Rules and ethics
Part of UK compliance for parenting publishers, starting with the item rather than the account label
Does the Children's code apply to your parenting site?
Check whether the ICO Children's code reaches a parenting creator's site, from the for-parents label to profiles, messaging and geolocation features.
A site written for parents can still fall within the Children's code. Whether it does depends on who is likely to use it and what its features collect, not on the label above the front page. Decide that before profiles, messaging or competitions go live.
What to take away
- The ICO Children's code covers information society services likely to be accessed by children, and a service need not be aimed at them.
- A "for parents" label does not settle whether the code applies. Likely access by under-18s can bring a service within it.
- Assess content, design, access evidence and data flow before adding profiles, messaging, geolocation or personal recommendations.
- Geolocation and profiling each have a Children's code standard of their own.
- Where processing is likely to create high risk, run a DPIA while the project can still change.
Who counts as a likely young reader
The Children's code applies to information society services likely to be accessed by children, and a child here means anyone under 18. A parenting site is not exempt because its writing is aimed at adults.
The ICO says the code also applies to services not specifically aimed or targeted at children but nonetheless likely to be used by under-18s. Parliament chose the wording so that services children use in reality stay in scope.
That matters for a family publisher. Where teenagers might join a community, enter a competition or watch a video on the site, ask honestly whether they are likely users, and write down the reasoning behind your answer.
Why a "for parents" label settles nothing
A "for parents" label does not settle whether the Children's code applies. The ICO's introduction says that if children are likely to access your service, even if they are not your target audience, you need to consider the code.
So the label is a statement of intent, not evidence. Evidence is what the service lets someone do: sign up, post, message, share a place or receive recommendations. Judge the service by those features rather than by its tagline.
UK regulator material cannot choose the answer for you, because it depends on the actual processing. A creator who has not looked at the processing has not yet answered the question.
Four things to assess before you add a feature
Assess content, design, access evidence and data flow before adding profiles, messaging, geolocation or personal recommendations. Each of the four can change the answer, so write a short finding for each one.
- Contentdoes the material draw in readers under 18, even when it is written for their parents?
- Designdo the features, tone and layout make the service easy for a young person to use?
- Access evidencewhat do analytics, comments, entries and messages show about who actually visits?
- Data flowwhich information moves to which supplier, and where is it stored?
Treat access evidence as the check on your own assumptions. If entries or comments point to younger users, the label on the home page does not outweigh them. Date the assessment and revisit it whenever a feature changes.
Features that change the answer
Four features deserve an answer before launch rather than after the first complaint. The table gives the question to settle for each and the Children's code point behind it.
| Feature | Question to answer first | Code point behind it |
|---|---|---|
| Profiles | What identifies a young reader, and who can see it? | Assess data flow and access evidence |
| Messaging | Who can contact whom, and where are messages kept? | Assess design and data flow |
| Geolocation | How precise is the location, and is the setting off by default? | Standard 10 on geolocation |
| Personal recommendations | What profiling feeds them, and can it be off by default? | Standard 12 on profiling |
A precise location carries a different risk from a town name. Note whether information is inferred, combined or published, because a feature that combines place, age and event can identify a family.
If the answer is yes, or unclear
Where processing is likely to create high risk, the ICO's DPIA guidance sets out how to describe it, test necessity, assess risk and record measures. Act while the project can still change, not after the feature is live.
Collect the minimum. Use age bands instead of birth dates where possible, and remove school names and full addresses that add no analytical value. A combination of place, age and event can still identify a family.
Give every information category a specific purpose. Future content does not justify collecting a child's school, diagnosis or full date of birth. Deliver the notice where information is submitted, in language the intended age can understand.
Record each supplier's role, access, contract, location and deletion process. Then set retention dates for raw recordings, rejected stories, message exports and former contractor access.
Advertising, claims and licensing sit outside this check. The UK compliance guide covers them.
Before you add a feature
- Write down who is likely to use the service, labels aside.
- Assess content, design, access evidence and data flow.
- Answer the table question for every new feature.
- Run a DPIA where processing is likely to create high risk.
- Use age bands, not birth dates, where you can.
- Record each supplier's role and set retention dates.
Common questions
Does a "for parents" label take my site outside the Children's code?
No. The label does not settle the question. Likely access by under-18s can bring a service within the code, so judge the features and the evidence of who uses them.
Does the code only cover services made for children?
No. The ICO says it also applies to services not specifically aimed at children that are nonetheless likely to be used by under-18s.
Who counts as a child under the code?
Anyone under 18. That includes teenagers who might join a community or enter a competition on a family site.
When does a parenting creator need a DPIA?
Where processing is likely to create high risk. The ICO's DPIA guidance explains how to describe the processing, test necessity, assess risk and record measures.
