Child data and consent under UK GDPR for family creators and the ICO

What to take away

For child data consent UK GDPR family creators, consent must be freely given, specific, informed and unambiguous, and a child under 13 cannot give it validly for information society services offered directly to them; otherwise assess the child's capacity to understand on the ICO consent page.
The Children's Code (Age Appropriate Design Code) applies to platforms and services likely to be accessed by children, which sets the standard your own publishing should meet.
Parents and children can make a subject access request, and the right to erasure lets them demand removal of footage and files.
Serious breaches must reach the ICO within 72 hours, and most creators who process personal data should pay the annual data protection fee.
Direct marketing to family audiences sits under PECR, so soft opt-in rules and consent records matter as much as the content itself.
A written checklist before every shoot is the cheapest compliance tool you own.

Why child data in family content is personal data under UK GDPR

A child appearing in your video is identifiable. Their face, voice, school jumper, bedroom and first name all point to one person, so everything you capture about them is personal data.

That means the UK GDPR and the Data Protection Act 2018 apply to your family channel in the same way they apply to a nursery or a soft play centre. A phone camera does not exempt you.

Some of it is special category data. Health details, ethnicity or a diagnosed condition need extra care, and you need a condition beyond ordinary consent to process it.

UK GDPR Recital 38 says children require specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data. That applies with particular force to marketing, creating personality or user profiles, and services offered directly to a child.

You are the controller for your own footage. If a brand, agency or editor also decides how that footage is used, they are a controller too, and you should agree in writing who answers a complaint.

Start with the basics of data protection for a parenting creator, because the rules follow the information you hold, not the size of your audience.

What counts as child data in practice

Child data in family content is rarely one thing. The six types you will capture most often are:

the child's face and voice in video and audio;
their first name, age or birthday in a caption;
identifying details such as a school uniform, house number or street;
health, medical or developmental information;
location data in a tagged post or in file metadata;
comments and messages other people leave about them.

What counts as child data

Faces, voices and names in video
School uniforms, badges, locations
Health, developmental or behavioural information
Location data, timestamps, device identifiers
Comments and messages from children
Private family group chats

Lawful basis and consent when filming children for brand work

The ICO's consent guidance sets the bar: consent must be freely given, specific, informed and unambiguous, given by a clear affirmative action. Silence, pre-ticked boxes and opt-out wording do not count.

Consent for a paid shoot

Check consent is freely given, specific, informed, unambiguous
Record parental consent, never assume it
Treat paid partnerships as commercial use
Reject perpetual image rights as a red flag
Read contract terms before the shoot

A child under 13 cannot give valid consent for this kind of processing. Parental consent is the workable route, and it should be recorded rather than assumed.

A paid partnership changes the calculation. Once money or free product is involved, the child's appearance is part of a commercial arrangement, and the parent's agreement needs to cover that specific use.

If a brand wants perpetual rights to your child's image, that is a red flag. Read the terms before the shoot, not after the invoice, and see what a contract must say about child participation and family data.

You can read the full position on Consent | ICO before you draft a release form.

Worked example: a paid nappy campaign

A creator in Greater Manchester films her two year old for a nappy brand. The brief asks for the child's first name in the caption and a six month paid usage licence.

Worked example: paid nappy campaign

She checks that the parent (herself) and the other parent both agree in writing to the named use.
She records what the brand will do with the clippaid social, website, and no editing that changes meaning.
She sets the licence at six months, not perpetual, and names the platforms.
She stores the signed release with the raw files, not in a separate inbox.
She notes the child cannot consent, so the release is signed by both parents.

If the brand later wants the clip in a TV ad, that is a new purpose and needs fresh agreement.

The Children's Code and age-appropriate design duties for creator platforms

The Children's Code, formally the Age Appropriate Design Code, is an ICO code of practice. It applies to information society services likely to be accessed by children, which covers most social platforms, apps and websites your family audience uses.

You are not the platform, so the code does not fall on you directly. It does set the benchmark. If a platform offers high privacy by default, no nudge techniques and no profiling of children, your own content should not undermine that.

In practice this means turning off public comment on videos featuring young children where you can, avoiding location tags on home content, and not running behavioural advertising at under-18 audiences.

The ICO's Children's information | ICO hub collects the consent and design guidance in one place.

Ofcom's duties for online safety run alongside this, and the ICO publishes separate Online safety and data protection | ICO material for services that publish children's content.

Design choices you control

Default family account to private or friends-only
Disable precise location on uploads
Turn off tagging and duets on child clips
Limit who can download your videos

Storing family footage, devices and cloud accounts without over-collecting

Data minimisation is the principle most family creators break. You do not need forty takes of a birthday to publish one clip, and the other thirty-nine are still personal data.

Decide a retention period and stick to it. A simple rule works: raw footage deleted 90 days after publication, finished edits kept while the post is live, then archived or removed.

Cloud accounts are the weak point. Shared logins, old phones still signed in, and family members with the password all widen the data chain, which is why a family-content vendor's data chain deserves a check before you hand over files.

Use two-factor authentication on every account holding footage. Encrypt external drives. Do not keep a child's medical letters in the same folder as your edit exports.

If you work with an editor or agency, put retention in the contract. They should delete raw files on a set date and confirm it in writing.

A storage routine that survives a busy month

A routine that holds up in a busy month looks like this:

Empty the phone into one dated folder on one drive the day you film, and delete the phone copies once the edit is exported.
Delete the unused takes after publication. Keep the finished edit, not the out-takes.
Save the signed release and the consent record in the same folder as the files.
Once a month, open the folder and delete everything past its retention date.
Every quarter, check who still has access to the shared drive and remove anyone who no longer needs it.

Storage routine that survives

Film on one device with known backup
Upload selects same day, delete rest
Move published edits to dated archive
Review archive quarterly and delete
Keep one-page record of holdings

Subject access requests and the right to erasure for a child's data

Anyone can ask what you hold about them. A parent can make a subject access request on behalf of their child, and once a child is old enough to understand, they can make one themselves.

You must respond within one month, normally free of charge. You can extend by two months for complex requests, but you must tell the person why.

Search properly. Footage, captions, comment threads, emails, contracts and WhatsApp messages about the shoot are all in scope, and a partial answer is a breach in itself.

The right to erasure is the one that catches creators out. A child who appears in your back catalogue can ask for removal, and the ICO explains the grounds on Right to erasure | ICO.

In practice you may not be able to delete a post hosted by a platform you do not control. You can delete your own copies, remove the content from your site, and ask the platform to act.

Handling a request in seven steps

Recognise the request. It does not have to be in writing, and it does not have to use the words 'subject access request'.
Log it with the date it arrived, because that is the day your one-month clock starts.
Ask for proof of identity only if you genuinely doubt who is asking, and never as a way to stall.
Search everywhere you hold the child's dataphone, cloud drive, inbox, contracts and comment threads.
Redact other people's information before you send anything.
Reply in plain English within one month, and explain why if a complex request needs the extra two months.

Handling a request

Log the date the request arrived
Verify identity and parental authority
Search every system, including old phones
Redact other people's data
Reply within one month in plain wording
Delete and confirm if erasure applies

Reporting a breach to the ICO

A breach is any loss, theft or accidental disclosure of personal data. A hacked cloud account, a lost phone with family footage, or an email sent to the wrong brand contact all qualify.

If it risks people's rights and freedoms, you must report it to the ICO within 72 hours of becoming aware. Keep an internal log of every incident, including the ones you decide not to report.

Most organisations that process personal data must pay an annual data protection fee to the ICO, unless an exemption applies. The tiers are set by size and turnover, and the fee page explains who pays what: Data protection fee | ICO.

Sole traders and small creators are not automatically exempt. If you are processing personal data as a business, check the exemption list rather than assuming.

Non-payment can attract a penalty larger than the fee itself, which is an expensive way to learn the rule.

Breach response, step by step

Containment comes before paperwork:

contain itchange the password, revoke the sharing link, wipe or recover the device, and ask the recipient to delete the file;
write down what happened, when you found out and whose data is involved;
work out the risk, and report it to the ICO within 72 hours of becoming aware if people's rights and freedoms are at risk;
tell the people affected without undue delay if the risk is high;
record the incident in your breach log afterwards, including the reason if you decided not to report it.

Breach response, hour by hour

Immediately
Contain incident and change passwords
Same day
Assess risk to children and family
Within 72 hours
Report to the ICO if risk is real
Without undue delay
Tell affected people
Afterwards
Write down what happened and changed

Direct marketing to family audiences under PECR

PECR sits alongside UK GDPR and governs electronic marketing. It covers emails, texts and direct messages, and it applies to creators selling a course, a printable or a subscription box.

The soft opt-in lets you email people who bought from you before, about similar products, if you offered an opt-out at the point of sale and in every message since.

Cold email or DM marketing to a bought list is not covered by the soft opt-in. You need consent, and you need to be able to prove when and how you got it.

Brands often ask you to share your email list or run a joint giveaway. That is a data sharing arrangement, not a favour, and it needs a written basis.

Keep consent records simple: who opted in, when, what they were told, and how they can leave. If you cannot show it, treat the contact as unconsented.

A child data and consent checklist for every family shoot

Run this before you pick up the camera. It takes ten minutes and covers most of what an ICO query would ask.

Parental agreement for the named use is written down before the camera comes out
The child is comfortable, knows what is being filmed, and can say no at any point
No school uniform, house number, street sign or car registration is visible
Nothing in shot reveals health or medical information
Names in captions and comment threads have been checked
The retention rule, and the folder the files will live in, are agreed
The brand's licence covers the platforms and the period, with no perpetual rights
The release names who can withdraw consent and how

Pre-shoot child data checklist

Both parents agreed in writing to this shoot
Release names platforms, duration, paid element
Child's comfort checked and boundaries agreed
Uniforms, house numbers, plates out of frame
Location services off, geotags stripped
Raw footage has deletion date and owner
Consent records stored with project file

The release form, in plain terms

A workable release says who the child is, what is being filmed, where it will appear, how long it will stay up, who can withdraw consent and how, and what happens to the files afterwards.

It should be signed by every person with parental responsibility, not just the parent who runs the account.

It should say that consent can be withdrawn, and what you will do if it is. A release that claims perpetual, worldwide, irrevocable rights to a child's image is not one a family creator should sign.

Common questions

Can my child consent to being filmed for a brand deal?

No. A child under 13 cannot give valid consent under UK GDPR. A parent or guardian with parental responsibility must agree on their behalf, and you should record that agreement.

Do I need to pay the ICO data protection fee as a small creator?

If you process personal data as a business, most creators do, unless a specific exemption applies. Check the ICO fee tiers rather than assuming your size exempts you.

What happens if a child asks me to remove an old video?

Treat it as a right to erasure request. Delete your own copies, remove the content where you control it, ask the platform to act, and reply within one month.

How long should I keep raw family footage?

Set a period and follow it. Ninety days after publication is a common rule. Keep only what you still need, and delete the rest on a schedule you can show.

Do I have to report a lost phone to the ICO?

Only if the loss risks people's rights and freedoms, which depends on what was on it and whether it was encrypted. Log every incident either way, and report within 72 hours if the risk is real.

Does PECR apply to my newsletter?

Yes. Emails and DMs to family audiences fall under PECR. Rely on consent, or the soft opt-in if they bought from you before, and keep proof of every opt-in.