The Children’s Code – the ICO’s ongoing review of compliance
11 social media and video-sharing platforms put on notice by the ICO, to improve children’s online privacy.
In November 2023 we wrote about TikTok’s GDPR fine that it was issued by the Irish Data Protection Commission, for its handling practices of the personal data of minors. The focus on children’s privacy continues with the Information Commissioners Office’s (ICO) putting 11 social media platforms (SMP’s) and video-sharing platforms (VSPs) on notice to improve children’s privacy when using their services.
Their ongoing review of a mixture of 34 new and established providers of SMPs and VSPs, found that 11 platforms had privacy issues relating to default privacy settings, geolocation, and age assurance and some other platform’s targeted advertising approach was not compliant with both the law and the code.
Emily Keen, Deputy Commissioner said:
“There is no excuse for online services likely to be accessed by children to have poor privacy practices. Where organisations fail to protect children’s personal information, we will step in and take action.
“Online services and platforms have a duty of care to children. Poorly designed products and services can leave children at risk of serious harm from abuse, bullying and even loss of control of their personal information.”
These SMPs and VSPs now must explain to the ICO, how their approach to children’s privacy conforms with the code. If the ICO are not satisfied with the responses from these platforms, they risk enforcement action or fines.
What is The Children’s Code?
The Children’s Code, (the informal name for the ICO’s Age Appropriate Design Code), is a set of 15 flexible standards that online services need to follow. Its purpose is to protect children’s digital privacy in this ever-changing digital world whilst balancing the need for children and young people to have the best access possible to the internet.
What are the risks to children?
In August this year, the ICO reported that it had asked the SMPs and VSPs to explain how their approach to default privacy settings, geolocation and age assurance complies with the Code. Below are some of the risks to children that arise from poor implementation of The Code, and not fully assessing the risks to children:
Default Privacy Settings Risks:
Default settings must be “high privacy” by default meaning the child does not need to activate privacy settings when first using a service. This minimises the risk of other service users seeing a child’s personal data, or third parties using children’s personal data without consent.
Geolocation Data Risks:
Geolocation data means data taken from the child’s device which indicates the geographical location of the device. The risks associated with platforms not switching off geolocation services by default means a child’s physical location could be tracked and could make children vulnerable to abduction, physical and mental abuse or trafficking.
Age Assurance Risks:
Companies should “take a risk-based approach to recognising the age of individual users” and implement measures to establish the age of a user. Where a business cannot achieve a level of certainty over its users’ ages, the ICO advises to “apply the standards in the code to all users”. This means children will still receive some important protections in how their personal data is used and the content they have access to if they have lied about their age.
Without appropriate age assurance/identification processes in place, SMPs and VSPs face risks such as children accessing information or content that is not appropriate for their age therefore exposing children to possible harmful content.
As technology continues to evolve, so too must an organisation’s approaches to safeguarding the privacy of the most vulnerable online users.
If you need support in meeting the requirements of the Children’s Code, we’re here to help. From DPIA assessments to identifying risks to implementing age-appropriate design, we can help you every step of the way. Get in touch today.
