Does the Children's Online Privacy Code apply to you?

Last checked 25 September 2026 against the Privacy Act 1988 compilation C2026C00227 (compilation date 4 June 2026) and the Privacy and Other Legislation Amendment Act 2024 (C2024A00128)

s 26GC(10) the law, read in the authorised textOAIC guidance the regulator's published guidance, which is not law

The Code at a glance

The duty to make the Code was added by the Privacy and Other Legislation Amendment Act 2024, which received Royal Assent on 10 December 2024.¹ It is now s 26GC of the Privacy Act 1988.

Who will be bound

An APP entity is bound by the Code if all of the following apply:² s 26GC(5)

• it provides a social media service, a relevant electronic service or a designated internet service, each as defined in the Online Safety Act 2021;
• the service is likely to be accessed by children; and
• the entity is not providing a health service.

The Code can also specify other APP entities, or classes of APP entities, that are bound. And it can specify APP entities that are not bound, even if they meet the tests above.² s 26GC(7)

The Commissioner may publish written guidelines to help entities work out whether a service is likely to be accessed by children. Those guidelines are not a legislative instrument.³ s 26GC(11)

The Online Safety Act 2021 definitions are not reproduced here. Read them before you decide your service is outside them. The OAIC describes the Code as reaching "most apps, games and websites that children and teenagers use daily, as well as online services that are primarily concerned with the activities of children".⁴ OAIC That is the regulator's description of its draft. The registered Code will settle the scope.

The small business test comes first

Only an APP entity can be bound. An APP entity is an agency or an organisation, and an organisation does not include a small business operator.⁵ A business is a small business if its annual turnover for the previous financial year was $3 million or less.⁵ s 6D(1)

A small business is not a small business operator if one of the cases in s 6D(4) applies. They include providing a health service and holding health information, and trading in personal information: disclosing personal information about another individual to anyone else for a benefit, service or advantage, or providing a benefit, service or advantage to collect it.⁵ s 6D(4) Trading does not count where it is done with the individual's consent, or as required or authorised by or under legislation.⁵ If your app or website earns money from users' personal information, check this before you assume the exemption.

When the Code takes effect

The Commissioner must develop and register the Code within the period of 24 months beginning on the day of Royal Assent.⁶ s 26GC(10) The OAIC says "the final Code must be registered by 10 December 2026" and that the Code "will be in place by 10 December 2026".⁷ OAIC

Every APP code must set out the period during which it is in force, and that period cannot start before the day the code is registered.⁸ s 26C(2)(c) Once the Code is registered, read it for the date it takes effect.

What the draft proposed

Before registering the Code, the Commissioner must publish a draft, allow at least 60 days for submissions, consider them, and consult the eSafety Commissioner and the National Children's Commissioner.⁹ s 26GC(9) The OAIC published its exposure draft on 31 March 2026, and consultation ran to 5 June 2026.¹⁰ OAIC

Does it touch an accounting, real estate, conveyancing or legal practice?

Most professional practice websites are not built for children. But the statutory question is not whether a service is aimed at children. It is whether the service is likely to be accessed by children, which can reach services built for adults. If your website or client portal is used by adults to deal with a practice, record why you think children are not likely to access it. Check again if you run anything that young people are likely to use, such as a rental app for tenants, a scholarship or work-experience form, or a site that collects information about children.

How to prepare

1. Confirm you are an APP entity

   Apply the small business test and the s 6D(4) cases first. If the Act does not apply to you, the Code cannot bind you. s 6D(4)

2. Assess each service

   For each app, website or online service, record whether children are likely to use it, and your evidence: the audience, content, sign-up data and any age checks.

3. Map children's information

   Note what personal information about children you collect, why, who you share it with, and how long you keep it.

4. Review defaults and marketing

   Look at tracking, location settings and marketing to young users. The draft singled these out.

5. Watch for the registered Code

   When the Code is registered, read who it names, the period it is in force and any OAIC guidelines on services likely to be accessed by children, then update your privacy policy.

Where to go next

• The rest of the Privacy Act: the Privacy Act section covers the small business test, privacy policies, data breaches and the dates coming up.
• Every source we use is listed on our sources page.

AMLCompliant is published by Wani Meridian Pty Ltd, an independent private business. We are not affiliated with, or endorsed by, the Office of the Australian Information Commissioner, the Attorney-General's Department or any other government body. This guide is general information, not legal advice.

Independent. Not affiliated with, or endorsed by, AUSTRAC or the Australian Government.