The ICO Children’s Code: The Scope, Standards and Compliance
Update: October 2026
The Children’s Code, formerly the Age Appropriate Design Code, is the ICO’s statutory code of practice for online services that children are likely to use. It applies to apps, games, connected toys, social media, streaming and many ordinary websites, whether or not the service is aimed at children.
The code took effect on 2 September 2020, and organisations had to comply from 2 September 2021. This guide covers who it applies to, the 15 standards, how to decide whether children are likely to access your service, and where the ICO is focusing its work now.
Key Takeaways
• The Children’s Code contains 15 standards for information society services likely to be accessed by children under 18. It applies to UK companies and to non-UK companies that process the personal data of UK children, and it covers services that are not aimed at children.
• The standards include high privacy settings by default, data minimisation, geolocation off by default, no nudge techniques, profiling off by default and a data protection impact assessment. Age assurance has to match the risks of the processing, or the standards apply to all users.
• The ICO’s August 2026 progress update reports commitments from Snapchat on age assurance, an open letter to platforms on age assurance and a new review of mobile gaming. The ICO states that data protection duties apply irrespective of any minimum age or service restriction.
The Code Covers Services Children Are Likely to Use
The code applies to information society services (ISS) likely to be accessed by children. An ISS is any service normally provided for remuneration, at a distance, by electronic means and at the individual request of the user. The ICO says most for-profit online services meet that definition, including apps, search engines, social media platforms, messaging services, online marketplaces, streaming services, online games and news or educational websites. The code also covers apps that control connected toys and devices.
The code does not limit itself to UK-based companies. The ICO confirms it applies to non-UK companies that process UK children’s personal data.
Schools are outside the code because they are not an ISS. The ICO’s introduction explains that the provider of an edtech service used in schools may still be in scope, and that schools should treat the 15 standards as good practice. Public authorities that provide a non-commercial online public service are not a relevant ISS either.
The 15 Standards Cover Design, Data and Defaults
The ICO’s code lists these standards:
The code groups them as follows. Governance and design: best interests of the child, data protection impact assessments, age-appropriate application, detrimental use of data, and policies and community standards. Transparency and defaults: transparency, default settings, data minimisation and data sharing. Features and controls: geolocation, parental controls, profiling, nudge techniques, connected toys and devices, and online tools for children’s rights.
The code calls the standards cumulative and interlinked, and says you must implement all of them to the extent they are relevant to your service. The ICO describes them as flexible: they don’t ban or prescribe specific designs, and the code calls for a proportionate, risk-based approach.
Default Settings and Data Minimisation Shape the Service
Standard 7 requires settings to be high-privacy by default, unless you can demonstrate a compelling reason for a different default that accounts for the best interests of the child. Standard 8 requires you to collect and retain only the minimum personal data needed for the elements of the service in which a child is actively and knowingly engaged, and to give children separate choices over which elements they switch on.
Standard 9 says not to disclose children’s data unless you can demonstrate a compelling reason, again taking account of the child’s best interests. Standard 10 requires geolocation options to be off by default and an obvious sign when location tracking is active. Options that make a child’s location visible to others must default back to off at the end of each session.
Profiling and Nudge Techniques Face Tight Limits
Standard 12 requires profiling options to be off by default, unless you can demonstrate a compelling reason. Profiling is allowed only with measures to protect the child from harmful effects, particularly being fed content that harms health or wellbeing.
Standard 13 prohibits nudge techniques that lead or encourage children to provide unnecessary personal data or to weaken or turn off their privacy protections. Standard 5 prohibits using children’s data in ways shown to be detrimental to their wellbeing, or that go against industry codes, other regulatory provisions, or Government advice.
Transparency Has to Fit the Child’s Age
Standard 4 asks for privacy information, terms, policies, and community standards that are concise, prominent, and in clear language suited to the child’s age. It also asks for bite-sized explanations at the point where a use of data is activated. Standard 6 requires you to uphold your own published terms, policies and community standards, including age restrictions and behaviour rules. A rule you publish and do not enforce counts against you.
Standard 15 requires prominent, accessible tools that help children exercise their data protection rights and report concerns. Our guide to children’s data under GDPR covers consent, parental authorisation and children’s rights in more depth.
Age Assurance Must Match the Risk
Standard 3 requires a risk-based approach to recognising individual users’ ages. You either establish age with a level of certainty appropriate to the risks that arise from your processing, or you apply the standards to all users.
The ICO has published a Commissioner’s Opinion on age assurance for the Children’s Code, and its likely-to-be-accessed guidance says that self-declaration will not be sufficient to demonstrate that children cannot access a service. For services children should not use, the ICO’s guidance sets out two options: apply the code’s principles to all users in a risk-based, proportionate way, or apply age assurance appropriate to the risks and restrict access by under-18s so they are no longer likely to use the service.
A Documented Assessment Shows Whether Children Are Likely to Use You
The code applies where children form a substantive and identifiable user group. The ICO’s guidance says a service is in scope when a significant number of children are likely to access it, and that a significant number means more than a de minimis or insignificant number. It has not set a numerical threshold. A terms-of-service line saying under-18s should not use the service does not remove you from scope when children use it.
The ICO lists factors to weigh: whether children can access the service; the number of child users; research on user behaviour; advertising aimed at children; complaints; content and design features that appeal to children; whether children use similar services; and your business model and how you market the service. Record the decision and keep it under review, since evidence of child users can emerge later.
A data protection impact assessment is part of this. The ICO states that you must carry out a DPIA if you offer online services to children, and standard 2 asks you to take account of differing ages, capacities and development needs.
The ICO Is Enforcing the Code on Platforms and Gaming
The ICO launched its Children’s Code strategy in April 2024, starting with social media and video sharing platforms. Its August 2026 progress update reports Snapchat’s commitment to strengthen age assurance. It also reports an open letter to social media and video sharing platforms on age assurance, improvements to location features on Snapchat and Instagram, a review of children’s privacy in mobile gaming and risk reviews of 14 age assurance providers.
The update notes the government’s announced proposals to ban certain social media platforms from offering their services to under-16s through amendments to the Online Safety Act. The ICO says data protection obligations apply regardless of any minimum age or service restriction, so the code still matters for services affected by those proposals.
The ICO also updated its Children and the UK GDPR guidance on 15 May 2026 to reflect the Data (Use and Access) Act 2025, with clearer signposting to the requirements for services likely to be accessed by children and new case examples.
A Self-Check Puts the Standards Into Practice
Start with the assessment above and record it. If children are likely to use the service, map the personal data you collect from them and complete the DPIA. Then work through the standards against each feature: default settings, geolocation, profiling, third-party sharing, ad tracking, notifications and any design that rewards sharing more data.
Test the age assurance route you chose against the risk, and check that your published terms match what you enforce. Review the privacy notice with the youngest likely user in mind. The ICO offers a self-assessment risk toolkit and DPIA templates, including examples for online retail, connected toys and mobile apps.
Consent also needs attention. Where you rely on it, our guide to valid consent under GDPR applies, along with the additional age rules for children. GDPRLocal helps organisations run children’s code assessments, DPIAs and age assurance reviews. See our GDPR consultant services.
Conclusion
The Children’s Code applies to far more services than those built for children. Any online service that a significant number of children use falls under its 15 standards, and the ICO treats conformity as a key measure of compliance with data protection law.
The ICO’s 2026 activity shows a regulator working through platforms, age assurance providers and mobile games. A recorded likely-to-be-accessed decision, a current DPIA and settings that default to high privacy give an organisation the evidence it will be asked for.
Frequently Asked Questions
Who Does the Children’s Code Apply To?
It applies to information society services likely to be accessed by children under 18, including apps, games, social media, streaming services and connected toy apps. It covers UK companies and non-UK companies that process the personal data of UK children, and services not aimed at children.
Does the Children’s Code Apply to an Adult-Only Service?
It can. If a significant number of children use the service, the code applies even where your terms say under 18s must not use it. You can either apply the code’s principles to all users or use age assurance appropriate to the risks and restrict access for under-18s.
Is the Children’s Code a Law?
It is a statutory code of practice required by the Data Protection Act 2018. The ICO describes it as a set of standards that explains how data protection law applies to children’s use of online services, and says it sets no new law. The ICO takes the code into account when it assesses whether an organisation complies with the UK GDPR and PECR.
Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.
About the Author
Head of Commercial & Country Manager
Zlatko Delev is Head of Commercial and Country Manager at GDPRLocal, where he leads the company’s commercial strategy and market presence. He brings international experience across sales, marketing, and customer success, along with a legal background from his studies at Iustinianus Primus Law School in Skopje, Macedonia.
Zlatko sits at the front line of GDPRLocal’s client relationships, guiding organisations through the first stages of their compliance journey and helping them understand where they stand and where they need to go on GDPR, information security, and the emerging landscape of AI regulation. His role bridges commercial strategy with practical data protection knowledge, ensuring clients get clear, actionable direction from their very first conversation with GDPRLocal.
Alongside his commercial focus, Zlatko has trained extensively in project management and organisational leadership, including risk management, stakeholder communication, agile methodology, and digital marketing, a broad skill set that supports his structured, delivery-focused approach to growing GDPRLocal’s business internationally.