What is children's code and what it means for us (part i)

September 20, 2021

The much-awaited Children's Code from the UK ICO is in full force from September 2021. What is it about? What difference can we expect? And what should you do if you are an innovator building technologies for children or a parent who would like to look out for your child?

Here is a series of reflections and interpretations from me, based on a range of available resources, and many years of academic research on creating 'good' designs for children.

What is the Children's Code is about?

The Age Appropriate Design Code (Children's Code) is a piece of ground-breaking legislation that came into force in the UK on September 2, 2021. It requires the `tech sector to protect children's privacy, safety, and wellbeing in products and services likely to be accessed by children and young people under 18' [5Rights].

If you are new to Children's Code, ICO's video provides an excellent starting point for this: here.

The Code provides a set of 15 technology-neutral design principles to ensure children's best interests and encourage the provision of age-appropriate digital services for children, which can include apps, online games, websites like social media, or connected toys. These 15 codes provide a comprehensive consideration and protection for children. However, these 15 codes can be daunting to start with.

As an academic, I have found the `self-assessment' tool produced by the ICO a great starting point for designers or even parents, who want to learn more about what exactly these 15 codes are about. In this post, I will go through the considerations raised in the `self-assessment' tool for each of the 15 codes and draw real-world examples to show what the implementation of each code can mean for children or what `existing bad' practices a designer/parent should look out for.

The Children's Code has avoided introducing any grouping or hierarchy amongst the codes so that we do not lose the specific considerations carefully put into each of these 15 codes. The presentation below is for convenience, instead of a suggestion of a new organisation of the code.

1. Protect children's best interest

The best interests of the child should be a primary consideration for online services likely to be accessed by a child. Here, the best interest of children should be considered in the following aspects, including

1.1 Establishing accountability for data protection and children's privacy within the organisation by setting up a dedicated management team to oversee this issue. Without it, children will likely experience digital services failing to adhere to terms and conditions and community policies.

1.2 Ensuring sufficient data protection training amongst staff, without which can likely lead to failures to follow privacy by designs.

1.3 Commercial interests of an organisation should not overweight a child's best interest. Apart from putting children's best interest as the primary consideration during the design process, designers could take actions to restrict the use of non-essential cookies, which may be used to further commercial interests.

1.4 Data-enabled physical and mental harms should never take place and nothing should overweight children's safety. Organisations should commission regular reviews of their services by a child safety expert and implement their expert recommendations. They should also carry out a documented consideration of how to protect and support child users of their services.

2. Data Protection Impact Analysis (DPIA)

The DPIA should take into account differing ages, capacities, and development needs of the children who are likely to access a service. Data protection should be built at the start of the design. If applicable, individuals (parents and children) and relevant experts, as well as the Data Protection Officer (DPO) should all be consulted at this stage.

Without a DPIA at the start of the design or involvement of stakeholders, services would miss a chance to understand child-specific needs, concerns, and expectations, and build trust with their stakeholders.

3. Age Appropriate Application

The code recommends the services be designed appropriately to children's age, and services should establish their users' age with a level of certainty and apply appropriate risk mitigation; and if they can't achieve that, then they should apply the standards in this code to all their users.

Age inappropriate services can expose children to inappropriate content, approached by inappropriate online users, or mental or physical harm inappropriate to their age. Establishing an understanding of the `age group' of a platform's users is a critical first step towards age-appropriate designs. Designers could look into emerging services to assist them in establishing the age of their users, or conducting regular user surveys to confirm the age range of their users.

The remaining codes provide further specific guidance regarding what an `age-appropriate' design may mean for children.

4. Transparency

Service providers are expected to provide clear privacy information and ‘bite-sized’ explanations at the point at which the use of personal data is activated. The code provides a series of age range breakdowns and recommendations for designers to consider, including 0-5, 6-9, 10-12, 13-15, and 16-17. Thus, it is essential for providers to establish the age range of their users, and apply age-appropriate privacy notice accordingly.

There are various degrees of `lack of transparency' in the current digital services accessed by children, ranging from presenting the collection of data in terms that are challenging for children or their parents/guardians to comprehend, providing a one-size-fits-all approach to transparency, to collecting and processing of children's data for different purposes with informing them in any explicit ways. Recognising this failure to support children's best interests and different needs is reflected and consequentially supported by the code of `transparency'.

The ICO's summary report on "Designing data transparency for children -- Insights from the Children’s Code transparency champions open call (June 2021)" provides a glance of possible directions for realising transparency for children. There are plenty of innovative design options presented here, although standard design guidance is still being developed by drawing together the industry and academia.

[To be continued]