As of September 2, 2021, the United Kingdom’s Information Commissioner’s Office (“ICO“) expects organizations to use their Age Appropriate Design Code (“AADC“). The AADC went into effect last year, but organizations had a 12-month transition period to implement their requirements. This transition period ended on September 2nd and we could see the ICO start taking enforcement action for non-compliance.
The AADC applies to information society services (“ISS“(E.g. websites, games, apps, connected toys and IoT devices) that children in the UK are likely to access. Any person under the age of 18 is considered a “child”. The code contains 15 principle-based standards for “age-appropriate design”, which are intended to protect children and their personal data on the Internet. These include, for example: the obligation to confirm the age of the user with a level of security appropriate to the data protection risks, the implementation of age-appropriate data protection guidelines and a ban on “poking” techniques that encourage children to provide more personal data or to turn off data protection protective measures.
Now that the transition period is over, organizations that offer ISSs that are likely to be used by children (a potentially broad area of responsibility) should ensure that they have complied and implemented the standards of the Code – and can demonstrate compliance. The Code advocates a risk-based approach and ISS providers should prioritize services that are specifically targeted at children and that pose the highest privacy risks.
The ICO has repeatedly stressed the importance of compliance with the AADC, recently advising that it would be “proactive” to require social media platforms, video and music streaming sites and the gaming industry to communicate to the regulator how their services are consistent with the code. We should get a feel for how the ICO will enforce the AADC over the next several months. In the meantime we suspect that not only the children will have this feeling of starting school….
A groundbreaking code to create “a better internet for children” comes into force in the UK