Internet Matters’ expert panel shares their thoughts about the Age-Appropriate Design Code and what it means for children using online services.
For most people, the Age-Appropriate Design Code doesn’t mean much – just another piece of legislation that we don’t pay much attention to. However, from an online safety point of view, the Code is important as it mandates tech companies to ensure that their platforms and services are safer for children and young people.
Many of the key players have already started to make changes with Instagram setting all child accounts to private by default and asking for a date of birth in order to log in. TikTok are doing this for users under 16 and will also stop sending notifications after 9pm to users under 16. Of course, much of this is dependent on users being honest when entering their date of birth at sign up, something we know does not always happen! But, in short, the Code will push companies to give specific protections for children and their data and should be welcomed. Non-compliance can be met with hefty fines of up to 4% of global turnover and many of the big tech companies have already implemented changes, not just in the UK but globally, which has to be good for children and young people.
The Age-Appropriate Design Code finally came fully into force on 2nd September 2021. It’s another world first for the UK.
The body responsible for enforcing the provisions of the Code is the Information Commissioner’s Office (ICO), Britain’s principal privacy protection agency.
That gives us a clue. The Code is all about children’s data or, more particularly, how online businesses can lawfully collect and use children’s data. Data are collected by many online businesses in order to know what kinds of advertisements or services their customers are likely to be interested in buying or using. But if their customers are children, there are limits. The Code explains them.
The ICO has produced some top-class resources which help businesses understand what their new responsibilities are, and how to discharge them. But the ICO has also gone to a lot of trouble to provide some really well thought-through advice and guidance for both parents and children.
The Code contains 15 different standards. From a parent’s perspective one of the key ones is Standard 4. This requires businesses to explain what data they collect and how they use it but — and here’s a really important bit — if their customers are children or are likely to be children, whatever they are doing or proposing to do must be explained in age-appropriate language. Expect to see many more cartoons, pictograms and drawings.
The Age-Appropriate Design Code is a set of rules and standards, tailored to age, that protect children’s data privacy under data protection laws when using the internet in the UK. The standards include taking account of children’s best interest, an impact assessment balancing the privacy rights of a child with any need to disclose data, and defaulting to the strongest privacy settings.
The Code applies to “information society services likely to be accessed by children” and therefore compels most paid online services to implement strong personal privacy and security settings for children, provide explanations of data protection in language that they will understand, and refrain from recommending harmful content.
This will therefore result in a safer online environment for children where they are treated appropriately according to age and in a way that values their best interests, instead of using children as a source of data and statistics.
See more articles and resources to help children stay safe online.