# Standards and Regulatory References — UK AADC Implementation

## Primary Legislation

### Data Protection Act 2018 — Section 123

- **Section 123(1)**: The Commissioner must prepare a code of practice which contains guidance as to standards of age-appropriate design of relevant information society services which are likely to be accessed by children.
- **Section 123(2)**: The code must be prepared and issued under section 125.
- **Section 123(3)**: "Relevant information society service" means an information society service other than a preventive or counselling service.
- **Section 123(4)**: In determining whether a service is likely to be accessed by children, the Commissioner must take into account whether reasonable steps are taken by the provider of the service to ensure that children do not normally access the service.

### UK GDPR (as retained EU law)

- **Article 5(1)(a)**: Lawfulness, fairness and transparency principle — processing must be transparent.
- **Article 5(1)(c)**: Data minimisation principle — data must be limited to what is necessary.
- **Article 8**: Conditions applicable to child's consent — UK threshold is 13 years.
- **Article 12-14**: Transparency and information obligations — heightened for children.
- **Article 25**: Data protection by design and by default.
- **Article 35**: Data protection impact assessment — particularly relevant where children's data is processed.

### UK Online Safety Act 2023

- **Section 11**: Duties regarding children's access to harmful content.
- **Section 12**: Safety duties protecting children.
- **Section 37**: Age verification and age estimation requirements.
- Ofcom designated as regulator; codes of practice published for compliance.

## ICO Age Appropriate Design Code (Published September 2020)

### The 15 Standards

1. **Best interests of the child**: The best interests of the child should be a primary consideration when designing and developing online services likely to be accessed by a child.
2. **Data protection impact assessments**: Undertake a DPIA for any processing likely to result in a high risk to rights and freedoms of children.
3. **Age-appropriate application**: Take a risk-based approach to recognising age and apply the standards to child users.
4. **Transparency**: Provide privacy information suitable for children's understanding.
5. **Detrimental use of data**: Do not use children's data in detrimental ways.
6. **Policies and community standards**: Uphold published terms and policies.
7. **Default settings**: Settings must be "high privacy" by default.
8. **Data minimisation**: Collect only minimum data for features in active use.
9. **Data sharing**: Do not disclose children's data unless compelling reason.
10. **Geolocation**: Switch geolocation off by default; visible indicator when active.
11. **Parental controls**: Inform children about monitoring; visible indicator.
12. **Profiling**: Switch profiling off by default; protect from harmful effects.
13. **Nudge techniques**: Do not use nudges to weaken privacy protections.
14. **Connected toys and devices**: Ensure connected devices conform to the code.
15. **Online tools**: Provide prominent tools for exercising data protection rights.

## ICO Guidance and Opinions

### ICO Age Appropriate Design Code — Full Guidance (Published 2 September 2020)

- 150-page guidance document providing detailed interpretation of each standard
- Includes examples of conforming and non-conforming practices
- Provides a conformance tool for organisations to self-assess
- Specifies that "likely to be accessed by children" is a low bar — if any children could foreseeably access the service, the Code applies

### ICO Opinion: Guidance for Age Assurance (Published November 2021, Updated 2023)

- Provides guidance on implementing AADC Standard 3 (age-appropriate application)
- Discusses age verification, age estimation, and self-declaration methods
- Recommends a risk-based approach: higher risks require more robust age assurance
- Notes that facial age estimation can be proportionate if processed on-device without storage
- Endorses the use of digital identity systems for age verification

### ICO-OAIC Joint Audit of Yoti Age Estimation (2022)

- Joint audit by ICO and Australian OAIC of Yoti's facial age estimation technology
- Found the technology to be accurate within +/- 1.5 years for children
- Confirmed on-device processing and non-retention of images met data protection requirements
- Identified areas for improvement in bias testing across demographics

## International References

### UN Convention on the Rights of the Child (UNCRC)

- **Article 3**: In all actions concerning children, the best interests of the child shall be a primary consideration.
- **Article 12**: Right of the child to express their views freely in all matters affecting them.
- **Article 13**: Freedom of expression including right to seek and receive information.
- **Article 16**: Protection from interference with privacy, family, home or correspondence.
- **Article 17**: Access to information and material from diverse sources beneficial to the child.
- **Article 31**: Right of the child to rest, leisure, play, and recreation.

### UNCRC General Comment No. 25 (2021) — Children's Rights in Relation to the Digital Environment

- Interprets the UNCRC in the context of digital services
- States that businesses should identify, prevent and mitigate impacts on children's rights in relation to the digital environment
- Recommends age-appropriate design, privacy by design, and child-specific DPIAs
- Cited by the ICO as a reference framework for AADC interpretation

### IEEE 2089.1-2024 — Age-Appropriate Digital Services Framework

- Industry standard for implementing age-appropriate design
- Provides technical guidance for conformance with AADC and similar codes globally
- Covers age assurance, data minimisation, transparency, and default settings

## Enforcement and Engagement

### ICO Enforcement

- **TikTok (ICO, 2023)**: GBP 12.7 million fine for processing data of children under 13 without appropriate consent under UK GDPR Article 8. The ICO referenced the AADC in assessing TikTok's obligations.

### ICO Engagement Letters (2021-2022)

- The ICO wrote to major platforms (Instagram, TikTok, YouTube, Snapchat, Amazon) requiring AADC conformance assessments.
- Outcomes included:
  - **Instagram**: Under-18 accounts defaulted to private; restricted direct messaging from adults to children
  - **TikTok**: Disabled direct messaging for users under 16; disabled push notifications for under-16s after 9 PM
  - **YouTube**: Disabled autoplay for under-18 users; blocked behavioural advertising for under-18 content
  - **Snapchat**: Enhanced parental controls; restricted features for under-18 users

### ICO Conformance Assessment Framework

The ICO published a self-assessment tool for organisations to evaluate AADC conformance:
- 15 standard assessment areas with specific questions
- Scoring methodology: Conforming, Partially Conforming, Non-Conforming
- Requires evidence documentation for each standard
- Recommends annual reassessment