Privacy (Children’s Online Privacy) Code 2026
Submission Date: 7 July 2026
The Law Council of Australia provided feedback to the Office of the Australian Information Commissioner about the Exposure Draft of the Privacy (Children’s Online Privacy) Code 2026 (the Code) and Exposure Draft Explanatory Statement.
The Privacy and Other Legislation Amendment Act 2024 (Cth) inserted section 26GC into the Privacy Act 1988 (Cth), requiring the Information Commissioner to develop and register an Australian Privacy Principles (APP) code about online privacy for children within 24 months of Royal Assent, being by 10 December 2026. This is consistent with Proposal 16.5 of the Privacy Act Review Report.1
The Code is to be read as operating alongside an entity’s existing obligations under the APPs, the Privacy Guidance on age assurance technologies and the Privacy Guidance on Part 4A (Social Media Minimum Age) of the Online Safety Act 2021 (Cth).
The Code includes new rules that require organisations to ensure that they consider the best interests of children before collecting, using or disclosing their personal information. It is not intended that children’s and young people’s access to online spaces be restricted or limited as a result of the Code.
The Law Council strongly supports the intent of the Code and the positive steps being taken to advance online privacy protections for children consistent with Australia’s obligations under Articles 3 and 16 of the Convention on the Rights of the Child.2
However, the Law Council maintains reservations about how the Code, in its current form and without further guidance, can be adequately implemented. We are particularly concerned about the extent to which the Code sufficiently clarifies obligations for the private entities that will be bound by it, and the potential for the Code to capture a wide range of industries or sectors that may already be subject to significant regulation. The regulatory burdens to be imposed by the Code should be proportionate to the risk they are seeking to mitigate; if this is not correctly calibrated, providers of some services may withdraw from the market and not provide services to young people.
Given the obligations the Code imposes, and the consequences of non-compliance (including inadvertent non-compliance), the Law Council’s primary recommendation is that the necessary clarifications be made within the text of the Code itself. Supporting guidance and other materials have an important role in assisting entities to comply, but they should supplement, rather than substitute for, clear drafting of the operative obligations.
This submission builds on the Law Council’s earlier submissions, in particular its submission of 8 August 2025 on the Children’s Online Privacy Code: Issues Paper,3 and its submission of October 2024 to the Senate Legal and Constitutional Affairs Legislation Committee on the Privacy and Other Legislation Amendment Bill 2024.4
The Law Council’s comments are directed to strengthening the draft Code so that the entities bound by it can understand and implement their obligations in practice, while delivering meaningful protections for children.
1 Australian Government Attorney-General’s Department, Privacy Act Review (Report, 2022) 157.
2 Convention on the Rights of the Child, opened for signature 20 November 1989, 1577 UNTS 3 (entered into force 2 September 1990) (‘CRC’).
3 Law Council of Australia, Children’s Online Privacy Code: Issues Paper (Submission, 8 August 2025).
4 Law Council of Australia, Privacy and Other Legislation Amendment Bill 2024 (Submission, 22 October 2024).
Last Updated on 14/07/2026