United KingdomAge Appropriate Design Code (Children's Code)
In force since .
An age-appropriate design code rule binding private bodies.
What it requires
- Applies to providers of information society services (apps, websites, connected toys and devices, and online games) likely to be accessed by children in the UK.
- Apply the 15 standards of age appropriate design in the Information Commissioner's statutory code, such as privacy by default and data minimisation.
- Do not use nudge techniques that weaken children's privacy protections.
These lines are LexLint's reading of the law's text. Also read by: Information Commission (formerly the Information Commissioner’s Office), guidance on when a service is likely to be accessed by children (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalties
Enforcement under UK GDPR: fines up to the greater of GBP 17,500,000 or 4 percent of global annual turnover for the most serious infringements.
Who enforces it
Enforcement body
Information Commission (it took over the Information Commissioner's functions on )
Settledness
- As of
- Guidance link
- https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/likely-to-be-accessed-by-children/
- Guidance body
- Information Commission (formerly the Information Commissioner’s Office), guidance on when a service is likely to be accessed by children
What it reaches
Age threshold
18
Covered services
Information society services, including apps, websites, connected toys and devices, and online games, likely to be accessed by children in the UK.
Verification methods
Self declaration, Facial estimation, Gov ID
What it makes you log
Logging duty
Sections 123 to 125 direct the Information Commissioner to prepare the age-appropriate design code and give it statutory weight. The sections impose no duty on a service provider to keep a log or record, and set no retention rule; the code's own standards are not read here.
- Kind
- None
- As of
What this law does
Requires providers of information society services likely to be accessed by children in the UK to apply 15 standards of age appropriate design, such as privacy by default, data minimisation, and not using nudge techniques that weaken children's privacy protections, under a statutory code of practice issued by the Information Commissioner under the Data Protection Act 2018. The code came into force on with a 12 month transition period ending .
The Information Commission and courts must take it into account where relevant when assessing UK GDPR compliance. The Information Commission took over the Information Commissioner's functions on .
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .