What is the Children's code, and who does it apply to?

What it is

The code was issued under DPA 2018 s.123 and has applied since 2021-09-02. Its standards include acting in the best interests of the child, high privacy by default, data minimisation, switching geolocation and profiling off by default, no nudge techniques, and age-appropriate application. The DUAA 2025 reinforced it with a duty to account for children's higher protection matters in data protection by design from 2026-02-05. Separately, a child must be 13 to consent to an online service on their own.

When it applies

• You provide an information society service, such as an app, website, game or connected toy, that is likely to be accessed by children in the UK. DPA 2018 s.123
• You rely on consent for an online service offered directly to a child under 13: you need a parent's consent. UK GDPR Art 8; DPA 2018 s.9

When it does not

• Services that children are not likely to access in practice, which you can show with evidence.
• Preventive or counselling services offered directly to children are excluded from the parental consent rule. DPA 2018 s.9(b)

Who is responsible

The provider of the online service as controller.

What it involves

1. Assess whether children are likely to access the service.
2. Complete a DPIA covering children's risks.
3. Apply the 15 standards, starting with high-privacy defaults.
4. Assess age with a method proportionate to the risk.
5. Review regularly.

If it goes wrong

Regulatory

The code is evidence of what the law requires: failing to meet it will count against you in enforcement under Arts 5, 8, 25 and 35. Penalties follow the UK GDPR tiers.

Criminal

No offence.

Civil

Courts must take the code into account in any compensation claim under Art 82.