Safety & Design
Age-appropriate design
Designing digital products around a child's developmental stage, with high-privacy defaults and no features that exploit how young users think or click.
- Businesses
- Policymakers and staff
- Educators and school leaders
What parents should know
Age-appropriate design means an app is built for a child's age. Privacy is on by default. The app does not use tricks that keep kids scrolling or oversharing. If a product feels like an adult app with a cartoon added, it probably was not designed this way. Ask what a child sees the first time they open it.
On this page
What is age-appropriate design?
Age-appropriate design means the product is shaped around how children at a given age think, read, and make choices. The clearest public statement of this idea is the UK Age Appropriate Design Code, also called the Children's Code. It sets 15 standards for online services likely to be used by children. High-privacy defaults are at the center. So are limits on data, transparent terms, and a ban on using children's data in ways that are detrimental to their wellbeing.
The code is UK law's implementing guidance under the Data Protection Act, enforced by the Information Commissioner's Office. It is not a US statute. US teams still use it as a design checklist because it is specific. It asks services to estimate the age of users with a level of certainty that fits the risk, and then to apply the standards to child users.
In product language, age-appropriate design shows up as defaults. Location is off. A public profile is off. Notifications are quiet. A child does not have to hunt through settings to get the safer version. Features that nudge a child to stay, to share more, or to turn privacy off are treated as a design problem, not as engagement.
Why age-appropriate design matters
Children click the default. If the default publishes a profile, shares location, or keeps a streak going, many children will live with that choice. Age-appropriate design puts the protective choice first, so a child is safe without having to be a careful adult.
Businesses that put AI inside an app, a venue, or a membership experience make this choice whether they name it or not. A kiosk that stores voice, a tutoring app that keeps every prompt, or a game that adds a chatbot all have defaults. High-privacy defaults and an adult view of the session are the practical test.
Schools and policymakers can ask vendors to map their product to a known standard, such as the Children's Code or COPPA's duties for under-13 users, instead of accepting a slogan. A mapping shows which default is on, which data is kept, and which features are unavailable to younger users.
How it shows up in practice
- A new account starts with a private profile, and the child has to take an extra step to make anything public.
- An AI chat for kids does not ask for a phone number, a school name, or a photo of their face.
- Notifications do not ping a child overnight to bring them back.
- A venue's AI activity deletes the session at the end of the visit unless a parent saves it.
- A vendor's security review includes a one-page map of defaults by age.
How HeyOtto helps
Age-appropriate design means the safer settings match the child's age and start on. A HeyOtto family account starts with a parent, for ages 8–18. The child does not self-enroll. Replies are meant to match that age, and the parent can read the chat and set topic limits. There are no ads.
- Under 13, verifiable parental consent is part of setup.
- Conversations are not used to train models.
- Topic limits are set per child.
For families
Try freeFAQs
What is age-appropriate design?
It means a digital product is built around a child's age. The safer, more private settings are the default. The product does not nudge a child to give up that privacy or to stay longer than they meant to. The UK Children's Code is the best-known official list of these standards. US products can follow the same ideas even though the code is not US law.
What are high-privacy defaults?
A high-privacy default is the setting a new user gets before they change anything. For a child, that usually means location off, profile private, and data collection limited to what the service needs. If a child must find a menu and opt out, the default is the looser setting, not the protective one.
Does age-appropriate design apply to AI?
Yes. An AI chat has defaults too: what it will talk about, what it stores, and who can read the transcript. Age-appropriate design asks those questions up front. A chatbot added to an adult product, with the adult data settings left on, is a common miss.
How is this different from COPPA?
COPPA is a US law about personal information from children under 13, including verifiable parental consent. Age-appropriate design is a broader product standard, spelled out in the UK Children's Code, covering defaults and wellbeing as well as data. A service can need to meet COPPA and still use the Children's Code as a design guide.
Sources
Last reviewed September 26, 2026. This entry is reviewed twice a year.