Code of practice on children’s online privacy launched

The code, which is a requirement of the Data Protection Act 2018, outlines 16 age-appropriate design standards for online services including apps, social media platforms, connected toys and streaming services. It is not restricted to services specifically aimed at children.

Developers and providers of services likely to be accessed by children must take the best interests of the child into account as their primary consideration, according to the guidance.

The code also says privacy information must be concise, prominent and in clear language suited to the age of the child, and that their personal data should not be used in detrimental ways.

Other standards, which are rooted in existing data protection law, include:

• Settings must be ‘high privacy’ by default, unless services can provide a compelling reason otherwise
• Geolocation and profiling options should be switched off by default
• Nudge techniques should not be used to encourage children to provide unnecessary data, turn off their privacy protections or extend their use.

The code is out for consultation until 31 May, with the final version expected to come into effect before the end of the year.

Elizabeth Denham, information commissioner, said: “The ICO’s Code of Practice is a significant step, but it’s just part of the solution to online harms. We see our work as complementary to the current focus on online harms, and look forward to participating in discussions regarding the government’s white paper.”

The ICO initially drafted the code using views and evidence gathered from designers, app developers, academics, and findings from research with parents and children conducted by Revealing Reality.

Baroness Kidron, who led the parliamentary debate about establishing the code, said: “I firmly believe in the power of technology to transform lives, be a force for good and rise to the challenge of promoting the rights and safety of our children. But in order to fulfil that role it must consider the best interests of children, not simply its own commercial interests. That is what the code will require online services to do. This is a systemic change.”