Age Appropriate Design Code comes into force in UK

The Age Appropriate Design Code requires data protection to be made a primary consideration when designing online services, from the point of inception. It sets out 15 standards that companies are expected to incorporate into services used by children, including apps, connected toys, games, and even educational websites.

The code was drafted by the Information Commissioner’s Office (ICO) and published in a “clarified and simplified” form last year, following initial publication of a draft in 2019. The ICO will also be responsible for enforcing the rules.

The measures cover transparency, default setting and data minimisation. The code states that privacy settings should be set to high by default and nudges (indirect suggestions) should not be used to encourage children to weaken their settings. It also says location settings that allow the world to see where a child is should also be switched off by default. Furthermore, data collection and sharing should be minimised and profiling that can allow children to be served up targeted content should be switched off by default too.

As the code is based on GDPR, companies risk fines of up to £17.5m or four per cent their annual global turnover (whichever is higher) for serious failures. The ICO warned that it will probably take more severe action against breaches involving children where it sees harm or potential harm.

The Information Commissioner, Elizabeth Denham, told the PA news agency that the code is about “age-gating” or “locking children out” of the internet.

“The internet was not designed with children in mind and I think the Age Appropriate Design Code will go a long way to ensure that kids have the right kind of experience online,” Denham said. “I think it will be astonishing when we look back to ever think of a time when we didn’t have protections for children online, because I think they need to be protected in the online world in the same way that they’re protected in the offline world.”

Companies were given a year to ensure their platforms adhere to the measures, although some have reportedly scrambled to make last-minute changes in recent weeks.

Instagram recently announced all users would be required to provide their date of birth. Google has introduced a set of measures, including videos uploaded to YouTube by users under the age of 18 being private by default, auto-play being disabled to discourage binge-watching, and location history being turned off for all underage accounts.

Andy Burrows, head of child safety online policy at the NSPCC, said: “It’s no coincidence that a flurry of tech firms have made child safety announcements on the eve of the children’s code coming into force. This landmark code shows that regulation works and that there is little doubt this UK leadership is having a global impact on the design choices of the sites such as Instagram, Google and TikTok.

“The Information Commissioner should now actively enforce the code and be prepared to take swift action against companies who fail to build and run services with the best interests of children in mind.”

Baroness Kidron, chairwoman of children’s safety group the 5Rights Foundation, told PA: “We need the Online Safety Bill, we need algorithmic oversight, we need a more receptive culture from the sector, but this is a landmark moment. And I would just say, as a warning, if there are people who think this is only about the usual suspects of Facebook, Google, YouTube, Snapchat, Twitter and so on, it’s not. So, I do call out the gaming sector, who we have heard a lot less from, and I do call out e-commerce, and some of the other people who think they can hide in the shadow of the big boys. That is not going to happen, we are watching and we will be looking to see what people do.”