United Kingdom. Children's privacy. Statutory code of practice
AADC / Children's CodeAge Appropriate Design Code (Children's Code) – statutory code of practice under s.123 Data Protection Act 2018
Partly verified
Medium confidence.Dates from ICO publication history; not individually re-verified this session.
§1Summary
- Synopsis
Sets 15 standards that online services likely to be accessed by under-18s must meet when processing children's data, such as high-privacy defaults, minimised data collection, no nudge techniques and geolocation off by default. Courts and the ICO must take it into account when applying UK GDPR and PECR.
- Key themes
- Unique features
Applies to services 'likely to be accessed' by children, not only child-directed ones, and covers all under-18s; it became a global template (e.g. California AADC).
- SaaS relevance
Relevant to consumer-facing or education SaaS likely to be used by under-18s in the UK; B2B tools are usually out of scope unless children are end users.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- See UK GDPR
- Cross-border transfers
- See UK GDPR
- Maximum penalty
- Enforced via UK GDPR: £17.5m or 4% turnover
§3Dates
- Key dates
- Adopted
- In force
- In force 2020-09-02 with 12-month transition; conformance expected from 2021-09-02; DUAA 2025 adds a statutory 'children's higher protection matters' duty for information society services
§4Text and authority
- Text
- Authoritative text ico.org.uk
- Authority
- Information Commissioner's Office (ICO)
§5Where it applies
- Domestic law of
- United Kingdom
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Dates from ICO publication history; not individually re-verified this session.