- 18 Nov 2026 UK Have your directors and PSCs verified with Companies House?
- 1 Dec 2026 AU Will your onboarding accept private-sector Digital IDs?
- 10 Dec 2026 AU Does your privacy policy explain your automated KYC decisions?
- End 2026 EU Is your ID verification ready for EUDI Wallets?
- 1 Jan 2027 US Can your age checks keep up state by state?
- 1 Apr 2027 JP Is your eKYC ready for the IC-chip mandate?
- 10 Jul 2027 EU Is your CDD flow ready for the AMLR?
- 1 Jan 2028 US Are your adviser clients ready for FinCEN’s AML rule?
- 31 Mar 2029 AU Is your initial CDD on the new AUSTRAC model?
- Now AU Tranche 2 is live. Is your AML/CTF program running?
Children's Online Privacy Code: what the draft says and when it lands
The OAIC must register a Children's Online Privacy Code by 10 December 2026. It will bind online services likely to be accessed by children. Most professional firms will not be bound, but those that collect children's details online should know the draft.
- The Privacy and Other Legislation Amendment Act 2024 requires the OAIC to develop a Children's Online Privacy Code and register it by 10 December 2026.
- The OAIC released an exposure draft, the Privacy (Children's Online Privacy) Code 2026, on 31 March 2026, and consultation closed on 5 June 2026.
- 10 December 2026 is a registration deadline. The commencement date has not been announced, and the draft left it to be set.
- The Privacy Act defines a child as an individual who has not reached 18 years, and a breach of the Code will be a breach of the Privacy Act.
What it is
The Children's Online Privacy Code is an APP code: a legislative instrument under the Privacy Act 1988 that says how certain online services must apply the Australian Privacy Principles to children, and adds further requirements. The OAIC is writing it under section 26GC of the Privacy Act, inserted by the Privacy and Other Legislation Amendment Act 2024.
The exposure draft sets out rules on working out users' ages, collecting only what is strictly necessary by default, acting in the best interests of the child, consent, notices, access, destruction requests, privacy impact assessments and training. The final text may differ from the draft. The base law is on the Privacy Act 1988 page.
Who it applies to
The Code will apply to APP entities providing social media services, relevant electronic services or designated internet services, as defined in the Online Safety Act 2021, that are likely to be accessed by children or primarily concerned with children's activities. The draft would also bind some providers of child-focused services, and excludes carriage service providers.
- Apps, games, educational tools and websites likely to be accessed by children
- Services primarily concerned with children's activities, such as family photo sharing apps, school management systems and connected baby monitors (examples from the draft)
- It applies service by service, so an entity may be bound for one service and not another
Accountants, lawyers, conveyancers and real estate agents are unlikely to be bound when they onboard clients. The link is indirect: firms sometimes collect details of minors, such as trust beneficiaries, and the Code's approach to consent at 15 and destruction on request shows where children's privacy expectations are heading. Whether a particular online form or portal falls within a designated internet service is a question for your own advice.
What the draft requires
These come from the exposure draft and bind only services within its scope. Treat them as proposed until the final Code is registered.
- Take reasonable steps to work out a user's age
Section 8 of the draft requires steps reasonable to the risk of harm before collecting personal information, unless the service applies the Code to all users regardless of age. Sensitive information collected only to work out age must be destroyed once that is done.
Covered services only - Collect only what is strictly necessary by default
Section 9 requires default settings that collect, use or disclose only what is strictly necessary to provide the service, with simple controls for anything more.
Covered services only - Act in the child's best interests
Sections 10 and 11 require collection, use and disclosure to be consistent with the best interests of the child.
Covered services only - Get consent from the right person
Under section 13 a child may consent only if at least 15. For a younger child, consent must come from a person with parental responsibility, and the service must take reasonable steps to confirm who that person is.
Covered services only - Destroy information on request
Section 32 lets a child, or a parent for a child under 15, ask for specified information to be destroyed, subject to limited exceptions.
Covered services only
What firms get wrong
The Code is often described as starting on 10 December 2026, and its reach is often overstated.
The OAIC says the Code must be finalised and registered by 10 December 2026. The draft explanatory statement says the commencement date will be set in the final version, and an APP code cannot come into force before it is on the Codes Register.
The draft applies to social media services, relevant electronic services and designated internet services likely to be accessed by children or primarily concerned with children. Offline dealings, and services outside those categories, sit with the ordinary APPs.
What happens when
- In force
Privacy and Other Legislation Amendment Act 2024 receives Royal Assent, mandating the Code Source
- Proposed
OAIC releases the exposure draft Code for consultation Source
- Proposed
Consultation on the exposure draft closes Source
- Proposed
Deadline for the OAIC to finalise and register the Code Source
- Not yet setProposed
Code commences Source
Not yet confirmed. We will update this when the date is set.
Also on the regulatory timeline.
Related guides
Questions people ask
What is the Children's Online Privacy Code?
It is an APP code the OAIC must make under the Privacy Act. It will set how online services likely to be accessed by children handle children's personal information, on top of the Australian Privacy Principles. See the Australian Privacy Principles explained.
When does the Children's Online Privacy Code start?
The OAIC must register it by 10 December 2026. The start date has not been announced, and the code cannot come into force before it is registered.
What age counts as a child?
The Privacy Act defines a child as an individual who has not reached 18 years. Under the draft, a child aged 15 or over can give their own consent, and a parent must consent for a younger child.
Does the Code apply to my accounting or law firm?
Probably not for client onboarding, because it targets online services likely to be accessed by children. Your duties for client information come from the Privacy Act 1988 and, for AML/CTF records, AML/CTF Tranche 2.
Primary sources
Checked 5 Nov 2026. We review this page every 90 days and when the rules change.
- OAIC, Children's Online Privacy Code
- OAIC, Exposure Draft Privacy (Children's Online Privacy) Code 2026
- OAIC, Draft Explanatory Statement for the Exposure Draft Code
- Attorney-General, Draft Children's Online Privacy Code released (31 March 2026)
- Federal Register of Legislation, Privacy and Other Legislation Amendment Act 2024
Where StackGo fits
The Code is aimed at online services used by children, which is outside what IdentityCheck is built for. It runs client due diligence for regulated professional firms.
- Onboarding forms where you choose what to collect, including multi-entity forms that record each person on a structure, such as trust beneficiaries
- By default, no personal details are written back to connected systems: they receive a link to the result plus the outcome and status
- It does not do age assurance or age estimation
- It does not collect or confirm parental consent
- It does not tell you whether a service of yours is covered by the Code, and it does not give legal advice
Ready to make onboarding minutes, not hours?
Start free and run your first check today, or book a demo and we will walk you through it.