Kids, Code & Clicks: Australia’s New Children’s Privacy Push

Privacy laws used to treat kids like a rounding error — cute, inconvenient, and mostly left to the “parental supervision” fine print. Not anymore.

In this 3rd part of IP Mojo’s exclusive Privacy 2.0 blog series, we see how Australia’s privacy regime is finally catching up to a reality every parent knows: children are online, they’re being tracked, and they deserve more than vague guidance from a dusty regulator’s website.

Enter the Children’s Online Privacy Code, a centrepiece of the latest privacy law reforms. For the first time, Australia is baking enforceable obligations into law when it comes to how children’s personal information is collected, used and shared. Not just “you should be careful” — but “you must comply.”

So what’s changing? The new law requires the Information Commissioner to develop a binding code that sits within the framework of the Australian Privacy Principles (APPs). The Code must be finalised within two years and will apply to organisations likely to interact with children — particularly social media services, games, streaming platforms, and apps that know full well they’ve got under-18s clicking through. It won’t apply to health services, but that’s about the only carve-out. In essence: if your platform’s got kids on it, this is now your problem.

The Code will apply to social media services, games, streaming platforms, and other digital services as defined in the Online Safety Act 2021 (Cth) — including so-called “relevant electronic services” and “designated internet services.” If you already know those definitions, you’ve probably had dealings with the eSafety Commissioner. Now, add the Privacy Commissioner to your contact list. These reforms don’t replace online safety obligations — they layer on top of them. That means double compliance, and potentially double trouble if you get it wrong.

Here’s the takeaway: if you run an app, platform, game or service that might appeal to kids — even if you didn’t intend it to — it’s time to review your privacy practices. Don’t wait for the Code to land in 2026. The direction of travel is clear: children’s data is no longer fair game. It’s protected space. And if you’re not designing with that in mind, your business model may need a rethink — or your lawyers may need a bigger budget.

Tune in next week for: a look at the revamped APP 11, where “reasonable steps” for data protection just got a lot more real.

I Tort I Saw a Privacy Breach: Australia’s New Right to Sue

In barely a few weeks’ time, for the first time in Australian legal history, individuals will be able to sue for a serious invasion of privacy — with the new statutory tort coming into force on 10 June 2025.

It’s a landmark moment. While the Privacy Act has long offered regulatory protections (mainly enforced by the OAIC), this new law gives individuals a direct, personal legal remedy in court. If someone invades your privacy — by spying on you, hacking your data, or misusing personal information — you can now bring a tort claim for compensation, injunctions, apologies, or other relief.

But it’s not a free-for-all. Let’s unpack how it works.

What Exactly Do You Have to Prove?

To win a case under the new law, a plaintiff must establish five elements, all of which are based on ALRC recommendations:

1. An invasion of privacy — either by intrusion upon seclusion (e.g. surveillance, unlawful entry, voyeurism) or misuse of private information (e.g. disclosing or using someone’s personal details without permission).

2. A reasonable expectation of privacy — determined in context. This takes into account factors like place (e.g. home vs public), the sensitivity of the information, age or cultural background of the plaintiff, and whether they invited publicity.

3. Intentional or reckless conduct — negligence isn’t enough. The defendant must have acted deliberately or with reckless disregard.

4. A serious invasion — not just annoying or embarrassing. The harm must be objectively significant (e.g. likely to cause offence, distress or harm to dignity to a person of ordinary sensibilities).

5. Public interest balancing — the court must be satisfied that the plaintiff’s right to privacy outweighs any public interest raised by the defendant (such as free expression, national security, or open justice).

You don’t need to prove economic loss or damage — it’s actionable without it. However, the nature and impact of the harm (e.g. emotional distress, reputational damage, or humiliation) will affect the seriousness of the invasion and any damages awarded.

Not Retrospective — and Watch the Clock

The new tort is not retrospective. That means you can’t sue for conduct that occurred before 10 June 2025, no matter how bad it was. The law only applies to invasions of privacy on or after the commencement date.

And there are strict time limits:

• You must start proceedings within one year of becoming aware of the invasion, and in any event within three years of when it happened — whichever is earlier.

• If the plaintiff was under 18 at the time, they can sue any time up until their 21st birthday.

• In exceptional circumstances, the court can extend the period up to six years after the event — for instance, where trauma or lack of awareness delayed action.

What About Defences?

It’s not all a one-sided affair. There’s a structured list of statutory defences, including where:

• The conduct was required or authorised by law

• The plaintiff consented

• It was necessary to prevent serious harm

• The conduct was part of a lawful defence of person or property

There are also defamation-style defences for things like absolute privilege, publication of public documents, and fair reporting of public proceedings — and journalists enjoy an exemption when acting in a professional capacity under a recognised code of conduct.

Law enforcement and intelligence agencies are also exempt when acting within their lawful functions.

What Remedies Are Available?

The court can award compensation for emotional distress, injury to dignity, and reputational harm — capped at the same maximum as defamation damages (currently $478,550, indexed).

It can also award exemplary damages in egregious cases (like malicious distribution of private images), and make orders for apologies, corrections, injunctions, and destruction of material.

Importantly, apologies won’t count as admissions of guilt — so defendants can say sorry without conceding liability (though it might reduce damages).

What Now?

This is a big deal for Australian privacy law. The new statutory tort fills a long-standing gap between regulation and personal rights — and will likely open the door to more litigation, especially in areas like:

• image-based abuse

• unauthorised publication of intimate content

• intrusive surveillance

• data misuse or unethical tech deployment

For businesses, publishers, digital platforms and public institutions, now is the time to review policies, train staff, and sanity-check any borderline practices. Reckless handling of sensitive information — even without publication — could now be very costly.

Tune in next week for: a deep dive into the new Children’s Online Privacy Code. Because in 2025, even kids’ data isn’t child’s play.

Privacy 2.0: Why the Law Had to Change

It’s not every day a 1980s law gets a 2020s reboot — but that’s exactly what’s happening with Australia’s privacy regime.

After years of community anxiety, OAIC submissions, and a few too many headlines about mega-breaches, the Privacy Act 1988 (Cth) is finally stepping out of its shoulder-padded past and into the digital present.

The latest round of reform — passed at the end of 2024 and now live — marks the biggest shake-up to Australia’s privacy framework in over a decade … and while the updates aren’t a total rewrite, they’re a bold start. From new breach response tools to sharper enforcement powers, and from kids’ data codes to the long-awaited statutory tort of privacy invasion, this is no longer just a compliance issue for GCs. It’s a reputational and risk issue for boards — and a tech/design challenge for operational teams.

So why now? Because the old law just wasn’t cutting it anymore. The last major reform (the 13 APPs) happened in 2014. That was before TikTok existed. Before mass data scraping, AI-driven insurance risk profiling, and customer loyalty schemes that know your breakfast habits better than your spouse. Fast forward a decade, and we’re living in an environment where personal data isn’t just a risk category — it’s a currency, and one that criminals, governments, and companies alike are eager to trade.

Add to that the global pressure. Australia has fallen behind the GDPR club, and even the US (the privacy laggard) is now rolling out state-level data laws with real teeth. If we want to be taken seriously in trade deals, tech partnerships, or cross-border enforcement, our domestic rules have to look credible. That means: Transparency. Accountability. Teeth.

This 9-part twice-per-week Privacy 2.0 blog series will unpack the key changes — what’s landed, what’s coming, and what businesses need to do now (not in 2026, when the AI rules kick in). We’ll also ask the hard questions: is this regulation or reaction? Is it about protecting individuals — or just managing headlines? And what does it mean for those of us navigating the line between innovation and intrusion?

Tune in tomorrow for: an in-depth look at Australia’s new statutory tort of serious invasion of privacy, commencing on 10 June 2025.