UK Age Appropriate Design Code Implementation

Overview

The Age Appropriate Design Code (AADC), also known as the Children's Code, is a statutory code of practice issued by the UK Information Commissioner's Office (ICO) under Section 123 of the Data Protection Act 2018. It came into force on 2 September 2020 with a 12-month transition period ending 2 September 2021. The Code sets out 15 standards of age-appropriate design that information society services (ISS) likely to be accessed by children must conform to. "Children" under the Code means anyone under the age of 18 in the UK. Non-compliance does not directly create criminal liability, but the ICO takes the Code into account when assessing conformance with the UK GDPR and DPA 2018, and violations can result in enforcement action including fines of up to GBP 17.5 million or 4% of annual worldwide turnover.

Scope — Who Must Comply

The AADC applies to providers of information society services that:

1. Process personal data: The service processes the personal data of individual users
2. Are likely to be accessed by children: The service is likely to be accessed by users under 18, even if not specifically directed at children. The ICO interprets "likely to be accessed" broadly — if children form any part of the actual or foreseeable user base, the Code applies
3. Are information society services: Services normally provided for remuneration, at a distance, by electronic means, and at the individual request of a recipient. Includes apps, games, social media, streaming services, connected toys, news websites, educational platforms, and online marketplaces

Services NOT in Scope

• Services with no UK users
• Preventive or counselling services offered directly to a child
• Services that can demonstrate children do not and cannot access the service (e.g., authenticated corporate intranets)