Online Safety Act 2025, Child Protection Code, safe design and operation duty for services likely accessed by children

Section 18 of the Online Safety Act 2025 requires a licensed applications service provider or licensed content applications service provider to implement measures, specified in a code issued by the Commission, to ensure the safe use of its services by a child user, defined as a person under the age of eighteen years; subsection 18(3) requires that, for a service that is, in the provider's opinion, likely to be accessed by child users, those measures include safe design and operation to prevent a child's access to suspected harmful content, limit an identified adult's ability to communicate with an identified child, limit features that increase or sustain a child's use of the service, prevent an identified adult from viewing an identified child's personal information, and control personalised recommendation systems suitable for child users.

The Child Protection Code, issued by the Commission under section 80 read with section 18 and taking effect 1 June 2026, applies these duties to any applications service enabling communication between users and any content applications service, and adds content-moderation duties (detecting and removing harmful content, accessible reporting channels for child users, steps against repeated exposure to reported or removed content), a duty to make available parental control features, a duty to set privacy and safety settings to the highest level by default for child users and limit an unconnected adult's direct communication with a child user, and duties over search and recommendation systems.

Those duties include activating safe search by default. Separately, algorithmic recommendation does not display or promote harmful content to child users.