2026 Australian Children’s Online Privacy Code: What Should Parents Check Before a Child Registers for an App?

The code’s status and what parents can rely on

The 2026 Australian Children’s Online Privacy Code is not a final set of platform rules as of November 7, 2026. The OAIC says the code is in development, with a final registration deadline of December 10, 2026. That deadline is part of the confirmed process; it does not mean the final code has already been published or that every proposed measure applies to apps now. Check the OAIC’s current code progress page before relying on a particular requirement.

The distinction matters when a registration screen raises a concern. The OAIC’s exposure draft describes proposed content for consultation. A proposal can help you anticipate issues to ask about, but it should not be presented as a final rule. The Privacy Act 1988 text, in the version dated June 4, 2026, is the relevant legislative background; it is not the same thing as a completed code.

For now, use the platform’s current privacy notice, registration flow, and support channels to make a decision. If the app explains what it collects and why, gives a usable way to ask questions, and offers a clear route to manage or delete an account, you have concrete information to assess. If the information is missing or vague, pause and ask before entering a child’s details.

The code’s progress is a reason to check current information, not a reason to assume the worst. Parents can make a careful decision without predicting what the final text will require.

A family-run signup: does the app really need an email?

When a family starts an account directly, separate the email field from the other details the form requests. A platform may ask for an email to confirm an account, send service messages, support account recovery, or communicate about activity. Those purposes are not interchangeable, and the app’s own explanation should make clear which apply.

Check the screen and privacy notice for four things:

• Is an email marked as required, or can the account proceed without one?
• Does the platform say what messages it will send and whether it uses the address for marketing?
• Can a parent manage notification preferences or close the account?
• Is there a support contact for privacy or account questions?

A required field is not, by itself, an explanation. If the page says only “email required” and does not explain the reason, ask the platform through its official support channel before entering a household address. Don’t infer that an email is needed for age checks, and don’t assume supplying one proves that a parent has consented.

It also helps to assess each item separately. A child’s name, date of birth, school, and email address can each reveal different information. Giving an email address does not automatically mean the platform has been given a child’s full identity, but the surrounding form may ask for more details than the family expects. Decide whether each requested item is necessary for the service the child will use.

A parent might, for example, be comfortable with an email used to recover a learning account but not with a form that asks for a child’s full date of birth without explaining why. That is a reason to ask what the data is used for, whether an alternative is available, and how long the information remains associated with the account. It is not a reason to enter inaccurate details or work around the platform’s age rules.

For a longer-running account, consider how the family will receive important notices and regain access if the child forgets a password. An address that is easy to discard may be a poor choice if it is the only way to recover the account. If you’re comparing a separate address with a plus-address format, our guide to aliases versus plus addressing explains what those approaches separate—and what they still connect to your main inbox.

School-arranged apps: what should you ask the school?

A platform selected by a school or training provider is a different situation from a child choosing an app for personal use. The school may have arranged access or set up a particular configuration, but families should confirm the actual process with that school. The code’s draft does not establish one standard account-creation or notification process for every school.

Ask the school or provider:

• What learning or administrative purpose does the platform serve?
• Does the school create the account, or must the family register separately?
• Which details will the child or parent need to provide?
• Who can answer questions about the platform’s privacy notice and account deletion?
• How will the family receive essential notices, and who should be contacted if access stops working?

These questions help identify the right contact. A school may be able to explain why a service is used or how students access it, while the platform may be the right place to ask about its privacy notice or data handling. Confirm the school’s own arrangements rather than assuming that another school uses the same configuration.

If the school asks families to create an account, check whether a parent contact address and a child’s account address serve different purposes. A parent’s address may receive administrative messages; a child’s address may be attached to the student’s login. Ask before using one address for both if the instructions are unclear. Avoid forwarding a child’s messages to a parent automatically unless the school’s setup and the family’s needs make that appropriate.

When a school cannot answer a privacy question, ask where it should be directed. Keep the response with the account information so another family member can understand why the account exists and which contact to use later.

Age checks and parental contact details

An app may request an age, a parent’s contact information, or a consent step. These actions serve different purposes. An age field provides information used in the app’s age-related process. A parent contact address gives the service a way to reach an adult. A consent step asks for a particular decision where the service requires one. An email address only receives messages sent to it; entering one does not, on its own, show that age assurance or consent has been completed.

The OAIC’s guidance on age assurance technologies is relevant when a platform explains that it uses an age-assurance method. Read what the platform says it collects for that process and why. If the explanation is unclear, ask through the service’s official channel. Do not supply false information or use a temporary address to bypass an age requirement or parental process.

The OAIC Children’s Online Privacy Code remains a developing framework, so families should not infer a uniform age-check or parental-consent workflow from a draft. The OAIC’s consultation information for children, young people, parents, and carers provides context on the consultation process. For a specific app, the current instructions and privacy information are the starting point.

A low-continuity trial: is a temporary address appropriate?

A temporary email address may be worth considering only when the app permits it and the family will not depend on that address for important notices, future access, or recovery. It changes which email address the app receives. It does not reduce the other information the app may collect, determine whether the app is suitable for a child, or satisfy an age or consent requirement.

Think of the choice as an account-management decision rather than a privacy shortcut. If the child may keep using the service, if a school depends on it, or if access could be needed later, choose an address the family can continue to access. If it is a permitted, low-stakes signup and the address will not be needed again, a separate temporary address may keep app mail out of the household’s primary inbox. Check the service’s current terms and the app’s registration rules before using one.

The table is a decision aid, not a claim that a particular address type makes an app compliant or private. If the service may send a password reset, a safety notice, or a change to its terms, losing access to the signup address can create a practical problem. For an account that may matter next term or next year, long-term access should outweigh inbox convenience.

You can also separate household responsibilities without making a child’s email the only record of an account. Keep a family record of the service name, the account owner, the reason for signup, the address used, and the official recovery route. Store it somewhere the responsible adult can access. Do not put passwords in an unsecured note or share a password among family members simply to make recovery easier.

A signup check you can use before submitting

Use this checklist when the app is not clearly a one-off signup, when the form asks for unexpected details, or when a school has directed the family to a platform.

• [ ] Read the current privacy notice and confirm that it describes the service the child will actually use.
• [ ] Mark which fields are required, optional, or unexplained before entering the child’s information.
• [ ] Check the stated purpose for the email address and whether the platform mentions service notices, marketing, or recovery.
• [ ] Ask the platform or school who can answer privacy questions and how to request account closure or data deletion.
• [ ] Confirm whether the family must create the account or whether the school provides access.
• [ ] Treat age information, parent contact details, and consent as separate requirements; follow the platform’s stated process.
• [ ] Choose an address based on future notices and recovery needs, not only on whether the inbox might receive promotional mail.
• [ ] If the platform’s explanation is incomplete, pause and ask through an official channel before submitting the form.
• [ ] Record the account’s purpose and recovery route so the family can manage it later.

The first three checks establish what the platform asks for and why. The next three clarify responsibilities and the account process. The final checks help prevent a short-term inbox choice from becoming a long-term access problem. If you cannot establish who handles a privacy question, or what happens when the account closes, waiting for an answer is often more useful than guessing.

Email choices by account duration and recovery need

The most suitable address depends on what the family needs to do with the account later. A mailbox that keeps the primary household address separate may be useful for a trial, but separation alone does not make an account suitable for a child. A longer-lived address can make recovery more reliable, but may also collect messages the family would rather keep out of its main inbox.

An alias can help sort messages while keeping a family’s established mailbox available; it is not the same as discarding an address after a short-lived signup. Our guide to email aliases covers the basic distinction. Whichever option you choose, remember that the address only affects the email channel. It does not stop an app from collecting other information that the family provides or that its service processes.

Choosing a next step for your family

Treat the code’s status as a reason to verify current information, not as a substitute for making a signup decision. As of November 7, 2026, the OAIC describes the code as still in development and gives December 10, 2026, as the final registration deadline. Check the OAIC progress page again before publication or when the OAIC announces a final text; a draft and a confirmed deadline are not the same as a completed code.

For a school account or a service the child may keep using, choose an address the responsible adult can maintain and use for recovery, while confirming the school’s instructions. For a permitted one-off signup that will not need important notices or future access, a separate temporary address can keep the household’s primary email out of that registration. It cannot limit other data collection or replace a privacy review, age check, or parental consent process.

After checking the app’s privacy information and recovery requirements, you can review Letterfwd if a temporary email address fits a permitted, low-continuity signup. Check the current service details first, and keep a lasting, family-managed address for any account that needs ongoing notices or recovery.