Regulation by Region

The Age Appropriate Design Code: A Plain-English Guide to Its Main Duties

By the Ageline editors / Oct 22, 2026 / 5 min read

Short answer. The UK's Age Appropriate Design Code, also called the Children's Code, sets out 15 standards for online services likely to be accessed by children. It focuses on children's best interests, privacy, age-appropriate experiences and the responsible use of personal information. It is not simply an age-rating system or a requirement to place an age gate on every website: its application depends on the service, the children likely to access it and the risks created by its design.

Key points

The Children's Code contains 15 flexible standards covering the design and operation of services likely to be accessed by children.
The standards include best interests, data minimisation, high privacy defaults, geolocation, profiling and parental controls.
Services should establish children's ages with a level of certainty appropriate to the risks, or apply the relevant protections to all users.
App store content ratings describe the suitability of app content and features; they do not independently verify the age of the person downloading an app.
The Children's Code and the Online Safety Act have different scopes and should be considered separately.

What the Age Appropriate Design Code covers

The Age Appropriate Design Code is the Information Commissioner's Office's code of practice for online services likely to be accessed by children. It is also known as the Children's Code. Its legal foundation is the Data Protection Act 2018, which requires the ICO to prepare guidance on age-appropriate design for relevant information society services. The code addresses how services process children's personal information and how design decisions can affect their rights.

Its scope is broader than services marketed specifically to children. An app, game, social platform or online information service may need to consider the code when children are likely to access it, even if adults are its intended audience. The ICO explains that services should assess their audience and processing risks. The question is not simply whether a registration page asks users to confirm they are adults.

The 15 standards in practical terms

The code sets out 15 flexible standards. They are intended to guide service design and data processing rather than prescribe one identical interface for every product. The standards work together: knowing the likely age of users, protecting their information and avoiding design choices that undermine privacy are connected responsibilities.

Best interests of the child: treat children's interests as a primary consideration in design decisions.
Data protection impact assessments: assess risks to children's rights and freedoms.
Age appropriate application: establish users' ages or apply the code's standards to all users.
Transparency: provide privacy information that children can understand.
Detrimental use of data: avoid processing that is harmful to children.
Policies and community standards: follow the commitments made to users.
Default settings: provide high privacy settings by default unless a compelling reason supports another approach.
Data minimisation: collect and retain only the personal information needed.
Data sharing: do not disclose children's data unless there is a compelling reason.
Geolocation: switch location tracking off by default and make its use clear.
Parental controls: give children appropriate information when parental controls are used.
Profiling: switch profiling off by default unless a compelling reason justifies it.
Nudge techniques: avoid encouraging children to weaken privacy protections or disclose unnecessary information.
Connected toys and devices: apply appropriate protections to connected products.
Online tools: provide accessible tools that allow children to exercise their data rights.

Age assurance is a design responsibility

The age appropriate application standard addresses how services establish the ages of their users. The ICO recognises several approaches, including self-declaration, artificial intelligence, third-party verification, account holder confirmation, technical measures and hard identifiers such as passports. The method should provide a level of certainty appropriate to the risks created by the service's processing.

For example, a service that collects little personal information and offers a low-risk experience may have different age assurance needs from one that profiles children or processes sensitive information. If the service cannot establish ages with suitable certainty, the ICO's approach is to apply the code's standards to all users. This avoids making children's protection depend entirely on an uncertain classification.

Identify which age groups may use the service.
Describe the risks that children's data processing creates.
Choose an age assurance approach proportionate to those risks.
Explain the method and its limitations to users.
Provide a way to challenge an inaccurate age assessment.

Privacy defaults, data collection and profiling

The code's high privacy default standard means that children should receive protective settings automatically. A service should not assume that a child will understand a complex settings menu or know how to disable unnecessary tracking. The data minimisation standard also requires organisations to consider what information is actually needed. A date of birth collected for age assurance, for example, should not automatically become information for birthday marketing.

Profiling and geolocation deserve particular attention. The code expects geolocation to be switched off by default and profiling to be disabled by default unless there is a compelling reason for a different approach. Nudge techniques should not be used to pressure children into disclosing unnecessary information or weakening privacy settings. These principles affect interface wording, default choices, retention periods and the wider product architecture.

The Children's Code and the Online Safety Act

The Children's Code and the Online Safety Act 2023 address related but different responsibilities. The Children's Code concerns children's personal information and age-appropriate design under data protection law. The Online Safety Act establishes duties for certain regulated online services to protect users, including children, from specified online harms. Ofcom oversees the relevant online safety regime, while the ICO is the UK's data protection regulator.

Under Ofcom's age assurance guidance, certain services must use highly effective age assurance to protect children from pornography and other harmful content. The regulator identifies methods capable of meeting the 18 threshold, including photo-ID matching, facial age estimation, digital identity services, credit card checks, open banking, mobile-network operator checks and email-based age estimation. It also identifies self-declaration as insufficient for that particular standard. These requirements should not be confused with the Children's Code's broader, risk-based approach.

App store age ratings are a separate system

App store age ratings describe an app's content, features or suitability for particular age groups. They are not the same as an age check performed on the person using the app. An app may carry a rating indicating that it contains mature themes or user-generated content, while the developer separately decides whether an individual user meets a minimum age requirement.

Apple and Google use different rating arrangements. Apple provides age rating categories and definitions through App Store Connect, including information about content, capabilities and in-app controls. Google Play uses a content rating questionnaire, with ratings assigned by independent rating authorities using their own methodologies. A rating shown in one store should not be assumed to map directly to the same label in another store. Regional requirements and platform changes can also affect the information displayed.

For a practical example, an app with a 17+ or 18+ content classification may still need its own age assurance process. The store's classification communicates information about the app; it does not necessarily establish the downloader's exact age or satisfy a separate statutory age restriction. Developers should verify the current platform documentation and applicable regional rules before relying on a rating.

Applying the standards to a service

A useful starting point is a data protection impact assessment that describes the service's users, data flows, features and possible effects on children. Map each relevant standard to a concrete product decision. For example, identify the default privacy settings, what information is collected during registration, whether location is used and how an age-related decision can be challenged.

The ICO's guidance and the text of the Children's Code are the primary sources for interpreting the standards. The Online Safety Act and Ofcom's separate guidance should be consulted where a service may also fall within that regime. The applicable duties can depend on the nature of the service and current law, so this overview is not legal advice. The next practical step is to map the service's data flows against all 15 standards and record the reason for each design choice.

Questions readers ask

Does the Children's Code apply only to children's apps?

No. Its scope includes relevant online services likely to be accessed by children, even where children are not the intended audience.

How many standards does the code contain?

There are 15 standards. They cover subjects ranging from children's best interests and privacy defaults to profiling, geolocation and parental controls.

Are app store age ratings legally sufficient age checks?

A content rating and an individual age check serve different purposes. A store rating describes the app, while an age assurance process determines whether a particular user meets an access threshold.

What if a service cannot reliably determine a user's age?

The ICO's approach under the Children's Code allows a service to apply the code's standards to all users when it cannot establish ages with appropriate certainty.

Where should a small organisation start?

Start with the ICO's Introduction to the Children's Code and the 15 standards. Then assess whether the service is likely to be accessed by children and whether a data protection impact assessment is appropriate.