Laws & Policy
UK Children's Code
The UK's Age Appropriate Design Code: 15 standards online services likely to be used by children must follow to protect their data and privacy.
- Policymakers and staff
- Businesses
This is general information, not legal advice.
What parents should know
The UK Children's Code is a data-protection code for online services likely to be used by children. It has 15 standards, including high-privacy defaults and not using children's data in ways that are detrimental. It has been in force since September 2, 2021. It is not a US law. This page is general information, not legal advice.
On this page
What is the UK Children's Code?
The Age Appropriate Design Code, often called the Children's Code, comes from the UK Information Commissioner's Office. It explains how data-protection law applies when children are likely users. Likely means more than a site that puts 13 in its terms. A service children actually use can be in view.
The 15 standards cover things families can ask about in plain language: the best interests of the child, age-appropriate application, transparency, detrimental use of data, policies, default settings, data minimization, sharing, geolocation, parental controls, profiling, nudge techniques, connected toys, and online tools. The ICO publishes the full list. A badge that says we follow the code should point at which standards, not a logo alone.
Why the UK Children's Code matters
US products copy the ideas even when the code does not bind them. High privacy by default, geolocation off unless there is a compelling reason, and no nudge that pushes a child to weaken a setting are design tests a parent can use on any app.
It is also easy to mix up with COPPA. COPPA is a US consent rule for under 13. The Children's Code is a UK data-protection code up to 18, built around defaults. A company can talk about one and be silent on the other.
How it shows up in practice
- A service ships with location and profiling off for a child account, and the child has to take a step to turn them on.
- A privacy notice is written so a child can read what is collected, not only a lawyer.
- A product stops using streaks or prompts whose job is to get the child to lower a privacy setting.
- A US business that serves UK children asks counsel whether the code applies before it quotes the ICO in a press line.
How HeyOtto helps
HeyOtto does not claim a UK Children's Code certification. The family product starts with a parent, for ages 8–18. The child does not self-enroll. There are no ads. Public sharing of a child's project stays off until a parent approves it. Those are design choices a buyer can compare with the code's defaults. They are not a legal finding.
- Under 13, verifiable parental consent is part of setup.
- Parents can read chats and set topic limits before a problem shows up.
- A business that wants this kind of default can talk with HeyOtto.
For businesses
Talk with HeyOttoFAQs
Is the Children's Code a US law?
No. It is a UK code from the Information Commissioner's Office, in force since September 2, 2021. US companies look at it as a design standard and, if they offer services to children in the UK, as a legal question for counsel. This page is general information, not legal advice.
How many standards are there?
Fifteen. They include high-privacy defaults, data minimization, limits on detrimental use, and care with geolocation, profiling, and nudge techniques. Read the ICO page for the official wording. A summary that lists three of them is not the code.
What age does it cover?
Children, in UK data protection, means under 18. That is wider than COPPA's under-13 consent duty. A teen account can still be a children's-code question in the UK.
What is a high-privacy default?
The protective setting is the one the product starts with. The user, or the parent, has to choose to loosen it. If a child account opens with location, public profile, and contact from strangers already on, the default is not high privacy.
Sources
Last reviewed September 26, 2026. Law entries are reviewed every quarter.
This is general information, not legal advice.