The Alannah & Madeline Foundation applauded the news that the Privacy and Other Legislation Amendment Bill 2024 had passed both houses of parliament in December last year.
The Bill represented the ‘first tranche’ of reforms to the Privacy Act 1988, following a review of the Act (2023). While the Bill is wide-ranging, we focus on its provision for the creation of a Children’s Online Privacy Code. This is a critical step forward to transforming the digital environment into a place where children can thrive.
Why does Australia need a Children's Online Privacy Code?
Digital technologies have become part of children's lives, and while they bring many benefits and opportunities, they are accompanied by risks and problems. Visible concerns include bullying, distraction, scams, ‘sextortion’, pornography, disinformation and violent content. These immediate threats have led to a national push for change.
However, public debates often miss the bigger picture: how digital providers handle our personal information.
When children go online, they enter a ‘data economy,’ where many providers make their profits by collecting highly specific personal information and sharing it with other parties such as advertising companies. Historically, children and their parents have had almost no real say about what happens to their personal information online.
As the Attorney-General noted when introducing the Bill to parliament, it’s been estimated that by the time a child turns 13, around 72 million pieces of data will have already been collected about them.
Moreover, in order to maximise data-handling, many digital providers have developed products which are highly attractive, distracting, provocative and hard to stop using, and which encourage heavy engagement through features such as notifications, autoplay, low default privacy settings, and the ‘infinite scroll’. These features can lead to harmful consequences.
A Children's Online Privacy Code – if well designed, resourced and enforced – could change the picture. For example, it could prohibit trading in children's personal information and prohibit direct marketing and targeting to children unless it is in the child's best interests. It could also require industry to set children's accounts to ‘private’ by default.
What's good about the changes to the Privacy Act?
The Foundation welcomes these features of the Bill:
- An introduction into the Privacy Act of a definition of a child as an individual who has not reached 18 years.
- Provision for the creation of a Children's Online Privacy Code to be led by the Office of the Australian Information Commissioner (OAIC).
- Application of the Code to services 'likely to be accessed by children' - not just services aimed specifically at children.
- A period of public consultation on a draft Code to involve the eSafety Commissioner, Children's Commissioner, child welfare organisations, and children themselves.
Amendments to the Bill extended the minimum period for public consultation on the Code to 60 days, in recognition of the logistical difficulties of community consultation, especially with children. This was a change recommended by the Foundation and we welcome it.
The Government has pledged $3 million to the OAIC to develop the Code. This commitment, which reflects the seriousness of the task, is very welcome.
What is still uncertain?
According to the Bill, the Children’s Online Privacy Code will cover social media services, relevant electronic services (e.g. messaging services, interactive gaming), and designated internet services (a range of websites and other online services). Health services will be exempt.
We agree that it is important to ensure children do not risk losing access to counselling or telehealth.
However, it is vital that children's personal information is protected appropriately in all digital environments. As such, we have concerns that the planned Code may not go far enough to cover all the digital technologies that handle children’s data – e.g. connected devices, educational technologies, app stores, AI training tools, commercial health and fitness apps.
The Government has moved to address such concerns by including a provision in the Bill allowing for flexibility – e.g. for the inclusion within the Code of some health services and some other services that are not social media, relevant electronic services, or designated internet services. We hope this approach will be sufficient as digital technologies continue to evolve.
What's next?
The OAIC must develop and register the Children’s Online Privacy Code by the end of 2026. This is a vast, important task.
We look forward to engaging with the OAIC and to supporting opportunities for children and young people to engage directly themselves.
Finally, we note that many other reforms to the Privacy Act were also proposed in the review. Presumably these will now be addressed in 2025. They include matters of importance to children, such as changes to how ‘personal information’ itself is defined and handled.
The Alannah & Madeline Foundation will continue to advocate for the right of all children and young people to be safe in all places where they live, learn and play - including online spaces.
