Schedule 1 Part 4 requires the Commissioner to develop and register a Children's Online Privacy Code (child: an individual under 18) setting out how one or more APPs apply to children's privacy, within 24 months of Royal Assent (by 10 December 2026). It binds an APP entity that provides a social media service, relevant electronic service or designated internet service (Online Safety Act 2021 meanings) likely to be accessed by children, unless it is providing a health service, and any APP entity or class the code specifies; the code may exclude specified entities. Under s 26A a bound entity must not breach a registered APP code. The Commissioner may issue guidelines on when a service is likely to be accessed by children.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.