It has long been recognised that children are being ‘datafied’ by companies and organisations that record many thousands of data points about them as they grow up. These can range from details about their mood and their friendships to what time they woke up and when they went to bed. As a case in point, it is alleged that TikTok quietly collects “voiceprints” and “face geometry scans” to recommend content based on the users’ age, race and physical attractiveness. Moreover, in many instances, this data, including data relating to minors, is sent to servers located in China.
The UK Parliament recognised the need to safeguard children, and required the Information Commissioner, under section 125(1)(b) of the Data Protection Act 2018, to produce an Age Appropriate Design Code. This Code (also known as ‘The Children’s Code’) came into force on 2 September 2020, with a 12-month transition period.
It applies to organisations providing social media and online services and products likely to be accessed by children up to age 18.
The Children’s Code sets out 15 standards for designers of online services and products relative to how they should comply with data protection law. In essence, the Code will require digital service companies to automatically provide children with a built-in baseline of data protection whenever they download a new app, game, or visit a website. The focus is on providing default settings which ensures that children have the best possible access to online services whilst minimising data collection and use, by default. The Code seeks to protect children within the digital world, not protect them from it.
The Code breaks new ground as regulatory guidance focused on a ‘by design approach’ (as required by Article 25 of the GDPR), and is a huge step towards protecting children online, especially given the increased reliance on online services at home during COVID-19.
The ICO’s code gives organisations a year to make the necessary changes to put children’s privacy at the heart of their design. However, we are sensing, that many companies and organisations are oblivious to the launch of this new Code, which means that few will be applying the standards by 2 September 2021!
Please contact us for further advice should this new Code have a relevance to your current or future business activities.
