Children's Online Safety

The Online Safety Act 2023 imposes specific duties on platforms that are "likely to be accessed by children" (under 18). These platforms must:

• Complete a children's risk assessment to identify and evaluate risks to children, including harmful content, contact with adults, and conduct risks (cyberbullying, grooming).
• Implement safe design measures to mitigate identified risks — for example, preventing algorithmic recommendation of harmful content to children.
• Prevent children from accessing primary priority harmful content — including pornographic content and content that promotes eating disorders, self-harm, or suicide.
• Apply age assurance — proportionate measures to verify or estimate a user's age to restrict access to harmful content.
• Provide an accessible, effective complaints process for users, including children and parents.

The ICO's Age Appropriate Design Code (Children's Code) applies to online services likely to be accessed by children in the UK. Services must:

• Apply the highest privacy settings by default for child users — geolocation, direct messaging, and public profile settings should be off by default.
• Not use nudge techniques to encourage children to share more personal data than necessary or to spend more time on the platform.
• Not use children's data in ways that are detrimental to their wellbeing — for example, algorithmic personalisation that increases anxiety or exposure to harmful content.
• Provide clear, transparent privacy information in plain language appropriate for the age group.
• Not collect more personal data than is necessary for the service.

The ICO can investigate platforms that fail to comply and impose fines up to £17.5 million or 4% of global turnover.

As a parent, you have several options if you are concerned about your child's online safety:

• Use parental controls — most devices and internet service providers offer parental control tools to restrict access to certain types of content. The UK's major ISPs (BT, Virgin Media, Sky, TalkTalk) provide free parental control filters.
• Report concerns to platforms via their reporting mechanisms — platforms must have accessible complaints processes under the OSA 2023.
• Complain to Ofcom if a platform is not complying with its Online Safety Act duties — Ofcom can investigate and take enforcement action.
• Exercise UK GDPR rights on behalf of your child — as a parent you can submit SARs and erasure requests on behalf of children under 13 (or under 18 where the child lacks capacity to act for themselves).

If your child has been harmed online:

• Online grooming or sexual exploitation: Report to the police (999 if immediate danger, 101 otherwise) and to the Child Exploitation and Online Protection Command (CEOP) at ceop.police.uk.
• Cyberbullying: Report to the platform and, if serious or persistent, to the school and police. The Diana Award's Anti-Bullying Pro programme and Childline (0800 1111) provide support.
• Exposure to illegal content: Report child sexual abuse material (CSAM) to the Internet Watch Foundation at iwf.org.uk. Report other illegal content to the platform and, if serious, to the police.
• Harmful algorithmic recommendations: Report to Ofcom if a platform's recommendation algorithm is exposing children to content that causes harm.

The ICO's Children's Code — formally the Age Appropriate Design Code — is a statutory code of practice under Section 123 of the Data Protection Act 2018. It came into full effect in September 2021 and applies to any information society service (app, website, game, connected toy) likely to be accessed by children under 18 in the UK, regardless of where the service is based.

The 15 standards in practice: The Code sets out 15 standards covering data minimisation, default privacy settings, profiling restrictions, and transparency. In practice for parents, the most important are:

• Default high privacy: Platforms should not require children to opt out of data sharing — privacy-protective settings should be the default, with children (or their parents) needing to actively opt in to sharing more data.
• No profiling for advertising: The Code says children's data should not be used for targeted advertising by default. This is particularly significant for social media platforms that derive revenue from advertising.
• Geolocation off by default: Location data is particularly sensitive for children. The Code requires location services to be switched off by default and requires platforms to provide clear information about when location data is being collected.
• Nudge techniques prohibited: Platforms cannot use design features that nudge children into sharing more data, spending more time online, or making purchases — dark patterns that exploit children's developing decision-making.

What parents can do when the Code is breached: If you believe a platform is violating the Children's Code — for example, by enabling targeted advertising to your child without opt-in, or by making location-sharing the default — you can:

1. Complain to the platform using their complaints process (required under the OSA 2023).
2. Report to the ICO at ico.org.uk — the ICO can investigate and impose fines of up to £17.5 million or 4% of global turnover. The ICO has already taken enforcement action against TikTok for Children's Code violations and is actively monitoring major platforms.
3. Report to the 5Rights Foundation (5rightsfoundation.com) which campaigns on children's digital rights and can direct you to specialist support.