Checks / Obligations / Protect children
Obligation · 23 controls · 5 laws
Protect children
Services children may use must assess the risks to them, keep their data to a minimum, switch risky features off by default and check age where it matters.
What to put in place
Run a children's risk assessment, set high-privacy defaults for under-18s and record how age is checked.
Policy wording you can use
[your organisation] assesses the risks its service poses to children before launch and after every significant change. Profiling, data sharing and nudge techniques are off by default for users under 18, and age is checked proportionately to the risk.
Prove it once
Describe or link the evidence that this is in place: the policy, the page, the document reference. It is sealed once and applied to all 23 controls here that take a yes or a document (the rest need their own number or date and are listed after).
Every control that asks for this
ICO Children's Code
- ICO Children's Code - best interests of the child
- ICO Children's Code - DPIA for children
- ICO Children's Code - age-appropriate application
- ICO Children's Code - transparency for children
- ICO Children's Code - detrimental use avoided
- ICO Children's Code - policies & standards upheld
- ICO Children's Code - high-privacy default
- ICO Children's Code - data minimisation
- ICO Children's Code - no data sharing by default
- ICO Children's Code - geolocation off by default
- ICO Children's Code - no nudge techniques
- ICO Children's Code - connected toys/devices safe
- ICO Children's Code - online tools to exercise rights
- ICO Children's Code - profiling off by default
- ICO Children's Code - parental controls transparent
UK Online Safety Act
- OSA s.11 - children's access assessment
- OSA s.12 - children's safety duties met
- OSA s.12 - age assurance in place
- OSA - grooming-pattern flagging (no false 'safe')