ICO opens Age Appropriate Design consultation

The Information Commissioner's Office (ICO) has opened consultation on a new set of standards for 'age appropriate design', through which it aims to protect children from the primary risks of online services including social media, connected toys, online games, and streaming platforms.

Announced late last week and made available for public viewing this week, the Information Commissioner's Office (ICO) 'age appropriate design' code of practice consultation sets out 16 key standards which it is considering requiring online services to meet in order to protect the privacy of children. The proposal is based on requirements set out by the Data Protection Act 2018, though which have not yet been enforced.

The proposed code of conduct includes the requirement that, unless there's a compelling reason to do otherwise, service providers must default to a high-privacy setting; that only a bare minimum amount of personal data should be collected and retained; that children's data, in particular, should 'not usually' be shared with third parties; and that geolocation services should be disabled by default in 'most circumstances'. The code also includes a section on the use of 'nudge techniques', such as promising an in-game reward or access to additional content, in exchange for children providing additional personal data, weaken their privacy settings, or to extend their time using the service long than they would otherwise have intended.

'This is the connected generation,' explains Information Commissioner Elizabeth Denham. 'The internet and all its wonders are hardwired into their everyday lives. We shouldn’t have to prevent our children from being able to use it, but we must demand that they are protected when they do. This code does that. The ICO's Code of Practice is a significant step, but it's just part of the solution to online harms.

'We see our work as complementary to the current focus on online harms,' Denham continues, referring to the Online Harms White Paper published by the Department for Digital, Culture, Media, and Sport earlier this month, 'and look forward to participating in discussions regarding the Government's white paper.'

'I welcome the draft code released today which represents the beginning of a new deal between children and the tech sector,' Baroness Kidron, who led a parliamentary debate on the creation of the code, opines. 'For too long we have failed to recognise children's rights and needs online, with tragic outcomes. I firmly believe in the power of technology to transform lives, be a force for good and rise to the challenge of promoting the rights and safety of our children. But in order to fulfil that role it must consider the best interests of children, not simply its own commercial interests. That is what the code will require online services to do. This is a systemic change.'

Digital rights campaigners, however, warn that the ICO must be careful in how the code of practice is implemented and enforced. 'It is welcome to see the ICO lay out strong "high privacy" by default including switching off geolocation, services the rely on profiling, and restricting nudge techniques, among others,' says the Open Rights Group (ORG)'s Matthew Rice. 'This gives the opportunity for children to access and use online services without becoming tracked and having their personal data monetised as soon as they land on the site.

'However the ICO must tread lightly when it comes to requesting verification of a child's age. There is a risk that an interpretation of the code will increase the spread of age verification technologies which, if implemented badly, could increase data collection of children or lead to inadvertently restricting access to services for children that don't have identity documents or sufficient parental support. The ICO must place strong restrictions to minimise the use of data collected, and give children the opportunity to enjoy the freedom to access to information and the communication potential that the best of these services provide.'

The code of practice is open to consultation now until May 31st; those interested in reading the code and responding can find details on the ICO website.