One year on: The ICO’s Children’s Code and its impact on business

The ICO recently marked the anniversary of the Children’s Code by confirming that ‘Children are better protected online in 2022 than they were in 2021’. The Children’s Code, which came into force in September 2021, asks for online services, like websites, applications, and games, to offer improved privacy protections for children, guaranteeing their personal information is safe in the digital age. 

Perhaps to demonstrate how seriously the ICO takes Children’s online privacy, they are currently undertaking a review of how over 50 different online services are conforming to the Children’s Code. Four investigations are ongoing, and nine organisations have been audited with their outcomes being assessed.

This announcement comes in the wake of news that the Irish regulator has fined Instagram €405m for failing to safeguard children’s information.

The ICO says ‘If your service is not aimed at children but is not inappropriate for them to use either, then your focus should be on assessing how appealing your service will be to them. If the nature, content or presentation of your service makes you think that children will want to use it, then you should conform to the standards in this code.’ 

Our senior data protection and privacy solicitors, Becky White, explains: 

This means that businesses who don’t necessarily operate a child focused service could be caught by the requirements of the Children’s Code and may need to consider their approach to compliance. Organisations should assess how appealing their services are to children and take appropriate action. One option is to implement appropriate age assurance measures, such as confirming date of birth, to minimise the risk of children accessing the service, however careful consideration should be given to this approach as age-assurance tools are still a developing area.

‘The recent announcement that the ICO are investigating how organisations are conforming to the code could mean they’re gearing up to hand out enforcement orders and fines. This is a wake-up call for any businesses who are unsure if the code applies to them to check they have suitable safeguards in place.’

Understanding your responsibilities under UK GDPR and the Children’s code can be tricky but our team of expert data protection solicitors can demystify this, removing the legalese and guiding you through what you need to do to be compliant. To get a clear view of your compliance needs we offer a data protection health check.