The UK privacy regulator – the Information Commissioner’s Office (ICO) – has published the final version of its Age Appropriate Design Code of Practice for designers, developers, and operators of digital services aimed to be used by children.
The ICO requires that services provide greater protection of children’s personal data by default, stating, for instance, that location and profiling features in the service should be turned off by default. The code also prohibits using nudge techniques to lead or encourage children to provide unnecessary personal data or weaken their privacy protections.
The ICO emphasizes that the principle of data minimization is particularly important when collecting personal data of children and prohibits disclosing or sharing children’s data unless a compelling reason to do so can be demonstrated.
The code is pending approval by the British Parliament and will come into effect 12 months thereafter.