Australia Releases Draft Children’s Privacy Code With Strict Consent Rules
On March 31, 2026, Australia published its draft Children’s Online Privacy Code for public comment.
Why it matters: The draft Code sets detailed compliance expectations for online platforms targeting children in Australia. Legal teams face new age verification and consent steps with implications beyond national borders.
- OAIC released the Draft Code on March 31, 2026; comments close June 5, 2026.
- Parental consent required for users under 15; 15 and up can consent independently.
- Covers most online services accessed by children; health services are excluded.
- Mandates age verification, limits on data collection, and allows children to request deletion.
The Office of the Australian Information Commissioner (OAIC) unveiled the Exposure Draft of the Privacy (Children's Online Privacy) Code 2026 on March 31, 2026. The regulation targets social media and digital platforms likely accessed by minors, bringing Australia’s children’s data rules closer to international frameworks like the UK’s Age Appropriate Design Code.
- Consent requirements: Providers must secure parental consent for users under 15. Those aged 15 or older may consent on their own, as outlined by the analysis by King & Wood Mallesons.
- Proportional age assurance: The draft demands age verification tailored to risk, requiring more robust checks where harm is likelier. The change impacts global platforms as well as Australian providers.
- Data practices: The Code restricts data collection to what’s strictly necessary and requires that children can request data deletion. This aims to minimize digital exposure and enhance privacy control for young users.
- Accessible disclosures: Privacy policies must use clear, age-appropriate language. High-risk activities require a privacy impact assessment and proper documentation in a publicly accessible register.
OAIC’s draft aligns with global trends for stricter child data practices. Public comment runs until June 5, 2026, after which the OAIC targets final Code registration by December 10, 2026. Corporate legal teams should review cross-border data practices and prepare for likely changes to Australian compliance norms.
By the numbers:
- 72 million — Estimated data points collected on a child by age 13, per OAIC.
Yes, but: The Code excludes health service providers, narrowing coverage for some digital platforms.
What's next: Final Code registration is targeted for December 10, 2026, after public consultation closes June 5, 2026.