United Kingdom
The United Kingdom has emerged as a global benchmark with its Age-Appropriate Design Code—also known as the Children's Code—established under the Data Protection Act of 2018, which requires digital platforms to design their services with the best interests of the child first, integrating privacy by default, and prohibiting manipulative practices.
Furthermore, its robust personal data protection legislation (UK GDPR + DPA) has enabled bodies such as the Information Commissioner's Office (ICO) to monitor and sanction compliance, making the United Kingdom a benchmark in matters relating to children and technology.
Age-Appropriate Design Code
This code of practice, developed by the Information Commissioner's Office (ICO), sets out 15 mandatory standards that online services must follow when they are "likely to be accessed by children."
Effective from September 2, 2021.
Age-appropriate digital design. Default privacy settings. Collection of personal data from minors. Data protection impact assessments. Prohibition of nudge techniques. Parental control and progressive autonomy. Transparency and accessible language according to maturity.
It introduces child-centered design principles, data protection by default, limitations on profiling, and a clear focus on the best interests of the child.
Information Commissioner's Office (ICO).
Although it is a code of practice, it is considered binding under the UK GDPR: failure to comply with it can lead to sanctions equivalent to those of the GDPR.
The code pioneered the establishment of the concept of "best interests of the child by design" as a regulatory paradigm.
It covers websites and apps, video games, educational services, social platforms, and internet-connected devices (IoT).
Main provisions of the Code.
Requires data protection impact assessments specifically targeting risks to minors (Standard 4).
It requires the application of default privacy settings with the highest level of protection (Standard 1).
It prohibits location sharing without clear justification and visible warnings (Standard 10).
It requires promoting well-being and avoiding interference with children's free time and sleep (Standard 14).Restricts the use of data for personalization, tracking, and marketing purposes (Standards 7, 9, 11).
Introduces the principle of data minimization and prohibits intrusive practices (Standard 8).Establishes a gradual approach to parental control, respecting maturity (Standard 13).
Demand clear and age-appropriate language in terms and conditions (Standard 5).
Digital Safety and Data Protection Bill Project
This bill seeks to establish institutional obligations to promote children's digital safety. It requires the UK's Chief Medical Officers to publish recommendations for parents on smartphone and social media use. It also mandates the Secretary of State to develop a research plan on the impact of social media on children and a formal assessment of the age of digital consent in the UK.
Proyecto de ley presentado, no aprobado aún, el 16 de octubre de 2024 como “Bill 16” en la Cámara de los Comunes.
Smartphone and social media use. Psychosocial impact of technology use. Evaluating digital experiences by age. Assessing digital consent and its appropriateness. National research on children's digital environment.
Art. 1: The UK Chief Medical Officers must issue, within 12 months of the draft's approval, official guidance for parents on the use of smartphones and social media by minors.
Art. 2: The Secretary of State must publish an official research plan on the impacts of social media use on children and adolescents.
Art. 3: An institutional assessment of digital experiences by age and the appropriateness of the age of digital consent (currently set at 13 by the UK GDPR) will be established. OFCOM and the Information Commissioner's Office (ICO) must be consulted.Art. 3.3: This assessment must include an explicit statement on whether the age of digital consent should be changed.
Art. 4: The draft would apply to the entire United Kingdom.This bill seeks to establish institutional obligations to promote children's digital safety.
It is still pending, so a specific authority for its implementation and sanctions has not yet been designated. It has currently been presented as a Private Members' Bill (Parliamentary Initiative Project) and is being debated in Parliament, but has not yet advanced to the approval stage, where the corresponding regulatory structures would be determined.
Although it does not impose direct obligations on platforms, it establishes institutional steps prior to future, more substantive regulation. It is an "enabling" law, paving the way for regulatory decisions based on scientific evidence and technical recommendations. It could result in changes to the age of digital consent (currently one of the lowest in Europe) and a new national digital child protection strategy. It strengthens the inter-agency approach to digital children's policies in the United Kingdom (public health, data protection, and media regulation are converging).