The Children’s Code came into force on 2nd September 2020 with a transitional period of 12 months and all affected organisations are now expected to be compliant.
From 2nd September 2021 the Commissioner must take the code into account when considering whether an online service is compliant with its data protection obligations under the UK GDPR and PECR (the Privacy and Electronic Communications Regulations).
The Children’s Code is officially called the Age Appropriate Design Code and it officially recognises children and young people’s data protection rights in the digital world, including games, apps and online services.
The code is for providers of information society services, such as online products or services, including programs, websites, games, apps, community environments and connected toys or devices with or without a screen that process personal data and there is a likelihood of the services being accessed by children in the UK.
What does it mean for businesses?
Standards introduced by the code
The Children’s Code explains how affected businesses should safeguard children’s personal data and it introduces 15 standards of age appropriate design applicable to businesses whose services are likely to be accessed by children and young people in the UK.
The standards include:
- Best interests of the child
- Data protection impact assessments
- Age-appropriate application
- Transparency
- Detrimental use of data
- Policies and community standards
- Default settings
- Data minimisation
- Data sharing
- Geolocation
- Parental controls
- Profiling
- Nudge techniques
- Connected toys and devices, and
- Online tools
The standards are flexible and provide built-in protection to allow children to safely explore, learn and play online.
Benefits of the code
It's estimated that 20% of all UK internet users are children and they need to use an internet that is designed for them.
The United Nations Convention on the Rights of the Child (UNCRC) recognises the special safeguards children need in various aspects of their life.
The code is not a new law but it explains how UK General Data protection Regulation applies in the context of children using digital services.
All affected businesses and organisations must now conform to the code and demonstrate that the use of children’s personal data is fair and in compliance.
What should businesses do to comply with the code?
Businesses should ensure that the best interests of children are the primary consideration when designing and developing online services, including but not limited to the following:
- Settings must be “high privacy” by default
- Only the minimum amount of personal data should be collected and retained
- Children’s data should not usually be shared
- Geolocation services should be switched off by default
- Nudge techniques should not be used to encourage children to provide unnecessary personal data, weaken or turn off their privacy settings
- Address issues of parental control and profiling
- Use data protection impact assessments (DPIAs) to assess potential risks and mitigation measures, and
- General UK GDPR compliance, including appropriate privacy notices, internal documents, processes and training.
What should businesses do about existing services?
We recommend that you review any existing services to establish whether they would be subject to the Children's Code and, if so, consider any necessary steps to comply, starting with a data protection impact assessment (DPIA).
Businesses should focus on assessing their current conformance and identifying and implementing any additional measures that may be necessary.
Changes may affect online products and services, as well as any packaging, printed information or the physical component of a connected toy or device.
Communicating any upcoming changes to existing users about their online experience will be a part of the process too.
Get legal assistance from LawBite
If you have any questions about the Children's Code or need any further support on how to handle children's data please do not hesitate to contact LawBite for your free 15 minutes consultation with one of our expert lawyers.
At LawBite we understand that every business is unique so we will make sure you are protecting your business in the right way. We will work with you speedily and affordably to understand what your business needs and agree on a pathway to compliance. To find out more book a free 15 minute consultation or call us on 020 3808 8314.
