The Office of the Australian Information Commissioner has released an exposure draft of the Privacy (Children’s Online Privacy) Code 2026, open for consultation until 5 June, with registration scheduled for 10 December 2026. As Allens notes in its analysis, the code imposes substantial obligations that go well beyond the current Australian Privacy Principles. It applies to any online service “likely to be accessed by children” — not just social platforms.

For not-for-profits, this is a bigger deal than it first looks. If you run a youth mentoring program, a community sport booking portal, a donor portal that young people can sign up to, an online learning site, or any app where under-18s might create an account, you are likely in scope. The draft requires either genuine age assurance or applying child-level protections to every user. Default settings must collect only “strictly necessary” information, and targeted advertising and personalisation become heavily restricted. Parental consent is required for children under 15, expires after 12 months, and bundled or manipulative consent is banned outright. You will also need to run privacy impact assessments before new services and maintain a public PIA register.

Most NFPs do not have a full-time privacy officer, and that is exactly where this gets hard. The realistic steps between now and December are: map every digital touchpoint where a minor could end up, check that default account settings collect the bare minimum, and start documenting parental consent workflows. If you have a chance to respond to the OAIC consultation before 5 June, take it — the scope is still being shaped.

Our team working with not-for-profits can help you map your obligations, tighten consent and data-minimisation settings across your platforms, and get ready for the December deadline without blowing the budget.