Skip to main content
Go back
Written by
UK Team
6th February, 2025

UK bolsters legal basis of Age Appropriate Design Code

Last night, the House of Lords agreed an amendment to the Data (Use and Access) Bill, introducing a legal duty for services to comply with stronger protections for children’s data by design and default.

A young black girl on a laptop. She is smiling and waves at the laptop in front of her, which suggests she is on a video call.

The amendment, brought forward by the UK Government and 5Rights Chair and founder Baroness Beeban Kidron, modifies Article 25 of the UK GDPR and will require services to take into account children’s heightened entitlement to protection when designing and carrying out data processing. In particular, services must take into account that children:

  • Must be best protected and supported when using the service;
  • Merit specific protection with regard to their personal data and how this impacts their rights; 
  • Have different needs at different ages and stages of development.

This duty pertains to online services “likely to be accessed by children”. This means that the legal requirement applies not only to services where we expect children to be but also where they are in reality. This aligns with the Age Appropriate Design Code (AADC), giving unequivocal backing to its principles and a legal basis for compliance. Notably, the amendment also acknowledges that services outside the AADC’s scope must consider children’s higher data protection in particular contexts.

Speaking during the debate, the Minister for Science, Research and Innovation, Lord Vallance, stated:

“Organisations that are already complying with the [Age Appropriate Design] code should not find it difficult to comply with the new duty, but organisations that have treated compliance with the code as optional will now be under a clear legal duty to design their services with children’s rights and interests in mind”

This marks a crucial victory for 5Rights. We have long advocated for stronger action on enforcement by the UK’s data regulator, the Information Commissioner’s Office, which has had access to enforcement powers for over three years while continuing to report ongoing and widespread misuse of children’s data.

5Rights will seek assurances from the regulator in the coming weeks as to how it will implement and take action in line with this new duty. In parallel, we remain committed to working with services – who now must comply with the Age Appropriate Design Code by law – to implement changes that provide children the privacy, protection and security to thrive in the online world.