Australia's Children's Online Privacy Code: what to expect by 10 December 2026

The OAIC must register Australia's Children's Online Privacy Code by 10 December 2026; the date its rules start to apply has not been set yet. If your child uses apps, games or websites — and if you are reading this, they do — it is the most significant change to their privacy protections in years, and almost nobody has told you about it.

Here is what it actually says, what it will and will not change, and what to ask any app your child uses.

What the Code is

The Code comes from the Privacy and Other Legislation Amendment Act 2024, which required the Office of the Australian Information Commissioner (OAIC) to write rules putting children at the centre of privacy protection. It is an APP Code: it specifies how online services likely to be accessed by children must comply with the Australian Privacy Principles, and adds requirements on top of them.

Two things about its scope matter to a parent.

It is not limited to apps built for kids. The test is whether a service is likely to be accessed by children — not whether it was designed for them. A general-purpose app that your 12-year-old uses is in scope.

Its scope grew during consultation to include services primarily concerned with children's activities. That now reaches things most people would never think of as "children's apps" — school management systems, internet-connected baby monitors.

What it asks of the services your child uses

The full Code is long, and the OAIC's own pages are the authority. But the themes that will change what you see on screen:

Children get told things, not just parents. One of the more striking proposed requirements: a service must notify the child when their parent is consenting on their behalf, and notify the child when another user — including a parent — is tracking their location. The Code treats a child as a person with an interest in their own privacy, rather than as an object of a parental decision.

Default settings have to be the safe ones. The burden shifts. The question stops being "did the parent find the setting and turn it on?" and becomes "why was it off by default?"

Data minimisation gets teeth. Collecting a child's information because it might be useful later is the practice the Code is aimed at.

What to ask any app your child uses

Four questions. You can ask them of us, and you should ask them of everyone else too.

1. Where is my child's data stored, and under whose laws? "The cloud" is not an answer. A service storing Australian children's data offshore may put it within reach of foreign government access laws.
2. Is my child's data used to train an AI model? Ask directly. Many general-purpose AI tools train on user input by default on their free tiers.
3. Can I see what the AI does with my child? Ask what you will actually be shown — which AI features were used, a summary of each interaction, any safety flags. If a service can show you nothing at all, you are being asked to trust a black box.
4. What happens if I ask you to delete it? There should be a person to ask and a stated timeframe.

Where Qwizflow stands

We are not going to claim the Code is easy for us and hard for everyone else. But we did make some choices early that we are glad of now.

Learning records are stored in Melbourne. Our Firestore database runs in australia-southeast2. Sign-in runs on Firebase Authentication in the United States, and AI requests go to Google's global endpoints — the Privacy Policy lists each one.

Consent is per-feature, not all-or-nothing. A parent approves each AI feature individually, and can withdraw any one of them without switching off the others. A child under 13 cannot self-consent to any of them.

Contact details are masked before a prompt reaches an AI provider. Email addresses and phone numbers, and names written behind a label, are masked by pattern before any AI call. A pattern cannot catch everything a child types themselves, so we ask children not to type personal details.

You see summaries, not transcripts. The parent dashboard shows a short summary of each AI interaction and any safety flags — never the raw chat, which stays your child's.

Our analytics set no cookie on your child's device, and there is no banner asking them to allow one. We use Google Analytics to see how many people find the site — but we run it with every storage permission switched off, so it writes no cookie and no identifier and sends anonymous counts instead. That was deliberate rather than convenient: the alternative is a consent banner, and a consent banner on a product used by nine-year-olds puts the decision on the person least equipped to make it. Google Signals, the feature that would otherwise link a visit here into a cross-device advertising profile, is off as well. It costs us the ability to tell a returning visitor from a new one. We think that is the right thing to give up.

One honest caveat: a product can do all of the above and still have work to do when a new Code lands. We will publish what changes for us, if anything does, rather than quietly declaring ourselves compliant.

What parents should actually do

Now, pick the three apps your child uses most and ask the four questions above. The answers are usually in a privacy policy, and how hard they are to find is itself informative.

Once the Code applies, watch for the notifications. If an app tells your child that you have consented on their behalf, that is the Code working.

And be a little sceptical of any service that markets its compliance harder than it explains its practices. The Code is a floor, not an achievement.

FAQ

When exactly does the Children's Online Privacy Code start?

It must be registered by 10 December 2026. The OAIC has not yet set the date it takes effect, and a Code cannot start before it is registered.

Does it apply to apps not made for children?

Yes, if the service is likely to be accessed by children. The test is actual likely access, not intended audience.

Does it replace the Privacy Act?

No. It is an APP Code — it sits on top of the Australian Privacy Principles and specifies how they apply to children's information.

Is Qwizflow free, and how does it make money?

Free to use, with a free AI allowance each month and optional pay-as-you-go credit top-ups if you want more. There is no advertising and no subscription, which is why there is no commercial reason for us to profile your child.

Who do I contact about my child's data?

Our privacy contact is published on the Privacy Policy page. You can ask for access, correction or deletion.