EdLaw
UK — ICO Children's Code (Age Appropriate Design Code)
The ICO's statutory code of practice under s. 123 DPA 2018 for information-society services likely to be accessed by children — the model the EU (DSA art. 28 guidance), California (CAADCA) and Australia (s 26GC) have copied. Not law itself, but the ICO must take it into account in enforcement, and courts can — practically, it is the compliance bar for anything child-facing in the UK.
Applicability to EdTech
- Scope turns on "likely to be accessed by children": consumer-facing surfaces (home use, parent-purchased, app-store distribution) are in scope. The ICO's EdTech position: where a school is the controller and the service is provided through the school, the code applies in more limited ways — but any direct-to-child service must conform in full. Assess each surface separately.
- Standard 14 — connected toys and devices (#s14) squarely covers VR headsets: effective conformance from the physical product, not just the portal.
- The most design-binding standards for us: high privacy by default (7), data minimisation (8), geolocation off by default (10), profiling off by default (12), no nudge techniques (13), DPIA required (2), and age-appropriate application (3 — establish age with proportionate certainty or apply the code to all users).
Contents
| Document | Covers |
|---|---|
| STANDARDS.md | The 15 normative standard statements, verbatim, with links to the ICO's full guidance per standard |
Scope note: the explanatory guidance behind each standard, and Annex B's age-and-developmental-stages framework, live on ico.org.uk — linked per standard.
Enforcement
ICO — the code feeds UK GDPR/DPA 2018 enforcement (assessment notices, fines); conformance is how "likely to be accessed" services evidence compliance.
Related
- UK GDPR and DPA 2018 — the enforcement substrate
- AU Privacy Act s 26GC — the Australian copy, due Dec 2026
- US COPPA — the US sibling regime
Sources
Meta
Standard statements in STANDARDS.md are reproduced verbatim from the ICO's per-standard pages by tools/ico-uk/build_aadc.py; verify re-fetches all fifteen pages and fails on any change (no version stamp exists — the code is unamended since 2020; watch for a DUAA-driven refresh).