – were not currently available to adults, he said, calling for the long-delayed second tranche of privacy reform to advance through parliament. Sulston also said there should be a general prohibition on direct marketing to children, arguing it was difficult to see how such marketing could ever be in a child’s best interests.
Under the draft rules, online services would need to collect only the minimum personal information required to operate, with privacy settings turned to maximum protection by default. Dark patterns – design tricks that pressure children into handing over data – would be explicitly banned. Targeted advertising would require consent and must be in the child’s best interests.
Professor Tama Leaver, of Curtin University’s ARC Centre of Excellence for the Digital Child, said the code accepted young people were online in a multitude of ways and sought to make those spaces safer. He said notifying children when parents consented to data collection on their behalf was more than symbolic – it was a vital step in building digital literacy and ensuring young people valued their privacy.
The consent framework sets 15 years as the threshold age. Children aged 15 and over could consent independently, while those under 15 would need parental permission. In a novel provision, services would be required to notify children when parents consent to data collection on their behalf, and to alert children when other users are tracking their geolocation.
Public consultation runs for 60 days until June 5, with the Office of the Australian Information Commissioner targeting registration of the final code by December 10, 2026.
Get news and reviews on technology, gadgets and gaming in our Technology newsletter. Sign up to receive it every Friday.
David Swan is the technology editor for The Age and The Sydney Morning Herald. He was previously technology editor for The Australian newspaper.Connect via X or email.