EdLaw
UK — ICO Children's Code (Age Appropriate Design Code)
The ICO's statutory code of practice under s. 123 DPA 2018 for information-society services likely to be accessed by children — the model the EU (DSA art. 28 guidance), California (CAADCA) and Australia (s 26GC) have copied. Not law itself, but the ICO must take it into account in enforcement, and courts can — practically, it is the compliance bar for anything child-facing in the UK.
Applicability to EdTech
- Scope turns on "likely to be accessed by children": consumer-facing surfaces (home use, parent-purchased, app-store distribution) are in scope. The ICO's EdTech position: where a school is the controller and the service is provided through the school, the code applies in more limited ways — but any direct-to-child service must conform in full. Assess each surface separately.
- Standard 14 — connected toys and devices (#s14) squarely covers VR headsets: effective conformance from the physical product, not just the portal.
- The most design-binding standards for us: high privacy by default (7), data minimisation (8), geolocation off by default (10), profiling off by default (12), no nudge techniques (13), DPIA required (2), and age-appropriate application (3 — establish age with proportionate certainty or apply the code to all users).
Contents
| Document | Covers |
|---|---|
| STANDARDS.md | The 15 normative standard statements, verbatim, with links to the ICO's full guidance per standard |
Scope note: the explanatory guidance behind each standard, and Annex B's age-and-developmental-stages framework, live on ico.org.uk — linked per standard.
Enforcement
ICO — the code feeds UK GDPR/DPA 2018 enforcement (assessment notices, fines); conformance is how "likely to be accessed" services evidence compliance.
Licence
The corpus reproduces the fifteen standard statements of the ICO's Age appropriate design code from the ICO's per-standard pages. The footer of those pages (read 2026-10-01 on the standard 1 page) says: "© Copyright All text content is available under the Open Government Licence v3.0, except where otherwise stated." The pages state no other terms for the standard statements.
The Open Government Licence v3.0 (read 2026-10-01) says: "You are free to: copy, publish, distribute and transmit the Information; adapt the Information; exploit the Information commercially and non-commercially". Its conditions: "acknowledge the source of the Information in your product or application by including or linking to any attribution statement specified by the Information Provider(s) and, where possible, provide a link to this licence", and, where no statement is specified, "Contains public sector information licensed under the Open Government Licence v3.0."; and, under Non-endorsement, the licence "does not grant you any right to use the Information in a way that suggests any official status or that the Information Provider and/or Licensor endorse you or your use of the Information."
Conditions, and how this corpus meets them:
- Acknowledge the source: STANDARDS.md names the ICO code and links the ICO page for every standard, and Sources links the publication. Attribution statement: "Contains public sector information licensed under the Open Government Licence v3.0." (licence).
- Non-endorsement: the corpus does not claim official status or endorsement by the Information Commissioner.
- Changes: the OGL does not require changes to be marked; the selection, layout and added anchors are described in Meta.
- Exemptions: no personal data, logos, crests or Royal Arms are reproduced.
The explanatory guidance behind each standard is linked, not reproduced.
Related
- UK GDPR and DPA 2018 — the enforcement substrate
- AU Privacy Act s 26GC — the Australian copy, due Dec 2026
- US COPPA — the US sibling regime