The Children's Online Privacy Code, and what your school needs to do before December.
Someone is going to ask what the school is doing about this. We made this guide so you have an answer, and so you can check every word of it against the draft yourself. 10 minute read.
days to go
The code has to be registered by 10 December 2026.
Registered means the Information Commissioner signs it into law, so that is the date it stops being a draft. The draft does not yet say when schools have to be complying by. It only sets the date the code itself has to exist. Until that lands, December is the sensible date to plan against, and we will update this page the moment the commencement date is confirmed.
It is not law yet. What exists is an exposure draft, marked "DRAFT ONLY, NOT FOR SIGNATURE", consulted on between 31 March and 5 June 2026. The wording can still change.
The four things below are the parts least likely to change. They are the ones worth planning around now.
15the age it flips
Consent comes from the parent until they turn 15
"Consent to the collection, use or disclosure of personal information about a child may be given by the child only if the child is at least 15 years of age."
Below that age it comes from a person with parental responsibility, and you have to take reasonable steps to confirm they actually hold it. Which is a question about your enrolment records as much as your consent form.
Section 13
12months, then it's stale
Consent expires, and bundling it breaks it
The period you rely on a consent for "must not exceed 12 months from the day the consent is obtained". A form signed once at enrolment and leaned on for six years does not survive that sentence.
Covering everything in one request breaks it too. Consent is not voluntary if "it is obtained using a bundled consent request", which the draft defines as asking for consent to several uses without letting the person agree to each separately. And silence is out: consent is not unambiguous where it "is given through a pre-ticked box or is assumed as a result of the continued use of a service".
Sections 14, 15 and 19
30days to answer
A family can ask you to delete their child
A child, or a parent of a child under 15, can ask you to destroy specified information. "If a request is made, the entity must destroy the information", with exceptions for legal proceedings and other retention duties. Thirty days to respond, or sixty if you explain why inside the first thirty.
Writing the policy is the straightforward part. The work is finding every copy of one student's image across your own drives, your archive, and every supplier who has ever filmed on your grounds.
Section 32
8questions for your suppliers
Your exposure is mostly other people's hard drives
Photographers, video producers, the yearbook company, the sports photography service, the tour operator. Every one of them is holding images of your students right now, and the draft leans hard on records, registers and annual reviews.
The eight questions are further down. Someone who has thought about this answers all of them in a couple of minutes.
Sections 25, 38, 39 and 40
Four more that catch schools out
- Telling a child when you are monitoring them
- If a service gives a parent the ability to monitor a child's use of it, or track their location, the child has to be told, in age appropriate terms, as soon as practicable after the monitoring starts. Device management and location tracking on school laptops and buses both sit near this. Section 33
- Nothing goes to marketing without its own consent
- Using a child's information for direct marketing needs consent obtained for that purpose specifically, plus a clear and easy way for the child to opt out, displayed prominently and in plain language. Sections 11 and 29
- A privacy policy a child could actually read
- A version of your privacy policy directed at children, age appropriate, allowed to use diagrams or video, and it must not include "complex or technical expressions, terminology drawn from specialist industry or legal language". Section 23
- Privacy training, for everyone who touches student data, every year
- Anyone employed or otherwise engaged with regular access to children's personal information must "participate in education and training about protecting personal information about children", as soon as practicable after they start and at least annually after that. Records of the training have to be kept and handed to the Commissioner on request. The wording catches contractors as well as staff, which makes it one more thing to ask your suppliers about. Section 40
Does it even apply to us?
Settle this one first. The Code reaches entities that provide particular kinds of online service, and only the activities that consist of providing them.
"the entity is a provider of a social media service, a relevant electronic service or a designated internet service"
"the service is primarily concerned with the activities of children"
"the entity is not providing a health service"
Section 5
Section 7 narrows it further, to activities that consist of providing such a service where it is "likely to be accessed by children" or "primarily concerned with the activities of children". The reason for schools to look closely is the draft's own list of examples.
"Examples of these kinds of services include applications that track early childhood development, family photo sharing applications, online school management systems that monitor student performance and internet-connected baby monitors."
Section 5, Note 1
An online school management system that monitors student performance is in there by name. Whether your school is caught depends on which systems you run, who runs them for you, and how the final wording lands. That one belongs with your own advisers and with the vendors of those systems. We cannot answer it, and I would be wary of any supplier who tells you they can.
How the lawyers read it
We are quoting the draft. A firm that acts for schools is interpreting it, and Moores have written this up in more useful detail than we can. Their position is that the Code "also applies to schools in certain ways", and they point at online learning platforms, apps on school devices, the messaging services you use to notify parents, and possibly even a school's own social media posts involving students. They also say subcontractors and cloud providers are caught.
That is a wider net than our reading, and theirs is the one to plan against. We would rather you saw both.
One line of theirs is worth carrying into every supplier conversation you have between now and December: a provider is directly responsible for its own compliance, and consent collected by the school does not shift that. Each party carries its own. It cuts both ways, which is why we say plainly further down that consent is yours and storage is ours.
What does this mean for your social media presence?
This is the question we get most from marketing people, so it is worth its own answer.
The draft never says "school Instagram account". Your school does not provide Instagram, Meta does, so on our reading of sections 5 and 7 the account itself is not the thing being regulated. Moores read it wider and think a school's own social posts involving students may be caught. That one is unsettled.
Four things in the draft touch what you post either way.
- One tick at enrolment does not cover four places
- Consent has to be specific. "We may use images for promotional purposes" bundles the website, the socials, the enrolment campaign and the yearbook into a single yes, and a bundled request is not treated as voluntary. Separate ticks, and a fresh one inside 12 months. Sections 14, 15 and 19
- Year 12 can say yes for themselves. Year 7 cannot
- Consent comes from the child once they are 15, and from a parent below that. It changes who you chase for the captain's video and who you chase for the Year 5 camp reel. Section 13
- Marketing needs its own consent, and a way out
- Using a child's information for direct marketing needs consent obtained for that purpose, plus an easy opt out shown prominently and in plain language. Whether an enrolment campaign counts as direct marketing is a question for your advisers. Worth asking it well before December. Sections 11 and 29
- Deletion reaches the post and the footage behind it
- If a family asks, the post comes down and so does the raw the reel was cut from, wherever it sits. Thirty days to answer. Worth knowing what is in the archive before someone asks. Section 32
The practical version of all this is a running record: what you posted, which students are in it, and which consent it sits under. Nobody enjoys building that. It is also the only thing that makes a deletion request take an afternoon instead of a fortnight.
Six questions about your own school
Tick what is honestly true today. Nothing is sent anywhere, this runs in your browser and we never see it.
Your read appears here as you go.
The question you will actually get asked
Nobody is going to ask whether you have read the code. What gets asked, usually in a meeting you did not call, is who is liable and how the school shows it did the work.
That is an evidence question. The draft leans on records, registers and annual reviews, so most of what protects you gets written down well before anything goes wrong. In that meeting, a list of your suppliers with what each one answered is worth more than a policy nobody has opened.
Most of your suppliers have not read the draft. The ones who have will answer the eight questions below in a couple of minutes.
Who owns this at your school?
If you sit in marketing, this probably is not yours to sign off. It usually lands with a business manager, a deputy principal, or whoever holds privacy across the group. If your school is part of a diocese or a corporation, that person may not be on your campus at all.
Worth finding the name this week and sending them this page. The check above has a copy button that drops your answers straight into an email.
The counter at the top moves every day, and we update this page when the draft changes. Press Cmd D on a Mac or Ctrl D on Windows, or add it to your home screen on a phone.
Eight questions worth asking every supplier
These are the ones I would want asked of us. Someone who has not thought about it will take a week and send back a policy document that mentions none of them.
- Where does our footage live while you are working on it, and who can open it?You want names. A department is not an answer.
- Does any of it get copied onto personal laptops, phones or cards that leave your building?This is where most of the real exposure sits, and it is rarely the cloud.
- What happens to it when the project finishes, and how would you prove that to us?A process and a date, in writing.
- Do you run an offsite backup? Where does it sit, and when does that copy expire?Nearly every studio has one, and plenty forget it exists while answering question three.
- Are your contractors bound in writing on confidentiality and ownership?Ask to see the clauses. A yes with nothing behind it is common.
- Does any student footage go into AI tools, for editing, transcription, upscaling or anything else?Ask about the whole workflow, including transcription and upscaling.
- If we ask you to remove something, how fast does it come down and who decides?A number of days, with no argument attached to it.
- If something went wrong, who calls us, how quickly, and what do they say?Before they have the full picture, or after? The answer tells you plenty.
Our own answers, since we would be asking
We make films. We do not run a social media service, a relevant electronic service or a designated internet service, and we do not host a portal, gallery or app that students or families log into. We deliver finished files to the school. Read against sections 5 and 7 above, that is what decides whether an organisation is caught, and it is why we deliberately do not host student galleries.
We hold ourselves to the standard anyway, because the school we work for is the one carrying the risk.
- Cards never leave with the crew
- Footage is not copied onto a contractor's own equipment. Cards come back the same day.
- School footage is edited in-house
- If that ever has to change, it goes only to a contractor under our signed agreement, and we tell the school before it happens.
- Named access while a project is live
- Cloud storage during production, open only to the people working on that job. No public links, no general access.
- Offline on completion, and we tell you what the backup still holds
- The project goes to an offline drive and the working copy comes down. Our encrypted offsite backup keeps a mirror that expires automatically within 12 months. We would rather say that than let you assume nothing exists.
- Two business days to remove anything
- Anything you ask us to take down comes down within two business days. No discussion needed.
- No student media in AI tools
- Student footage and images are not uploaded to generative AI tools and are not used to train any model. Editing happens on our own machines.
- The do not photograph list, in writing, before the day
- Confirmed in writing before each shoot and given to every crew member on the job.
- Consent stays with the school, and we say so plainly
- We rely on the school having obtained permissions from parents and guardians before we film. We do not verify them and we do not hold them. Saying it out loud stops either side assuming the other has it covered.
- If something went wrong
- We would tell your named contact within 24 hours of knowing, in writing, before we had the full picture. Then we follow your direction on who else hears about it, because it is your community.
Take the questions with you
A one page worksheet with the eight questions and room to write each supplier's answer. Print it, fill it in as the replies come back, and you have something to hand whoever asked you the question in the first place.
Or download it straight away without leaving your details.
Want the worksheet to take with you?
The eight questions on one page, with room to write down what each supplier actually said. Tell us where to send it and the download opens straight away.
Your details are stored by us and used to send you the worksheet, and occasionally something else useful for schools. We do not sell or share them, and you can ask us to delete them at any time by emailing hello@vibesociety.com.au. The worksheet is also on this page as a plain download if you would rather skip this.
Who we are
Vibe Society makes films for schools. Enrolment films, campus films, the pieces a principal puts in front of a room of prospective parents. Isaac and Sam run it, and we are on school grounds most weeks, which is how we ended up here.
This page exists because the same question kept coming up in our own client conversations, from people who had been asked what the school was doing about it and had nowhere useful to look. So we read the draft and wrote it down.
We are not a compliance service and we are not selling one. What we can do is answer those eight questions about our own work without stalling, and help you get straight answers out of everyone else holding your students' images.
Questions about any of this, or about how we handle your footage: hello@vibesociety.com.au. No pitch, and we will tell you when something is outside what we can answer.
Working across more than one school?
Everything on this page multiplies. A question that takes one school a month to settle takes a group the same month at every school, each with its own supplier list and its own consent records to audit.
We work across school groups and we have been through this exercise on our own operation. If someone at the centre is coordinating the response for a group, a diocese or a corporation, we are happy to be in that room. It is the same problem several times over, and there is no good reason for each school to solve it alone.