--- title: "Australia — Children & Vulnerable Groups | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/australia/children-and-vulnerable-groups/ source_html: /jurisdictions/australia/children-and-vulnerable-groups/index.html description: "Australia — Children & Vulnerable Groups: children_and_vulnerable_groups Children & Vulnerable Groups 5 sub-modules 4 claims Green ▾ # Binding, in-force age-verification law plus a legislatively mandated forthcoming Childr" generated_at: 2026-10-25T04:46:50Z content_sha256: 637adde5e3fd36f85a675fb7951668445f0b7827d3b192fcdf8f1dde85d06c30 generator: "fe-fleet/md-twin@1.0" --- # Australia — Children & Vulnerable Groups | Data Protection Monitor ### D9Children & Vulnerable Groups5 sub-modules4 claimsGreen▾# Binding, in-force age-verification law plus a legislatively mandated forthcoming Children's Code represent strong and active regulatory attention to children's privacy. Primary framework Online Safety Act 2021 (Cth) Part 4A; Privacy Act 1988 (Cth) (Children's Online Privacy Code, pending) Supervisory authority [Office of the Australian Information Commissioner (OAIC)](https://www.oaic.gov.au/) Traffic-light rationale — Green Binding, in-force age-verification law plus a legislatively mandated forthcoming Children's Code represent strong and active regulatory attention to children's privacy. #### Sub-modules (5) #### Age VerificationGreen SMMA scheme requires reasonable steps to prevent under-16 accounts from 10 December 2025. Claims (1): - From 10 December 2025, providers of age-restricted social media platforms must take reasonable steps to prevent Australians under the age of 16 from creating or keeping an account, under the co-regulated Social Media Minimum Age scheme overseen by the OAIC for privacy compliance and eSafety for broader compliance. #### Parental ConsentGreen Parental consent can no longer override the under-16 restriction once SMMA took effect. Claims (1): - Once the SMMA obligation took effect, parents lost the ability to consent to allow children under 16 to hold accounts on affected social media platforms such as Facebook, Snapchat, Instagram and TikTok. #### Minor Profiling BansAmber Children's Online Privacy Code (pending, must register by 10 December 2026) will impose child-specific privacy obligations on covered online services. Claims (1): - The OAIC is developing a Children's Online Privacy Code, a legislative instrument under the Privacy Act mandated by the POLA Act 2024, which must be registered by 10 December 2026 and will apply to APP entities providing social media services, relevant electronic services, or designated internet services likely to be accessed by children. #### Education SettingsAmber Draft Code's scope may capture some education-adjacent services but sector-specific carve-outs are not yet finalised. Claims (1): - The draft Children's Online Privacy Code's applicability extends to designated internet services likely to be accessed by children or primarily concerning children's activities, which may capture certain education-adjacent online services, though the OAIC has not yet finalised sector-specific carve-outs. #### Dependent AdultsRed No dependent-adults-specific privacy protections identified in this research pass. Absence provenance: unavailable . Searched: OAIC privacy rights pages, OAIC Privacy Act Review submissions. #### Key findings (3) - — source on file - — source on file - — source on file Category narrative 79 words Australia has implemented one of the world's most prominent children's online protection regimes: the Social Media Minimum Age (SMMA) scheme (in force from 10 December 2025) prevents under-16s from holding accounts on age-restricted social media platforms, co-regulated by OAIC and eSafety, and removes parental override of the age floor. Separately, the OAIC is developing a Children's Online Privacy Code (mandated by the POLA Act 2024) which must be registered by 10 December 2026. No dependent-adults-specific privacy protections were evidenced. Periodic update · new data 2026-10-18 #### Children & Vulnerable Groups The OAIC's Children's Online Privacy Code, developed against the current Australian Privacy Principles rather than against the Tranche 2 reform framework, must be registered by 10 December 2026. This registration deadline places the Code on the same operative timeline as the new APP 1.7-1.9 automated-decision-making disclosure duties, meaning organisations serving children will face two converging compliance obligations on the same date: the finalised Children's Code itself, and the ADM disclosure duty where applicable to services used by children. Because the Code is developed against the current APPs rather than the still-pre-parliamentary Tranche 2 framework, its content and obligations are not contingent on the Tranche 2 Bill's introduction or passage; it proceeds on its own statutory basis toward the 10 December 2026 registration deadline regardless of the broader reform's progress. #### Outlook The period immediately before 10 December 2026 is the key compliance-preparation window for organisations providing services to children in Australia, as the Code's registration converts its content from developed-but-unregistered guidance into a binding instrument. 1 earlier distinct update(s) Periodic update · new data 2026-10-05 #### Children & Vulnerable Groups Under Tranche 1 of the Privacy Act reforms, already enacted ahead of this cycle, the OAIC is statutorily required to develop and register a Children's Online Privacy Code by 10 December 2026. As at this cycle, the Code is understood to remain in draft, meaning registration has not yet occurred, though the statutory deadline remains in force and approaching. This is a distinct development track from the second-tranche exposure draft discussed elsewhere in this brief: the Children's Online Privacy Code obligation derives from already-enacted Tranche 1 provisions, placing it on a firmer legal footing than the still-proposed second-tranche reforms, even though the Code's content has not yet been finalised or registered. The practical effect of the Code, once registered, would be to impose specific obligations on entities handling children's personal information online, a vulnerable-group protection mechanism with some conceptual parallel to children's codes operating in other jurisdictions, adapted to the Australian Privacy Principles framework. The approaching deadline means this is one of the more concretely dated developments in Australia's current privacy reform landscape, in contrast to the second-tranche Bill's introduction timeline, which remains contingent on parliamentary scheduling. Because the Code derives its legal requirement from already-enacted provisions, its 10 December 2026 deadline is not dependent on the second-tranche Bill's progress or ultimate enactment. #### Outlook The statutory deadline of 10 December 2026 for registering the Children's Online Privacy Code falls within the current reporting period's near horizon and is independent of whether the second-tranche Bill is introduced to Parliament on the Government's signalled timeline. Given the Code remains in draft, the key near-term question is whether the OAIC will register it by the statutory deadline or whether a delay occurs; no information available this cycle indicates which outcome is more likely. Evidence 4 Sources and claims (4) - Probable[Office of the Australian Information Commissioner](https://www.oaic.gov.au/privacy/your-privacy-rights/social-media-minimum-age) — From 10 December 2025, providers of age-restricted social media platforms must take reasonable steps to prevent Australians under the age of 16 from creating or keeping an account, under the co-regulated Social Media Minimum Age scheme overseen by the OAIC for privacy compliance and eSafety for broader compliance.observed 2026-07-29 - Probable[International Association of Privacy Professionals](https://iapp.org/news/a/social-media-safety-privacy-literacy-and-gentle-parenting) — Once the SMMA obligation took effect, parents lost the ability to consent to allow children under 16 to hold accounts on affected social media platforms such as Facebook, Snapchat, Instagram and TikTok.observed 2026-07-29 - Probable[Office of the Australian Information Commissioner](https://www.oaic.gov.au/privacy/privacy-registers/privacy-codes/childrens-online-privacy-code) — The OAIC is developing a Children's Online Privacy Code, a legislative instrument under the Privacy Act mandated by the POLA Act 2024, which must be registered by 10 December 2026 and will apply to APP entities providing social media services, relevant electronic services, or designated internet services likely to be accessed by children.observed 2026-07-29 - Speculative[Office of the Australian Information Commissioner](https://www.oaic.gov.au/privacy/privacy-registers/privacy-codes/childrens-online-privacy-code) — The draft Children's Online Privacy Code's applicability extends to designated internet services likely to be accessed by children or primarily concerning children's activities, which may capture certain education-adjacent online services, though the OAIC has not yet finalised sector-specific carve-outs.observed 2026-07-29