Australia's Children's Online Privacy Code: what changes on 10 December 2026

On 10 December 2026, Australia's Children's Online Privacy Code takes effect. If your child uses apps, games or websites — and if you are reading this, they do — it is the most significant change to their privacy protections in years, and almost nobody has told you about it.

Here is what it actually says, what it will and will not change, and what to ask any app your child uses.

What the Code is

The Code comes from the Privacy and Other Legislation Amendment Act 2024, which required the Office of the Australian Information Commissioner (OAIC) to write rules putting children at the centre of privacy protection. It is an APP Code: it specifies how online services likely to be accessed by children must comply with the Australian Privacy Principles, and adds requirements on top of them.

Two things about its scope matter to a parent.

It is not limited to apps built for kids. The test is whether a service is likely to be accessed by children — not whether it was designed for them. A general-purpose app that your 12-year-old uses is in scope.

Its scope grew during consultation to include services primarily concerned with children's activities. That now reaches things most people would never think of as "children's apps" — school management systems, internet-connected baby monitors.

What it asks of the services your child uses

The full Code is long, and the OAIC's own pages are the authority. But the themes that will change what you see on screen:

Children get told things, not just parents. One of the more striking proposed requirements: a service must notify the child when their parent is consenting on their behalf, and notify the child when another user — including a parent — is tracking their location. The Code treats a child as a person with an interest in their own privacy, rather than as an object of a parental decision.

Default settings have to be the safe ones. The burden shifts. The question stops being "did the parent find the setting and turn it on?" and becomes "why was it off by default?"

Data minimisation gets teeth. Collecting a child's information because it might be useful later is the practice the Code is aimed at.

What to ask any app your child uses

Four questions. You can ask them of us, and you should ask them of everyone else too.

1. Where is my child's data stored, and under whose laws? "The cloud" is not an answer. A service storing Australian children's data offshore may put it within reach of foreign government access laws.
2. Is my child's data used to train an AI model? Ask directly. Many general-purpose AI tools train on user input by default on their free tiers.
3. Can I see what my child actually did? Not a usage summary — the real thing. If a service cannot show you what your child asked an AI and what it said back, you are being asked to trust a black box.
4. What happens if I ask you to delete it? There should be a person to ask and a stated timeframe.

Where Qwizflow stands

We are not going to claim the Code is easy for us and hard for everyone else. But we did make some choices early that we are glad of now.

Student data is stored in Melbourne. Our Firestore database runs in australia-southeast2. Australian student data stays under Australian law.

Consent is per-feature, not all-or-nothing. A parent approves each AI feature individually, and can withdraw any one of them without switching off the others. A child under 13 cannot self-consent to any of them.

Personal information is scrubbed before anything reaches an AI provider. The prompt that leaves our servers does not carry your child's identity.

You can read the transcript. The parent dashboard shows what your child asked and what came back.

Our analytics set no cookie on your child's device, and there is no banner asking them to allow one. We use Google Analytics to see how many people find the site — but we run it with every storage permission switched off, so it writes no cookie and no identifier and sends anonymous counts instead. That was deliberate rather than convenient: the alternative is a consent banner, and a consent banner on a product used by nine-year-olds puts the decision on the person least equipped to make it. Google Signals, the feature that would otherwise link a visit here into a cross-device advertising profile, is off as well. It costs us the ability to tell a returning visitor from a new one. We think that is the right thing to give up.

One honest caveat: a product can do all of the above and still have work to do when a new Code lands. We will publish what changes for us, if anything does, rather than quietly declaring ourselves compliant.

What parents should actually do

Before December, pick the three apps your child uses most and ask the four questions above. The answers are usually in a privacy policy, and how hard they are to find is itself informative.

After December, watch for the notifications. If an app tells your child that you have consented on their behalf, that is the Code working.

And be a little sceptical of any service that markets its compliance harder than it explains its practices. The Code is a floor, not an achievement.

FAQ

When exactly does the Children's Online Privacy Code start? 10 December 2026.

Does it apply to apps not made for children? Yes, if the service is likely to be accessed by children. The test is actual likely access, not intended audience.

Does it replace the Privacy Act? No. It is an APP Code — it sits on top of the Australian Privacy Principles and specifies how they apply to children's information.

Is Qwizflow free, and how does it make money? Free to use, with daily fair-use limits and optional pay-as-you-go credit top-ups if you want more. There is no advertising and no subscription, which is why there is no commercial reason for us to profile your child.

Who do I contact about my child's data? Our privacy contact is published on the Privacy Policy page. You can ask for access, correction or deletion.