Help us make digital spaces safe for children and young people.
Five years of the Children’s Code: pioneering then, pioneering now
Now in its fifth year, the UK’s Children’s Code still sets the bar for children’s privacy online but weak enforcement means it’s not delivering on its promise.
It is five years since the Age Appropriate Design Code (the Children’s Code) – the world’s first code of practice for the protection of children’s data – came into force in the UK, breaking new ground for children growing up in the digital environment.
Why the Code matters more than ever
A lot has changed since the Children’s Code came into force. AI is now becoming part of children’s everyday lives, from tools used at school to chatbots, games and recommendation systems.
As more of childhood moves into the digital world, more of it is shaped by data. Platforms use what children watch, search for and interact with to build profiles and personalise what they see. The more the system learns, the better it can keep children engaged. The ICO’s own research found that 76% of children say that seeing more of the same kinds of content makes them spend longer online than they want to.
Around the world, governments are responding to concerns about children’s online experiences with age limits and other restrictions. But many of those concerns trace back to the same root.
The Children’s Code gives us a way to address this at its source: by limiting the data companies collect, how they use it and the profiling they carry out.
How the Code changed the standard for companies
The Code pushed companies to make changes that, five years ago, were far from standard practice: children’s accounts private by default, notifications switched off overnight, less data collected and less profiling. That shift did not stay within the UK. Major tech companies have since announced similar protections in the US, while governments are moving to make some of these measures mandatory. The UK Government itself has reiterated the need for stronger protections such as these just this summer.
Meanwhile, the Code’s influence has continued to grow, stretching from the US State of Maryland to Brazil, Ireland and, most recently, Australia. The world is catching up with the Children’s Code, proof that the framework works when it is applied.
Regulation and enforcement make a difference
That is exactly why enforcement matters. Research from the Digital Futures for Children centre at LSE by Steve Wood found that regulation is having an impact on how platforms protect children. But it also found that some companies are moving away from protections built in by default and towards tools that children or parents have to switch on themselves.
That is not good enough. Protecting children’s data should be the starting point, not something companies do only after the regulator intervenes.
Enforcement is both the gap and its fix
Children’s lives are deeply digital, but they cannot be expected to understand or control the vast amount of data being collected about them. And the ICO’s latest research shows that parents often have less control over their children’s online lives than they think.
The ICO has also taken enforcement action, including fines against Reddit and Imgur for failing to protect children’s data. These cases prove that the regulator can act when companies fall short, but fines should not be the end of the story. The ICO must also make clear what companies need to change and check that those changes are made across all the digital services children use.
Five years in, we need to see more enforcement. The ICO needs to be clear about what it is finding, what companies are being asked to change and whether those changes have been made. A stronger legal foundation would make that possible. That is why we are calling on the Government to put the Age Appropriate Design Code into primary legislation.
Head of UK Affairs Colette Collins-Walsh said:
“Five years ago, the UK set groundbreaking protections that changed how companies should design digital services and how we understand children’s data. The Age Appropriate Design Code was pioneering then and it remains pioneering today. Children are now growing up in a world where more and more of childhood is lived through digital services, from education and entertainment to friendships, gaming and AI, confirming the importance of the Code more than ever. But strong rules are only useful if they are properly enforced. The UK Government should put the Age Appropriate Design Code into primary legislation and make sure children get the protection it promised.”
The Children’s Code has already changed the way we think about children and technology. Other countries are following its lead. Now the UK needs to make sure it leads by example.
