The Information Commissioner’s Office (ICO) announced on August 2, 2024 that it is putting on notice several major social media and video-sharing platforms to improve their handling of children's data privacy, following an ICO investigation that highlighted various areas of non-compliance with the UK’s Age Appropriate Design Code, also known as the Children's Code, for 11 out of 34 social media platforms (SMPs) and video sharing platforms (VSPs) as part of the ICO’s Children’s Code Strategy.
The investigation found issues related to transparency, data protection measures, and the use of algorithms that could expose children to inappropriate content, which has highlighted a need for these platforms to align with the standards set out in the Children's Code, which requires prioritizing the best interests of child users, the ICO has emphasized.
Emily Keaney, Deputy Commissioner, made the following statement:
There is no excuse for online services likely to be accessed by children to have poor privacy practices. Where organisations fail to protect children’s personal information, we will step in and take action. Online services and platforms have a duty of care to children. Poorly designed products and services can leave children at risk of serious harm from abuse, bullying and even loss of control of their personal information.
The "Age Appropriate Design Code" outlines standards for protecting children's data online and emphasizes that online services likely to be accessed by children must prioritize their best interests, offering high privacy by default, minimizing data collection, and avoiding harmful practices like profiling or using "nudge" techniques to encourage data sharing.
The Code applies to various online services, including apps, games, and websites, and requires companies to conduct Data Protection Impact Assessments (DPIAs) to evaluate and mitigate risks to children’s data.
In addition to this, the Code aligns with the UN Convention on the Rights of the Child and serves as a guideline to ensure compliance with GDPR and the UK's Data Protection Act 2018, and includes 15 standards designed to protect children's privacy and data online, as follows:
The ICO has also clarified that the 11 SMPs and VSPs could face enforcement actions if they fail to make the necessary changes.