The UK has created a new privacy code that could see internet giants like Facebook and YouTube hit with massive fines if they fail to comply.
The Age Appropriate Design Code consists of a set of standards for services likely to be accessed by children and which process their data - everything from apps and social media to connected toys, online games, streaming services and educational website.
Privacy settings will need to be set to high by default, and 'nudge' techniques should not be used to encourage children to weaken their settings. Location settings should also be switched off by default. Meanwhile, data collection and sharing should be minimized, and profiling that might allow children to be served with targeted content should be switched off by default. Organizations will be expected to know the age of their users.
"Personal data often drives the content that our children are exposed to – what they like, what they search for, when they log on and off and even how they are feeling," says information commissioner Elizabeth Denham, whose office created the code.
"In an age when children learn how to use an iPad before they ride a bike, it is right that organisations designing and developing online services do so with the best interests of children in mind. Children’s privacy must not be traded in the chase for profit."
The code is based on the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. It will now go through various statutory processes before it's laid in Parliament for approval, probably this fall; organisations will then be given 12 months to update their practices. After that, organizations that fail to comply will face sanctions including orders to stop processing data and fines of up to £17 million or four per cent of global turnover.
The code is the first of its kind, but the Information Commissioner's Office seems keen to stress that similar moves are under consideration elsewhere too - in the US, Europe and globally by the Organisation for Economic Co-operation and Development (OECD).
"I believe companies will want to conform with the standards because they will want to demonstrate their commitment to always acting in the best interests of the child," says Denham.
"Those companies that do not make the required changes risk regulatory action. What’s more, they risk being left behind by those organisations that are keen to conform."
However, there's been criticism of the new code, particularly as it may be hard for smaller companies to implement. "Some of the more potentially onerous requirements of the AADC are, one, putting children's data setting on 'high privacy' by default; two, establish age of users with a level of certainty; and, three, provide prominent tools to help children understand their rights and how to report," says Isabel Davis, a lawyer with Purewal Partners.
Meanwhile, the Open Rights Group welcomes the move, but says it has concerns: in particular, it warns, the code could lead to the introduction of age verification across the board.
"The ICO don't know how their code will change adults access to content in practice," says executive director Jim Killock.
"Age Verification demands could become a barrier to adults reaching legal content, including news, opinion and social media. This would severely impact free expression."
In a statement, Facebook says it supports the principles of the code.
"The safety of young people is central to our decision-making, and we've spent over a decade introducing new features and tools to help everyone have a positive and safe experience on our platforms, including recent updates such as increased Direct Message privacy settings on Instagram," it says.
"We are actively working on developing more features in this space and are committed to working with governments and the tech industry on appropriate solutions around topics such as preventing underage use of our platforms."
