Does your website or platform comply with the new Children’s code?
As detailed in our blog earlier this year, the transition period on compliance with the Age Appropriate Design Code – known as the Children’s Code – has now expired. Online service providers are now expected to meet the standards outlined in the Children’s Code.
What Is The Children’s Code?
The Information Commissioner explains that the code “recognise(s) and cater(s) for the fact that children warrant special protection”. It is specifically designed to give children a greater understanding and level of control over their use of personal data, as well as protecting them from potentially abusive conduct by online service providers. It creates 15 standards that online service providers should meet in their business dealings with children and sets a ‘safe as standard’ starting position.
Why Is It Necessary?
Children of the digital age rely on the internet for education, interaction with their peers, fun and knowledge – it is intrinsic to growing up in today’s world. While their reliance grows, so to have concerns that the digital space is not suitable, nor designed for them. Statistics show that 20% of internet users are children and the Children’s Code aims to create a safer space for children to “learn, explore and play”.
Who Does The Children’s Code Apply To?
This Children’s Code is for providers of information society services (ISS). Broadly speaking, it applies to all online services used or likely to be used by children in the UK. This includes apps, programs, websites, games or community environments, and connected toys or devices. The Children’s Code applies to both domestic and international businesses.
Who Is A Child Under The Children’s Code?
A child is defined as anyone under the age of 18 and so the scope is far broader than most would expect. For example, mid-teens are very often managing their money online, using online resources for education and using it as a social tool. This shouldn’t be confused with the legal age of consent for processing their personal data which is 13 in the UK.
What Should Online Services Do To Comply?
The first step for online service providers will be to know their legal obligations and whether they are currently non-compliant with the Children’s Code. Practically, they must also understand their customer base and whether they a) process children’s data or b) have children use their service. They must also understand the applicable age groups due to differing levels of expectation. This process must be documented and is something our specialist team of Data Protection advisers can help with.
Once you have established that the Children’s Code applies to you, you must undertake a Data Protection Impact Assessment and take steps to meet your obligations under the 15 standards. This will involve looking at everything from policies, design and your contracts with any processors or sub-processors to adopt necessary changes.
What Happens If You Fail To Meet The Standards?
The widely reported fine imposed on TikTok demonstrates what can happen when standards are not met. In this case, Tik Tok were found to have breached their legal requirements under both GDPR and US privacy laws which led to significant fines and subsequent changes to their platform. Many of these changes align with the requirements under the Children’s Code and, for under 16s, include:
- Private accounts as a default;
- A ‘friends only’ comment limitation;
- Changes to the algorithm to prevent under 16s profiles being suggested as friends to other users;
- Restrictions on ‘stitch’ and ‘duet’ features;
- Restrictions on Push notifications after 9 pm; and
- Restrictions to direct messaging or livestream hosting.
There are also some lighter touch changes that apply to users aged 16-17.
Whilst the Children’s Code itself is not law, the Information Commissioner’s Office will take this Code into account, along with other relevant legislation, when considering whether you have complied with data protection laws. The Code can also be used in evidence in court proceedings, and the courts must take its provisions into account wherever relevant. If you do not meet the requirements under the legislation, you are at risk of sizable fines under the Information Commissioner’s enforcement powers and potential civil action.
Taking The Next Steps To Comply With The Children’s Code
If you suspect that children under the age of 18 use your online service and you have not yet taken steps to comply with the Children’s Code, it is not too late to make a start. For many online services, necessary changes will likely require significant design, development and management time, so we would recommend organisations take action now. Non-compliance will no longer be an option.