The OAIC is developing a Children's Online Privacy Code that will set expectations for how online services handle children's personal information.
Much of the public attention is focused on social media, but the draft material is broader. It refers to online services connected with children's activities, including school management systems that monitor student performance.
For schools, this has practical implications.
Learning platforms, wellbeing tools, behaviour systems, assessment products and parent communication apps all create data trails about children. Schools often sit between the student, parent or guardian, and the service provider.
K–12 leaders should be reviewing their EdTech stack now: what data is collected, why it is needed, how it is used, who can access it, and whether supplier settings support children's privacy by design.
These are important questions to ask during shortlisting and procurement, before the supplier and default settings are locked in.