Age-Appropriate Design is Here, and Organizations That Fail to Keep Up Will Incur Penalties
The age-appropriate design code is here, and it beckons all system engineers, coders, UX designers, and all kinds of organizations operating in the online space to reconsider their data-gathering methods – especially wherever young people are concerned. Its aim is to steer all digital services away from harvesting data from minor users that could be used in exploitative ways. It could be done by the company itself or by third parties that might have access to the retrieved data.
This is done by establishing a new set of standards calling for age-appropriate design whenever a user is identified as being a minor, as well as requiring organizations to ascertain the age of users. It applies not only to social media websites but to just about all digital services that gather any kind of data from their users.
Contextualizing Appropriate Design Code
At a time when over one-fifth of Internet users are children, age-appropriate design code expands on the principles laid out in the DPA (data protection act) to lay out foundations that keep online services from working against the best interests of young users, especially where it concerns data harvesting.
While similar measures have already been devised under the GDPR requirement for any online service that collects personal data to only do so after asking for consent from users, the revised set of guidelines introduces new considerations meant to safeguard the needs and interests of child users.
This age-appropriate design code was first introduced in the United Kingdom late in 2020 (with a transition period of one year), and similar initiatives have since been set in motion throughout the world, such as CA Kids Code (California design code).
What does the age-appropriate design code entail?
This statutory code requires all organizations offering services in the digital world to perform age verification on their users. It also requires them to serve those who are found to be less than 18 years old with an appropriate design that maximizes data protection. This is expected to be done as part of their default settings, rather than as an optional feature. Whenever young users are being monitored by parental control features, they should be informed of the fact.
Age-appropriate design expands on the principles of general data protection by taking a risk-based approach to the collection of personal data. The code applies to any online service that collects any type of user data, no matter the reason. It does allow for privacy levels, meaning that some data may be collected in some cases, just as long as it’s proven to be essential to the actual service. It does not allow for the sharing of data gathered from minors with any sort of parties, or even internal data processing for tangential reasons such as user profiling.
Additionally, the code also negates the use of nudge techniques for data collection purposes, and it stipulates the need for organizations to develop age assurance methods that won’t be easy for users to get around easily, but also won’t in themselves constitute an added means to gather sensitive data from child users (such as photographs or personal documents).
Which digital services need to comply with age-appropriate design?
The standards in the code apply to digital services ranging all the way from social media platforms to online games, as well as apps and websites. In such cases, the involved organizations are expected to make their professionals conform to the code, otherwise, they will be at risk of incurring regulatory action.
For the time being, the code is technically a set of flexible standards (15 in total) rather than an actual hard law, but it is only a matter of time before they indeed become legal requirements. So the time to adapt to the future is now; all relevant professionals need to be up to date on the code as well as the underlying reasoning, and they need to be proactive in embracing its tenets.
Organizations are now expected to behave considerately towards young users who use their digital services (even when they’re not the intended audience); they should keep in mind the best interests of children rather than their own, and accommodate the data protection impact. This implies refraining from data harvesting for commercial purposes, as well as from using manipulative tactics to negatively influence the behavior of young users.
- Why London’s Luxury Rental Market Is the Natural Choice for the Modern Executive on the Move - May 17, 2026
- Order to Cash Automation: A Leadership Playbook for Agile Finance Transformation - April 10, 2026
- Leading Through Digital Transformation with Microsoft Dynamics 365 Support Services for Agile Organizations - March 22, 2026
