Children's Online Privacy Code: What It Means for Schools

The Children's Online Privacy Code sets how the Australian Privacy Principles apply to children's information, including best-interests considerations. The OAIC must register it by 10 December 2026 ^[1]. Schools should work out which online services students use, then check age assurance, consent, privacy settings, notices and access requests before the final text lands.

The Children's Online Privacy Code is still being finalised, but the timetable is fixed. Schools that start with a clear list of the services students use will be in a far better position when the final Code is registered.

What is the Children's Online Privacy Code?

The Children's Online Privacy Code is a privacy code under the Privacy Act. It sets out how the Australian Privacy Principles (APPs) apply to children's personal information, including best-interests considerations ^[1]. In practice, it turns the general APPs into more specific expectations for online services that children are likely to use or that are mainly concerned with children's activities.

The OAIC released an exposure draft on 31 March 2026 and consultation closed on 5 June 2026 ^[1]. The OAIC must finalise and register the Code by 10 December 2026 ^[1]. Until then, the final wording can still change, so any readiness work should focus on the main themes rather than on fine detail.

The broad idea is to put more of the responsibility on the organisations running online services, rather than expecting children or parents to work through privacy settings and long notices on their own. For schools, that means looking hard at the platforms they choose and how those platforms are configured.

Does the Code apply to a school?

This is the first question to settle, and the answer depends on the school and on the Code's final scope. Coverage typically turns on two things: whether the organisation is bound by the Privacy Act, and whether a given service is likely to be accessed by children or is mainly concerned with children's activities.

Not every school is in the same position. Private and independent schools are generally covered by the federal Privacy Act and the APPs, usually subject to criteria such as size or the handling of health information. Public (government) schools are generally governed by state or territory privacy laws instead, and complaints about them usually go to the relevant state or territory regulator rather than the OAIC. Queensland, for example, now has a single set of Queensland Privacy Principles and a mandatory data breach notification scheme for government agencies ^[3]. A school group, a systems authority or a sports and activities body attached to a school may fall in a different place again.

Because of that, the sensible step is to get advice on your own status, and then to list the services in question. That list matters more than the label on the organisation. Even where a school is not directly bound, its vendors, its families and its community will increasingly expect the same standard.

Which school services are most likely to be in scope?

Think about the online services where students create accounts, enter personal details or have their activity recorded. Common examples include:

Learning management systems and student portals.
Parent communication apps and school apps.
Online enrolment and excursion consent forms.
Homework, reading and maths platforms from third-party vendors.
Photo and video sharing, including newsletters and social media.
School-run sport, music or after-school care booking systems.
Library and device management tools.

Many of these are run by vendors rather than the school itself. That raises a second question: who is responsible for meeting the Code when a vendor collects the data, and what does the contract say? Cross-border and third-party arrangements are worth checking early.

It is also worth asking which services teachers adopted on their own. Free tools signed up to in a single classroom are often the ones that never reach the school's register, and they can collect a surprising amount of student information.

What themes should schools expect from the Code?

The final Code is not yet registered, so treat the following as the areas to prepare for rather than a settled list of rules. They reflect the main obligations a readiness review would test:

Best interests: decisions about collecting, using and sharing children's information should be able to show that children's best interests were considered ^[1].
High privacy by default: settings for children should start at the most protective option, and the service should collect only what it needs to deliver the service. Design tricks that push children toward sharing more are a risk.
Age assurance: how a service knows, or reasonably estimates, whether a user is a child. The steps should match the risk of the service, without collecting more identity data than necessary.
Consent: when consent is needed, who gives it (the child or a parent), and how a child or parent can understand and change it.
Notices: clear, age-appropriate explanations of what is collected and why.
Privacy impact assessments: documented assessment of new or changed services that handle children's information, showing how the design protects children's best interests.
Access requests: a workable way for students and parents to ask for their information, and for it to be dealt with on time.
Annual reviews and training: regular review of child-specific privacy practice, and staff who understand the rules.

The exact thresholds, timeframes and wording will come from the registered Code, so check the OAIC page after 10 December 2026 before locking in any detail.

Schools already run many of these things in some form. The gap is usually that they are spread across teachers, IT and administration, with no single view.

Why does this matter beyond the Code itself?

The OAIC has said it will target power and information imbalances, including excessive collection, ad tech, data brokers and AI practices, along with privacy in emerging technology such as biometrics and location tracking ^[4]. Children's information in education technology sits close to several of those themes.

There is also private litigation risk. Individuals can now sue directly for serious invasions of privacy, which adds litigation exposure on top of OAIC enforcement ^[2].

Breach handling is judged separately from prevention. The Australian Clinical Labs case is a healthcare example, used here only to show that breach assessment and notification are penalised separately. The Federal Court ordered $5.8m in penalties, including $4.2m for failing to protect data, $800k for inadequate breach assessment and $800k for failing to notify promptly ^[5]. The lesson applies to any organisation holding sensitive data: slow assessment and slow notification are each penalised on their own.

For a school, the reputational side is just as real. Parents expect the school to know where student data goes. Trust is hard to rebuild after a student data incident is made public, and a school board or council will want to know the school can show it took reasonable steps.

What should a school do before December?

A practical sequence for a principal, business manager, ICT lead or privacy contact looks like this:

List every online service used by or about students, including those teachers adopted on their own.
Mark which are run by the school and which by vendors, and note what personal information each one collects.
Walk through sign-up, consent, default settings and notices as a student or parent would see them.
Check whether a privacy impact assessment exists for the higher-risk services.
Test how an access request from a parent or student would actually be handled.
Confirm who owns privacy in the school. Is it an accidental privacy officer doing it on the side, with no time set aside for it?
Agree a short, prioritised plan with owners and dates, and revisit it once the final Code is registered.

If you have no information inventory, or no single framework for how student data is governed, start there. It makes every later step quicker.

A fixed-scope first step

Transform LogiQ offers a Children's privacy readiness assessment, built for schools, education and sport bodies, membership organisations and apps used by under-18s. It runs over 3 to 4 weeks and has three phases: scope, assess and plan.

In the scope phase, it works out which services are likely to be accessed by children or are mainly concerned with children's activities. It then walks through sign-up, consent, settings and notices on the main services. The gap assessment tests against the Code's obligations: best interests, high privacy by default, age assurance, consent, notices, privacy impact assessments, annual reviews and training. You receive a scope assessment, a gap assessment and a prioritised readiness plan with owners and timing.

The assessment does not include technical testing of age assurance tools, legal advice or rewriting notices and policies. It is built for a Code that is still being finalised, so the plan is practical rather than final.

If you would rather start smaller, a Privacy health check is a 1 to 2 week look at how personal information is handled today, scored against the APPs, with the five things to fix first.

Frequently asked questions

When does the Children's Online Privacy Code start?

The OAIC must finalise and register the Code by 10 December 2026 ^[1]. The exposure draft came out on 31 March 2026 and consultation closed on 5 June 2026 ^[1]. Check the OAIC page for the final text and any commencement details.

Do public schools have to follow the Code?

Government schools are generally governed by state or territory privacy law rather than the federal Privacy Act, so the Code's reach for them depends on its final scope. Get advice on your own status. The readiness steps are useful either way.

Is the Code the same as the Privacy Act?

No. The Code sits under the Privacy Act and sets how the APPs apply to children's information, including best-interests considerations ^[1]. The Privacy Act and the APPs still apply alongside it.

Should we wait for the final Code before doing anything?

Not entirely. The final text can still change, but listing your services, checking defaults, consent and notices, and finding an owner are useful whatever the final wording says.

Who owns this in a school?

Usually it needs a named owner, often the business manager or a privacy contact, working with ICT, teaching leaders and the principal. Many schools find privacy sits with someone doing it on the side.

What if a vendor runs the platform?

The school still needs to know what data the vendor collects, where it goes and what the contract says. Third-party and cross-border arrangements are worth checking in your service list.

Book a Children's privacy readiness assessment to find out which of your online services the Code is likely to cover and what to fix first.

Reviewed by Broderick Smith, Managing Director, Transform LogiQ (IAPP AIGP), on 25 October 2026.