Targeted advertising & the Children's Online Privacy Code

The Children’s Online Privacy Code is widely expected to address a range of privacy issues for children, including targeted advertising. This briefing paper explores a discussion held by 21 experts from academia and civil society in June 2025 around how the Code might address targeted advertising.

It recommends that:

• The Code addresses the ‘data processes’ involved in targeted advertising. This includes data collection, use, and disclosure, along with other aspects inherent to targeted advertising that cuts across multiple Australian Privacy Principles (APPs).
• The Code offers a strong remedy, such as prohibiting or presuming against the collection, use or disclosure of data to enable targeted advertising.
• Strong requirements for transparency — including regulator transparency and public transparency — be implemented within the Code itself.

The discussion outlined that:

• Targeted advertising is a violation of children’s rights because of the data handling process it involves. The Children’s Online Privacy Code would be well placed to prohibit this practice on privacy grounds.
• Targeted advertising creates a risk environment for young people and places them in danger of harm. Even if this process is occasionally used to promote positive advertising, this overall risk profile would justify prohibiting the use of children’s data to fuel this practice in the Code.
• Multiple jurisdictions have presumed against the practice in comparable children’s data codes. The UK, Ireland and the EU have used data protection laws to create a presumption against targeted advertising by outlining that children should not be profiled. The EU has dovetailed this with a broader prohibition under the Digital Services Act.
• A major mismatch exists between how the digital economy currently functions and what Australians deserve and want. Extensive research shows that Australians are uncomfortable with the practices of targeted advertising.
• The process of targeted advertising involves a pipeline of data handling practices, including the collection, use and disclosure of data, as well as automated profiling. This means that there are multiple ways a Code could address targeted advertising, and a pipeline-wide approach would be desirable.
• There is a broader need for transparency and accountability within the Code. Without this, non-compliance or malicious-compliance could become commonplace.
• Ultimately, this is a question of ‘the business model’; can protecting children’s privacy create a way to lift children out of the current rights-violative approach?