I’ve had a few questions recently about The Children’s Code, so I’ve written a summary I hope will be helpful:
The Children’s Code (or Age Appropriate Design Code to give it its formal name) is a significant development in online safeguarding because it impacts on many businesses who’ve never had to consider whether children are interacting with their online platforms.
In its Executive Summary, the ICO explains that the Code seeks to protect children within the digital world, not protect them from it.
What is it?
The Code is a statutory code of practice for online services, such as apps, online games, and web and social media sites, likely to be accessed by children under the age of 18.*
It contains 15 standards that online services need to risk-assess themselves against to meet their obligations under data protection law to protect children’s data online.
Although the Code came into force on 2 September 2020, organisations have been given 12 months to prepare, so the effective date is 2 September 2021.
Does it apply to schools?
The Code does not apply to schools because they are not information society services (see below).
However, I think it will be a useful benchmark for schools when considering the use of educational websites, apps etc in the future.
Who does it apply to?
The UK’s Data Protection Act 2018 (section 123) says the Code applies to “relevant information society services which are likely to be accessed by children.”
An information society service (ISS) is defined as: “any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services.”
Therefore, most for-profit online services are ISS, and will be covered by the Code. This includes:
- apps
- programs
- search engines
- social media platforms
- online messaging or internet based voice telephony services
- online marketplaces
- content streaming services (eg video, music or gaming services)
- online games
- news or educational websites
- any websites offering other goods or services to users over the internet.
Electronic services for controlling connected toys and other connected devices are also ISS.
Even if an online service isn’t aimed at children, if it is likely to be accessed by them, the provider will need to risk-assess whether they need to conform to the Code.
Free online games or search engines that are funded by advertising fall under the definition of an ISS.
Age of the Child
*The Code uses the definition of a child under the UN Convention on the Right of the Child (UNCRC), which is anyone under the age of 18.
N.B. This is distinct from the age of consent for a child using an information society service, which is 13 in the UK:
- only children aged 13 years and over may lawfully provide their own consent for the processing of their personal data when using an ISS
- an adult with parental responsibility must provide consent for processing if the child is under 13.
The exception to this is if the ISS is an online preventive or counselling service, when parental consent is not required.