The UK Children's Code: the design code the world is copying

Scope note: plain-language guidance, not legal advice. The Code is a UK instrument, but it has become the template jurisdictions copy — including Australia's incoming Children's Online Privacy Code — which is why non-UK educators keep meeting its ideas.

The Age Appropriate Design Code (the "Children's Code"), issued by the UK Information Commissioner's Office under the Data Protection Act 2018 and in force from September 2020 (with a year's transition), did something genuinely new: instead of regulating what services may do with children's data after collecting it, it regulates how services must be designed in the first place. It's a statutory code of practice — not itself an Act, but the ICO applies UK GDPR through it, which gives it teeth.

The two moves that made it matter

1. "Likely to be accessed by children." The Code doesn't apply only to services aimed at children (the old COPPA-style trigger) — it applies to any online service likely to be accessed by under-18s. That single phrase swept in mainstream platforms that had long claimed to be for adults while hosting millions of children, and it's the design choice successor codes keep copying.

2. Best interests + high-privacy defaults. The Code's spine is the child's best interests (imported from the UN Convention on the Rights of the Child) operationalized as defaults: privacy settings high by default, geolocation off by default, profiling off by default, data minimisation as a duty, and no nudge techniques steering children toward weaker privacy. The burden flips: the service must justify each collection, not the child each refusal.

The fifteen standards, compressed

Best interests of the child · age-appropriate application (know your audience's ages or apply the code to all) · transparency children can understand · no detrimental use of data · policies you actually uphold · defaults: high privacy · data minimisation · no unjustified data sharing · geolocation off by default · parental controls disclosed to the child (a quietly radical standard — surveillance must announce itself) · no profiling by default · no nudge techniques toward weaker privacy · connected toys covered · online tools for children to exercise rights · DPIAs (risk assessments) for anything likely accessed by children.

For teachers, three of these do most of the evaluative work: minimisation (the same principle as APP 3 and COPPA §312.7 — collect only what the function needs), high-privacy defaults (a child should not need to find a settings maze to be private — we teach children to beat those mazes, and the Code's answer is that they shouldn't exist), and no nudging — which reads as a direct description of the glitter-button consent patterns the ad-funded web runs on.

Its visible effects, and its export

The Code's arrival coincided with a wave of real product changes for minors on major platforms — defaulted-private accounts, disabled targeted advertising for under-18s, autoplay and notification changes — visible worldwide because platforms rarely fork their products per jurisdiction. Legislatively it became the template: California's Age-Appropriate Design Code Act (2022; enforcement entangled in US constitutional litigation, itself instructive), and Australia's Children's Online Privacy Code now in development under the 2024 Privacy Act amendments. For an Australian school, that's the practical relevance: evaluating tools against the UK Code today is a preview of your own regulatory direction.

What the Code doesn't do

It doesn't ban data collection from children — it demands justification, minimisation, and honest defaults.
It doesn't verify ages by itself — age assurance remains the hard, contested implementation problem.
It doesn't reach every service equally in practice; enforcement is the perennial question for codes of practice everywhere.

Using it as an evaluation lens

Add three Code-flavored questions to the eleven: Are defaults high-privacy, or does safety require configuration? Is there any profiling of children, and can it be justified as in their best interests? Do the interface patterns nudge children toward sharing (streaks that punish absence, prompts that shame refusal)? A product built on zero-PII architecture answers all three structurally — nothing to profile, nothing to default, nothing to nudge toward — which is the design bar the Code is slowly making normal.

Reference

UK Information Commissioner's Office (2020). Age Appropriate Design Code: a code of practice for online services (under s.123, Data Protection Act 2018).
UN Convention on the Rights of the Child, Art. 3 (best interests) — the Code's imported spine.
California Age-Appropriate Design Code Act (2022) and subsequent litigation — the export's contested US chapter.
Privacy and Other Legislation Amendment Act 2024 (Cth) — Australia's code-development mandate.

© Glu IO Pty. Ltd. — Wiz Kids (wiz.kids). Link freely; republication requires permission — see terms. Found an error in our reading of the research? We correct fast: tell any teacher piloting Wiz Kids.