Children's Code

{{short description|UK code of practice for online services used by children}} {{use British English |date=December 2021}}

The '''Age appropriate design code''', also known as the '''Children's Code''', is a British [[internet safety]] and [[Internet privacy|privacy]] [[code of practice]] created by the [[Information Commissioner's Office]] (ICO). The draft Code was published in April 2019,<ref name=":0">{{Cite news |date=15 April 2019 |title=Under-18s face 'like' and 'streaks' limits |url=https://www.bbc.com/news/technology-47933521 |access-date=15 April 2019 |work=[[BBC News]]}}</ref><ref name=":1">{{Cite news |last=Greenfield |first=Patrick |date=15 April 2019 |title=Facebook urged to disable 'like' feature for child users |work=The Guardian |url=https://www.theguardian.com/technology/2019/apr/15/facebook-urged-to-ditch-like-feature-in-uk-online-child-safety-drive |access-date=15 April 2019 |issn=0261-3077}}</ref> as instructed by the ''[[Data Protection Act 2018]]'' (DPA).<ref name=":2">{{Cite web |title=ICO's 'Children's Code' applies from today – what you need to know |url=https://www.eversheds-sutherland.com/global/en/what/articles/index.page?ArticleID=en/Data-Protection/ico |access-date=2023-04-09 |website=Eversheds Sutherland}}</ref> The final regulations were published on 27 January 2020 and took effect 2 September 2020, with a one-year grace period before the beginning of enforcement.<ref>{{Cite web |last=Lomas |first=Natasha |date=2020-01-22 |title=UK watchdog sets out 'age appropriate' design code for online services to keep kids' privacy safe |url=https://techcrunch.com/2020/01/22/uk-watchdog-sets-out-age-appropriate-design-code-for-online-services-to-keep-kids-privacy-safe/ |access-date=2023-04-09 |website=TechCrunch |language=en-US}}</ref><ref>{{Cite web |last=Lomas |first=Natasha |date=2021-09-01 |title=UK now expects compliance with children's privacy design code |url=https://techcrunch.com/2021/09/01/uk-now-expects-compliance-with-its-child-privacy-design-code/ |access-date=2023-04-09 |website=TechCrunch |language=en-US}}</ref> The Children's Code is written to be consistent with [[General Data Protection Regulation|UK GDPR]] and the DPA, meaning that compliance with the Code is enforceable under the latter.<ref name=":0" /><ref name=":1" />

It applies to any internet-connected product or service that is likely to be accessed by a [[Minor (law)|person under the age of 18]]. It requires online services to be designed in the "[[best interests]]" of children and their health, safety, and privacy, requiring that they be afforded with the strongest privacy settings by default, that only data strictly necessary to deliver individual service elements is collected from children unless there is justification, and that children's personal data not be disclosed to third-parties unless there is justification. It also requires privacy policies and controls to be presented in a manner that is clear and accessible to children, including prohibiting [[dark pattern]]s.

== History == Baroness [[Beeban Kidron]] sponsored the amendment to the DPA that mandated the development of the Code.<ref>{{Cite news |last=Tait |first=Amelia |date=2021-09-19 |title=Beeban Kidron v Silicon Valley: one woman's fight to protect children online |url=https://www.theguardian.com/film/2021/sep/19/beeban-kidron-v-silicon-valley-one-womans-fight-to-protect-children-online |access-date=2024-02-16 |work=The Observer |language=en-GB |issn=0029-7712}}</ref> Upon the implementation of the Code in 2021, she explained that "[the Code] shows tech companies are not exempt. This exceptionalism that has defined the last decade, that they are different, just disappears in a puff of smoke when you say, 'actually, this is business.' And business has to be safe, equitable, run along rules that at a minimum protect vulnerable users.<ref>{{Cite news |last=Hern |first=Alex |date=2021-09-02 |title=UK children's digital privacy code comes into effect |url=https://www.theguardian.com/technology/2021/sep/02/uk-childrens-digital-privacy-code-comes-into-effect |access-date=2024-02-16 |work=The Guardian |language=en-GB |issn=0261-3077}}</ref>

== Contents == The Children's Code is a [[code of practice]] enforceable under the [[Data Protection Act 2018]], and is consistent with GDPR and the [[Convention on the Rights of the Child]]. It specifies design standards for any information society services (ISS, which includes websites, software and apps, and [[connected toys]]) that are likely to be used by a [[Minor (law)|person under the age of 18]] and is based in or serves users within the United Kingdom.<ref name=":2" /><ref name=BBC/>

The Code requires that services be designed in the "best interests" of children, including their physical and mental health, protecting them from being exploited commercially or sexually, and acknowledging parents and caregivers' roles in protecting and supporting said best interests for their children.<ref name=":2" />

The Code specifies that when used by a child, online services must use their highest privacy settings by default, unless there is a compelling reason to do so while keeping into account the child's "best interests". This includes not allowing access to data by other users, [[location tracking]], or behavioural profiling (such as algorithmic curation and [[targeted advertising]], or using data "in a way that incentivises children to stay engaged").<ref name=":2" /> The amount of data collected from children must be minimized, only collecting data that is strictly necessary to deliver service elements that a child is "actively and knowingly engaged" in. A service may not disclose a child's personal data to a third party without a compelling reason to do so.<ref name=":2" />

Services must present their [[privacy policy]], privacy options, and [[Data portability|data export]] and [[Data erasure|erasure]] tools in clear terms that can be understood by the target audience. They must not use [[dark patterns]] to [[Nudge theory|nudge]] children toward options that decrease their privacy.<ref name=":2" /> The Code recommends that privacy settings and tools be tailored to the needs of specific age groups.<ref name=":2" /> Per GDPR, a user must be at least 13 years old to give verifiable consent to data processing; verifiable consent must be given by the child's parent or custodian.<ref>{{Cite web |title=Age of consent in the GDPR: updated mapping |url=https://iapp.org/resources/article/age-of-consent-in-the-gdpr-updated-mapping/ |url-status=live |archive-url=https://web.archive.org/web/20180527023437/https://iapp.org/resources/article/age-of-consent-in-the-gdpr-updated-mapping/ |archive-date=27 May 2018 |access-date=26 May 2018 |website=iapp.org}}</ref><ref name="privacy association">[https://www.privacyassociation.org/media/presentations/A12_EU_DP_Regulation_PPT.pdf "How the Proposed EU Data Protection Regulation Is Creating a Ripple Effect Worldwide"]. Judy Schmitt, Florian Stahl. 11 October 2012. Retrieved 3 January 2013.</ref>

== Impact == Social media services adjusted their services to comply with the Code; on [[Instagram]], all accounts created by under-18s began to be marked as private by default, and adults may not direct message them unless they are followers. [[TikTok]] stated that it will not send [[Push notification|push notifications]] to children during the evening and nighttime hours, while [[YouTube]] stated that it would treat all videos "made for kids" (a designation introduced in 2020 following a ruling and fine under the U.S. [[Children's Online Privacy Protection Act]])<ref>{{Cite web |last=Kelly |first=Makena |date=December 11, 2019 |title=YouTube calls for 'more clarity' on the FTC's child privacy rules |url=https://www.theverge.com/2019/12/11/21011229/youtube-google-coppa-ftc-creators-videos-childrens-privacy-regulations |access-date=December 11, 2019 |website=The Verge |language=en}}</ref><ref name=":3">{{cite web |last=Matthews |first=David |date=January 6, 2020 |title=YouTube rolls out new controls aimed at controlling children's content |url=https://www.techspot.com/news/83422-youtube-rolls-out-new-controls-aimed-controlling-children.html |access-date=January 9, 2020 |work=TechSpot}}</ref> under the assumption they were being viewed by a child, including disabling autoplay, personalization, targeted advertising, and social features.<ref>{{Cite news |date=2023-03-01 |title=YouTube accused of collecting UK children's data |language=en-GB |work=BBC News |url=https://www.bbc.com/news/technology-64786968 |access-date=2023-04-09}}</ref><ref>{{Cite news |date=2021-09-01 |title=Children's internet code: What is it and how will it work? |language=en-GB |work=BBC News |url=https://www.bbc.com/news/technology-58396004 |access-date=2023-04-09}}</ref><ref name=":3" />

In March 2023, a complaint was filed against YouTube alleging violations of the Code, as the service can track children via devices shared by multiple users.<ref>{{Cite news |date=2023-03-01 |title=YouTube accused of collecting UK children's data |language=en-GB |work=BBC News |url=https://www.bbc.com/news/technology-64786968 |access-date=2023-04-10}}</ref> === California === The code was adapted by the U.S. state of [[California]] as AB 2273, The California Age-Appropriate Design Code Act, and passed in August 2022. Kidron's charity [[5Rights Foundation]] was credited as a supporter and "co-source" of the bill. In September 2023, the bill was ruled unconstitutional by Federal Judge [[Beth Labson Freeman]] as a violation of the [[First Amendment to the United States Constitution|First Amendment]].<ref>{{Cite web |last=Masnick |first=Mike |date=2022-08-25 |title=Why Is A British Baroness Drafting California Censorship Laws? |url=https://www.techdirt.com/2022/08/25/why-is-a-british-baroness-drafting-california-censorship-laws/ |access-date=2024-02-16 |website=Techdirt |language=en-US}}</ref><ref>{{Cite web |last=Robertson |first=Adi |date=2022-08-30 |title=California passes sweeping online safety rules for kids |url=https://www.theverge.com/2022/8/30/23326822/california-ab-2273-passes-senate-children-social-media-bill-gavin-newsom |access-date=2024-02-16 |website=The Verge |language=en}}</ref><ref>{{Cite web |last=Masnick |first=Mike |date=2023-09-19 |title=Court Says California's Age Appropriate Design Code Is Unconstitutional (Just As We Warned) |url=https://www.techdirt.com/2023/09/19/court-says-californias-age-appropriate-design-code-is-unconstitutional-just-as-we-warned/ |access-date=2024-02-16 |website=Techdirt |language=en-US}}</ref>

==See also== * [[Online Safety Act 2023]] * [[Advertising to children]]

==References== <references>

<ref name=BBC>{{citation |url=https://www.bbc.co.uk/news/technology-58396004 |title=Children's internet code: What is it and how will it work? |author=Jane Wakefield |date=1 September 2021 |publisher=[[BBC News]]}}</ref>

</references>

[[Category:Child online safety laws]] [[Category:Child welfare]] [[Category:Information governance]]