UK GDPR Children's Code

Check whether the service is an information society service: a service normally provided for remuneration, at a distance, by electronic means, at the individual request of a recipient. Most for-profit online services meet that definition. Then assess whether the service is likely to be accessed by children under 18 in the UK, not merely whether the product is marketed to them.

Use evidence about the nature and presentation of the service, appeal to children, actual audience, comparable services, marketing, user research, and the effectiveness of access restrictions. If the service is unsuitable for children and reliable controls prevent their access, document that conclusion. If evidence later shows a substantive child audience, revisit the assessment and either conform to the code or improve the restriction.

The statutory scope excludes a general broadcast that is not provided at an individual's request and a preventive or counselling service, such as an online health screening or counselling service, offered specifically to children. An on-demand element of a broader broadcast and a general health, fitness, or well-being service can still be covered. The code came into force on 2 September 2020, and its 12-month transition ended on 2 September 2021, so an in-scope service should conform now.

Treat the child's best interests as a primary consideration and complete a DPIA that assesses differing ages, capacities, and risks. Apply the code in a risk-based and proportionate way, but do not use proportionality to remove the substance of a standard.

The 15 standards cover: best interests; DPIAs; age-appropriate application; transparency; detrimental use of data; policies and community standards; high-privacy default settings; data minimisation; data sharing; geolocation; parental controls; profiling; nudge techniques; connected toys and devices; and online tools that let children exercise rights or report concerns.

Keep the scope and age-range assessment, child-focused DPIA, design decisions against all 15 standards, user research, notices, settings, age-assurance reasoning, testing, parental-control behaviour, profiling logic, sharing map, geolocation controls, retention, and rights routes. Evidence should match the released product on each supported platform.

Review after new features, material interface changes, new profiling or sharing, changed age-assurance methods, a shift in the child audience, complaints, incidents, or evidence that a control does not work as intended.