United KingdomOfcom Protection of Children Codes of Practice
In force since .
A social media and minors rule binding private bodies.
- Covered services
- User-to-user services and search services likely to be accessed by children in the UK.
- Verification methods
- Facial estimation, Gov ID, Third party service, Device signal, Self declaration
- Audit expectation
- periodic
- Who audits it
- Self, Internal independent
- Where the report goes
- Kept
What it requires
- Applies to user-to-user services and search services likely to be accessed by children in the UK; these Codes set out the measures Ofcom expects, and following them treats you as compliant with the children's safety duties.
- Have completed your children's risk assessment by .NIST Privacy FrameworkID.RA-P4
- Have risk mitigation measures in place from , including age assurance, safer default settings and algorithms, and content moderation.no control in the NIST Privacy Framework
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Penalties
Fines up to the greater of GBP 18,000,000 or 10 percent of qualifying worldwide revenue; business disruption measures for serious or repeated breaches.
Who enforces it
Enforcement body
Ofcom
Settledness
Ofcom issues the Codes as the enforcing body, so the Codes are its own construction of the children's safety duties; a provider that implements the recommended measures is treated as complying with the duty each measure relates to.
- As of
- Open questions
- Where a provider takes an alternative to a measure the Codes recommend, what must its written record under section 23(4) of the Online Safety Act 2023 show about "how those alternative measures amount to compliance with the duty in question"?
What it makes you log
Logging duty
Where a provider concludes that applying highly effective age assurance access controls is not technically feasible or proportionate, PCU C2.12 recommends that it make and keep a written record of how feasibility or proportionality was assessed and why. PCU A1.2 recommends that the most senior governance body of a large service carry out and record an annual review of its risk management activities for harm to children. Paragraph 1.8 adds that a provider using alternative measures must maintain a record of what it did. The Code recommends no record of an individual age check and sets no retention period. The codes are recommended measures, not duties; a provider that follows them is treated as complying.
- Kind
- Explicit
- As of
- Provision
- Protection of Children Code of Practice for user-to-user services, PCU C2.12 and PCU A1.2
- Trigger
- age_assurance
- all_systems
What this law does
Sets out the measures Ofcom expects user-to-user and search services likely to be accessed by children to adopt to comply with the Online Safety Act's children's safety duties, including age assurance, safer default settings and algorithms, and content moderation; providers that follow the Codes are treated as compliant.
Ofcom published the final Codes on ; providers had to complete children's risk assessments by and have risk mitigation measures in place from , after the Codes completed the required Parliamentary process.
When LexLint raises it
When your app profile says your app operates a social platform.
Back to the example · Lint your app
Page updated .