On September 2, 2020, a statutory ICO code came into force, according to which organizations must ensure better protection of online privacy for children. This marked the beginning of a twelve-month transition period.

The Age Appropriate Design Code, or Children’s Code, applies to organizations that offer online services and products that children under the age of 18 are likely to access, and gives companies one year to make the changes necessary to protect the privacy of To put children at the center of their design.

For designers of online services and products, 15 standards are set and how they should comply with data protection law. The code requires that digital services automatically provide a built-in privacy foundation to children when they download a new app, game, or website.

Breaking new ground as regulatory guidelines that focus on a “by-design” approach, the Code is a big step forward in protecting children online, especially given the increasing reliance on online services at home during Covid-19. All major social media and online services used by children in the UK must comply with the Code.

Information Commissioner Elizabeth Denhams commented: “In a generation we will all be amazed that there ever was a time when there were no specific rules to protect children online. It’s as normal as putting on a seat belt.

“This code makes it clear that children are not online like adults and that their data needs better protection. We want children to be online, learn and play and experience the world, but with the right protection.

“We know that businesses, especially small businesses, need support to comply with the Code, so we’ve decided to give businesses a year to prepare and offer help and support.”

Businesses are encouraged to contact them to highlight the additional help they may need to understand the new code. Based on their feedback, the ICO will develop a bespoke support package over the next year to help organizations customize their online products and services before September 2, 2021.

The code is risk based, which means that it does not apply to all organizations alike. Those responsible for designing, developing, or deploying online services such as apps, connected toys, social media platforms, online games, educational websites, and streaming services that use, analyze, and profile child data will likely need to do more to conform to the code .


The ICO’s new web hub is a starting point for everyone in charge to get the help and support they need. A series of webinars running throughout September will support members of professional associations in the fields of games, video streaming, social media and connected toys.

It is also keen to hear from innovators focused on cutting edge personal data projects that address the issues arising from implementing the Children’s Code. It invites organizations to apply for spots in its free sandbox.

The sandbox is designed to help organizations use personal data to develop innovative products and services and accepts applications from all types of organizations from start-ups, SMEs and large organizations in the private, public and voluntary sectors.

Additional resources will be added on the ICO website, including a toolkit for organizations to help assess whether they need to meet requirements and details of risk assessment workshops.

Take part in the debate

Jenny Brotchie, Senior Policy Manager at the ICO, will present a session on age-appropriate design code at the upcoming virtual privacy summit on December 10th.

Leading experts from across the data protection landscape will attend the event and examine the critical issues that frontline practitioners face.

Like this:

To like Loading…