The Australian government has released a draft privacy code specifically designed to protect children's personal data online, marking one of the most significant moves toward child-focused digital regulation the country has seen. The draft code sets out new obligations for online services that collect data from young people, and - in an unusual step - the government is actively seeking feedback from children and teenagers themselves. The question driving the consultation is straightforward but consequential: do young Australians understand what happens to their information, and do they think the proposed protections go far enough?
What a Digital Footprint Actually Means
Every time a young person opens an app, watches a video, searches for something, or creates an account, they leave behind a trail of data. This is commonly called a digital footprint - and for most children and teenagers, it is far larger and more detailed than they realise.
That footprint typically includes what is called active data: information a person deliberately shares, such as a username, a profile photo, or a date of birth entered during sign-up. But it also includes passive data, which is collected automatically without any conscious action. This covers things like which device is being used, where the user is located, how long they spent on a particular page, what they clicked on, and what they ignored. Combined, these data points can build a surprisingly precise profile of a person's habits, interests, emotional state, and even social relationships.
For adults, this is already a significant privacy concern. For children, the stakes are higher. Young people are still forming their identities and are less likely to understand the long-term implications of data collection. Information gathered about a child today can persist in databases for years, potentially shaping the digital profile that follows them into adulthood.
How Data Gets Collected and Where It Goes
The mechanics of online data collection are worth understanding clearly, because they operate largely out of sight. When a child signs up to a platform, the obvious data - name, age, email - is only the beginning. Behind the interface, tracking technologies such as cookies, pixels, and device fingerprinting record behaviour across sessions and, in many cases, across entirely different websites and apps.
This data is typically used in two broad ways. The first is to personalise the experience: recommending content, adjusting what is shown in a feed, or targeting advertisements to a specific profile. The second is commercial: platforms may share or sell aggregated or individually identifiable data to third-party advertisers, data brokers, or analytics companies. For children, this raises particular concerns because targeted advertising directed at minors - especially advertising designed to exploit psychological patterns - has been the subject of growing regulatory scrutiny worldwide.
The broader ecosystem around children's data is not limited to social media. Educational apps, gaming platforms, streaming services, and even seemingly innocuous tools like homework helpers can all collect substantial amounts of data. The draft code, if enacted, would create clearer obligations across these categories.
Why the Government Is Stepping In Now
Australia is not acting in isolation. The United Kingdom introduced its Age Appropriate Design Code - often called the Children's Code - which came into full effect in 2021 and set a global benchmark for how digital products should treat younger users by default. The United States has had the Children's Online Privacy Protection Act on the books since 1998, though critics have long argued it is outdated relative to the current data landscape. The European Union's General Data Protection Regulation includes provisions around children's consent, and several member states have gone further with specific child-focused rules.
Australia's draft code reflects a recognition that general privacy law - even when updated - does not adequately account for the specific vulnerabilities of children online. The existing Privacy Act applies broadly, but it was not designed with a child's developmental context in mind. The new code would sit alongside the Privacy Act and create age-appropriate standards: higher protections, stricter consent requirements, and explicit limits on certain types of data use when children are involved.
The decision to seek feedback directly from young Australians signals something important about the government's approach. Regulation that does not reflect how young people actually experience the internet risks being both ineffective and irrelevant. Asking children and teenagers to weigh in before the code is finalised gives the process a degree of legitimacy - and may surface practical concerns that adult policymakers would not otherwise anticipate.
What Meaningful Protection Could Look Like
Effective children's privacy protection generally involves several interlocking measures, and the draft code is expected to address at least some of them:
- Data minimisation: Platforms should collect only the data genuinely necessary for the service to function, rather than gathering as much as technically possible.
- Default privacy settings: The most protective settings should be the default for child users, not something they or their parents have to opt into.
- Restrictions on profiling: Building detailed behavioural profiles of children for commercial purposes should be substantially limited or prohibited.
- Clear, age-appropriate transparency: Explanations of what data is collected and why should be written in language children can actually understand - not buried in lengthy legal terms.
- The right to erasure: Children and their families should be able to request deletion of data, with meaningful enforcement behind that right.
Whether the draft code delivers on these principles will depend on the detail of its final provisions and, critically, on how rigorously it is enforced. Strong rules without enforcement mechanisms have historically offered more comfort than protection. The consultation process now underway is the moment for Australians - young people included - to push for the specifics that will determine whether the code has real teeth.
