On April 3, 2024, the UK Information Commissioner’s Office (“ICO”) published its 2024-2025 Children’s code strategy (the “Strategy”), which sets out its priorities for protecting children’s personal information online. This builds on the Children’s code of practice (“Children’s Code”) which the ICO introduced in 2021 to ensure that all online services which process children’s data are designed in a manner that is safe for children.

The new Strategy focuses on social media and video-sharing platforms in particular, and lists four priority issues that these services must improve on in order to conform with the Children’s Code and applicable data protection laws:

  1. Default privacy and geolocation settings: Tracking a child’s location poses obvious risks to their physical and mental safety. In the ICO’s view, platforms should set children’s profiles to private and turn off their geolocation settings by default.
  2. Profiling children for targeted advertisements: Children are less likely than adult users to be aware of profiling activities or their implications. Therefore, unless there is a “compelling reason”, platforms should turn off the profiling of children for targeted advertising by default.
  3. Using children’s information in recommender systems: The ICO points out that algorithmically-generated content feeds based on recommender systems may lead children to harmful content, such as self-harm, suicidal ideation, misogyny, or eating disorders. It also states that such recommender systems may induce children to spend more time and share more personal information on a platform.
  4. Using information of children under 13 years old: As children under the age of 13 cannot themselves consent to the processing of their personal information, it is crucial that online services gain parental consent and utilize age assurance technologies alongside other appropriate safeguards.

To address the most serious risks arising out of these priority areas, the ICO intends to continue gathering evidence (such as through a planned call for evidence this summer), engage with all relevant stakeholders, and use its enforcement powers. It also intends to further its cooperation with other UK regulators, such as Ofcom, and international counterparts.

* * *

The Covington team continues to closely monitor developments in the fields of children’s privacy and online safety. Please reach out to a member of the team if you have any questions.

This post was prepared with the assistance of Ruben Tjon-A-Meeuw.