AustraliaChildren's Online Privacy Code (Privacy Act 1988, section 26GC)
An age-appropriate design code rule binding private bodies.
- Audit expectation
- none
What it requires
- This code is proposed and has not been finalised or registered: the Information Commissioner must develop and register it by , and what follows is what the exposure draft indicates it would require.
- Applies to social media services, relevant electronic services and designated internet services that are likely to be accessed by children or primarily concern the activities of children, excluding health service providers.
- Use proportionate age assurance, and limit how long you retain facial age estimation data.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.DM-P5Data are destroyed according to policy.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Penalties
A breach of the registered code will be treated as an interference with privacy under the Privacy Act 1988, subject to the Act's existing civil penalty framework.
Who enforces it
Enforcement body
Office of the Australian Information Commissioner (OAIC)
Settledness
The Information Commissioner has consulted on an exposure draft of the code and an explanatory statement.
- As of
- Open questions
- Which services are 'likely to be accessed by children' under subparagraph 26GC(5)(a)(ii) of the Privacy Act 1988, given that subsection 26GC(11) lets the Commissioner make written guidelines to assist entities to determine it?
What it reaches
Covered services
Social media services, relevant electronic services and designated internet services that are likely to be accessed by children or primarily concern the activities of children, excluding health service providers.
What it makes you log
Logging duty
Section 26GC directs the Information Commissioner to develop and register the Children's Online Privacy Code and says which entities it will bind; it requires no log, record or retention period of any entity. The code is not registered and its exposure draft is not law, so a record or retention rule the code may carry is not yet a duty.
- Kind
- None
- As of
What this law does
Requires the Australian Information Commissioner to develop and register an Australian Privacy Principles code addressing the privacy of children, covering social media services, relevant electronic services and designated internet services likely to be accessed by children, within 24 months of the amending Act's Royal Assent on , that is, by .
An exposure draft, drawing partly on the UK Age Appropriate Design Code, was released for public consultation from 31 March to and includes proportionate age assurance and limits on retaining facial age estimation data, but the Code is not yet finalised or registered.
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .