The Children’s Code – Changes to How Online Services Use and Protect Children’s Personal Data

On 2 September 2021, the Children’s Code commissioned by the ICO came fully into force. It is a data protection code of practice for online services, such as apps, online games, and social media sites which are likely to be accessed by children. The Children’s Code is intended to create a better internet for children by ensuring online services that are likely to be accessed by children, respect a child’s rights and freedoms when using their personal data.

The ICO identified that some of the biggest risks currently come from video gaming, social media, and video and music streaming platforms. On these platforms, it was found that children’s personal data was being used and shared to bombard them with specific content and personalised service features which included inappropriate adverts; unsolicited messages and friend requests; and privacy-eroding nudges urging children to stay online. This raised alarm bells for a number of potential harms that could be created as a result of this data use, which could include physical, emotional and psychological, or even financial harm.

It is important that children’s rights must be respected and the Children’s Code clarifies how online services can and must use children’s data in line with the applicable law. The introduction of the Code means that organisations are expected to prove that the children’s best interests are a primary concern and will require them to inform the ICO of how their services are designed in line with the Code. In turn, the ICO will identify areas where intervention is needed.

What Has Changed?

Coincidentally, many online platforms have made or unveiled changes just days before the Children’s Code actually came into force.

For example, Google has promised in the coming months that for users under the age of 18 (anywhere in the world) it will block targeted advertising based on their age, gender, or interests, and will turn off its ‘location history’ account setting.

Instagram has also taken the decision to make all accounts of people under the age of 16 private by default, and improved algorithms which will protect them from unwanted contacts and any ‘potentially suspicious behaviour’. These changes have also limited how advertisers can target its underage users.

The popular video-sharing app, ‘TikTok’, has also introduced features such as allowing parents to “pair” their device with their child’s device in order to control privacy, searching, content, and more, remotely from the parent device.

The ICO itself has said that these recent changes by Facebook, Google, Instagram, and TikTok have shown a clear impact since the introduction of the Children’s Code.

UK Perspective

The Children’s Code includes 15 principles, ranging from default settings and geolocation, to parental controls and profiling. According to the ICO, if companies do not comply with the Code, they are probably breaking the UK versions of the EU’s General Data Protection Regulation, or the e-Privacy Directive.

One provision in the Code will oblige services to have data protection impact assessments in place and be able to show accountability under the UK General Data Protection Regulation.

Interestingly, though, it is not expected that all online services will have implemented an age barrier straight away and because of this, the ICO has suggested that it will show flexibility over checking compliance in the Children’s Code in its early stages.

Also, in the limelight for autumn 2021 is the Online Safety Bill which will be up for parliamentary debate from early September 2021. The Bill will regulate harmful content on platforms and has a particular focus on protecting children.

The ICO has confirmed it is committed to working with other regulators through the Digital Regulation Cooperation Forum which will help ensure that there is consistency between the Children’s Code and incoming online safety laws which will jointly protect children online.

Ultimately the Children’s Code will help revolutionise industries to ensure that the best interests of the child are of primary concern online and that this is implemented from the start. It is hoped that this will help grow the trust between online platforms, children, parents and society.

For legal advice on a data protection matter whether from the perspective of a business or as an individual, please contact our data protection experts at Farleys on 0845 287 0939 or send your enquiry by email and we will get in touch with you.