‘Everyone Is A Child To Some Extent’: What The Looming Children’s Privacy Code Changes Means For Advertisers

Why It Matters

The COPC could reshape the entire digital advertising ecosystem, raising compliance costs and limiting personalised marketing across the broader economy.

Key Takeaways

• COPC penalties could reach ~US$2.2 million per breach.
• “Strictly necessary” test raises bar above current “reasonably necessary” standard.
• Unclear “likely to be accessed by children” threshold may force universal age‑assurance.
• IAB urges OAIC to retain existing privacy thresholds and postpone enforcement.
• Child‑focused standards are expected to shape adult privacy expectations.

Pulse Analysis

The Australian Children’s Online Privacy Code represents the most ambitious child‑centric data regime in the region. Finalised by early December, the code expands the definition of personal information, bans profiling for personalised advertising, and mandates verifiable consent for any direct marketing to minors. Penalties of up to AU$3.3 million (about US$2.2 million) underscore the regulator’s intent to enforce rigorously. By shifting from the Privacy Act’s “reasonably necessary” language to a “strictly necessary” standard, the draft raises the evidentiary bar for data collection, compelling firms to reassess data‑minimisation practices across all campaigns.

Beyond child‑only brands, the code’s ambiguous “likely to be accessed by children” test could compel any digital service to implement age‑verification mechanisms. For advertisers, this means redesigning targeting algorithms, re‑engineering consent flows, and potentially abandoning high‑value personalised ad formats that rely on granular user profiling. The higher compliance threshold threatens revenue models that depend on ad‑funded content, especially for publishers serving mixed‑age audiences. Moreover, the principle‑based approach signals that today’s acceptable practices may be deemed non‑compliant tomorrow, urging marketers to adopt a forward‑looking privacy‑by‑design mindset.

Industry bodies such as IAB Australia have responded with a detailed submission to the OAIC, urging clarification that businesses should not be forced to treat every user as a child. Their recommendations include retaining the existing “reasonably necessary” test, adopting proportionate age‑assurance solutions, and granting a two‑year grace period before enforcement. For marketers, the prudent path is to audit data pipelines now, strengthen consent documentation, and embed robust data‑deletion protocols. Early adoption of these safeguards not only mitigates regulatory risk but also positions brands as trustworthy stewards of consumer privacy, a competitive advantage as privacy expectations continue to rise across all age groups.