1-Year Transition Period is Up
The Age-Appropriate Design Code of Practice, or Children’s Code, came into force in the UK in September 2020, with a 12-month transition period to give organizations the time to prepare. All businesses and providers of online services used by children, now need to comply. This includes apps, online games, and web and social media sites. The UK’s Information Commissioner’s Office (ICO) explains that the Code translates GDPR requirements into design standards, helping businesses understand what is expected of them. It also published a five-step guide explaining what organizations can do to comply. These steps include:
Putting children first, asking questions such as: what’s the age range of our users? How much personal data do we really need? Is it fair to use their personal data in that way? Giving children a highly private service. This means that, for example, optional use of personal data, behavioral advertising and location sharing should be switched off by default. Ensure an age-appropriate service. Even when children change default settings, the service should still be age appropriate. Advertising is to be suitable for the child’s age group. Providing age-appropriate communication. Even prompting children to check with a trusted adult before taking a certain action. Showing tools to help children take control over their data. For example, a button to download their data or a one-click solution to delete personal information.
The 12-month transition period has now come to an end. It is important to note that the Code applies to all businesses providing online services to children living in the UK. Regardless of where the company or organization is based. Thus, it’s likely to become an international benchmark. Moreover, it is not restricted to online services aimed at young people, but all services possibly used by them.
Tech Giants Stepped Up
Halfway into the transition period, industry research confirmed that the majority of businesses were aware of the Children’s Code. However, most were still in the early stages of preparation. Therefore, the ICO worked closely with the design community. To identify what further support organizations and businesses would need to conform with the code. Meanwhile, tech giants stepped up. In late July, Instagram announced several changes designed to give young people “a safer, more private experience”. These changes included default private accounts for children. Making it harder for potentially suspicious accounts to find young people. And limiting advertising options. YouTube announced similar changes in August for under 18s and people using YouTube Kids. Further, only the user and whomever they choose can see private uploads. YouTube also made “digital wellbeing features” more prominent, like bedtime reminders. Lastly, TikTok followed suit with new privacy protection tools for younger users.
Hefty Fines for Non-Compliance
Once the Children’s Code is in place, the ICO will be able to impose fines and other punishments to services that fail to build in, by design, its safety standards to protect underaged users. Violations of the Code could lead to GDPR-standard fines of up to €20 million, or 4% of a company’s annual worldwide turnover, whichever is higher. One question, however, remains unanswered: how to verify the user’s age? TikTok, for example, requires users to be at least 13 years old to use the app. Yet, despite TikTok’s policy to forbid under 13s on the video-sharing platform, 44% of 8 to 12-year-olds in the UK use TikTok. In the US, around 30% of users are between 13 and 18, but it’s relatively easy for younger users to set up an account. The ICO admits that, post 2 September 2021, the risks to children are not removed overnight (update September 2022: page removed by source). “We have identified that currently, some of the biggest risks come from social media platforms, video and music streaming sites and video gaming platforms. […] Separately, we are considering how organisations in scope of the Children’s code can tackle age assurance, whether that’s verifying ages or age estimation.” The ICO will be formally setting out its position on age assurance in autumn.
