RwandaMinisterial Instructions on Child Online Protection
Ministerial Instructions N° 001/MINICT/2024 of 22/01/2024 on Child Online Protection
In force since .
An age-appropriate design code rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Applies to any person or organisation that broadcasts or provides content online or provides access to online content, not only services aimed at children or social media platforms. The instructions do not define child, but the Law N° 71/2018 they are issued under defines a child as anyone under eighteen.
- As a digital content provider or retailer, make digital content filtering tools available, maintain plans to manage harmful online content, provide a reporting function for users, and give a clear external label describing whether platform content is suitable for children (Article 4).no control in the NIST Privacy Framework
- Put in place a mechanism to prevent children from accessing age-inappropriate content, sites, products or interactive services (Article 4).no control in the NIST Privacy Framework
- As an internet service provider, inform subscribers of risks to children, support reporting of child abuse, block access to child-abuse material once identified, and make parental-control tools available where applicable (Article 5).no control in the NIST Privacy Framework
- As a cybercafe or public Wi-Fi provider in a public place, proactively block access to sites known for hosting content harmful to children (Article 6).no control in the NIST Privacy Framework
- As a broadcaster or television service provider, indicate the suitability of content for various age categories, and implement technical barriers, including parental controls and age-verification tools, so that children are not exposed to harmful content (Article 7).no control in the NIST Privacy Framework
- As a social media user, refrain from creating or publishing videos of child actors in age-inappropriate roles, and from creating or publishing children's images or videos for entertainment or commercial purposes without the consent of a holder of parental responsibility (Article 8).NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
the organ in charge of cybersecurity in Rwanda (the competent authority named in the instructions)
What it reaches
Age threshold
18
Covered services
Any person or organisation that broadcasts or provides content online or provides access to online content, including digital content providers, internet service providers, cybercafes and public Wi-Fi access providers in public places, broadcasters and television service providers, and social media users
Obligation class
Design code, Content labelling, Age verification, Consent
What it makes you log
Logging duty
Articles 4 to 8 require filtering tools, harm-management plans, a reporting function, labels, blocking and parental-control tools; a plan to manage harmful content is not a record of an age check, and no article names a log, record, retention period or audit.
- Kind
- None
- As of
What this law does
Article 3 applies these instructions to any person or organisation that broadcasts or provides content online or provides access to online content, a scope not confined to services aimed at children or to social media platforms.
Article 4 requires digital content providers and retailers to make available digital content filtering tools, maintain plans to manage harmful online content, provide a reporting function for users, give a clear external label describing whether platform content is suitable for children, and put in place a mechanism to prevent children from accessing age-inappropriate content, sites, products, or interactive services.
Article 5 requires internet service providers to inform subscribers of risks to children, support reporting of child abuse, block access to child-abuse material once identified, and make parental-control tools available where applicable. Article 6 requires cybercafes and public Wi-Fi providers in public places to proactively block access to sites known for hosting content harmful to children.
Article 7 requires broadcasters and television service providers to indicate the suitability of content for various age categories. It also requires them to implement technical barriers, including parental controls and age-verification tools, so that children are not exposed to harmful content.
Article 8 requires social media users to self-regulate by refraining from creating or publishing videos of child actors in age-inappropriate roles, and from creating or publishing children's images or videos for entertainment or commercial purposes without the consent of a holder of parental responsibility.
The instructions themselves do not define the term child; they are issued pursuant to Law N° 71/2018 relating to the Protection of the Child, which defines a child as any person under eighteen years of age.
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .