The UK told online services to default to child privacy

The short answer

Since September 2021, any online service likely to be used by children in the UK has had to meet fifteen design standards or be able to explain why it does not need to. If you have noticed a game or app asking a child's age before switching off targeted adverts, or setting a new account's profile to private by default, that is very likely a service responding to this code, not a company being unusually cautious on its own initiative.

What the evidence says

The Age Appropriate Design Code, usually called the Children's Code, is a statutory code of practice made by the UK's data protection regulator, the Information Commissioner's Office. It was laid before Parliament on 11 June 2020 and formally issued on 12 August 2020, as the code's own account of its passage records, and it came into force on 2 September 2020. Because the code sets new expectations for products that already existed, the regulator allowed what its transitional arrangements guidance calls the maximum transition period of twelve months, so full conformance was expected from 2 September 2021. The code applies to information society services likely to be accessed by children, a deliberately broad test covering apps, games, search engines, social media and connected toys, whether or not they are designed for children. Its fifteen standards require, among other things, that the best interests of the child be a primary consideration, that privacy settings default to high, that profiling be off by default, that nudge techniques not steer children toward weaker privacy choices, and that geolocation be off by default.

For context

The code does not create new criminal offences or ban any content outright. It works through existing UK data protection law, so the regulator's leverage is enforcement of data protection obligations rather than content removal. Nor does the code verify a child's age; it requires a service to make a reasonable, risk-based judgement about whether children are likely to use it. Reports of large platforms switching youth accounts to private around 2021 coincided with the code's deadline, though the code itself names no company, and other pressures, including similar rules developing elsewhere, were in play at the same time.

A practical next step

You could open a new account on a platform your child uses and check whether it defaults to a private profile, off geolocation and no targeted advertising, since these are the settings the code specifically expects.

• Does this service ask for age in a way that changes what a child sees, or is age just a checkbox?
• Are the strongest privacy settings the default, or does a family have to find and switch them on?
• If a setting looks weak, is that a gap in the code's coverage or a service that has not yet conformed?

The Children's Code is best understood as a floor for design, not a guarantee of safety: it tells a service what to consider, not what a particular family should decide. Reading a platform's own privacy information alongside its default settings gives a fuller picture than either alone.