The UK Information Commissioner's Office (ICO) has published its final code of practice to protect the privacy of children online.
The Age Appropriate Design Code includes 15 standards that online services should meet to protect children's privacy. The standards will cover those who design, develop or provide online services, such as app, social media platforms, online games, connected toys, educational websites and streaming services, which are likely to be accessed by children and will process their data.
Under the terms of the code, digital services will be obliged to automatically provide children with a built-in baseline of data protection when they visit a website, or download a new game or app, by setting privacy settings to high by default. They should also switch off location settings by default, and avoid the use of nudge techniques to encourage children to weaken their privacy settings. In addition, profiling that allows targeted content to be delivered should also be switched off by default, and data collection and sharing should be minimised.
The standards of the code are based on the General Data Protection Regulation (GDPR). The code was submitted to the Secretary of State in November 2019, and must undergo a statutory process before being presented to Parliament. After this, affected organisations will have 12 months to update their practices before it comes into full effect, which is expected by autumn 2021.
