Children’s Online Privacy Rules Grow Teeth

The internet was not designed for children, but children found it anyway, and for years the gap between those two facts was filled with a polite fiction: a tick-box asking users to confirm they were over thirteen. Regulators on several continents have lost patience with the fiction. Privacy and safety rules aimed specifically at children now carry real fines, design requirements and, increasingly, obligations to check ages in ways that actually work. The shift matters to every app a child touches, and to every parent who assumed the settings menu had the situation covered.

Britain’s approach centres on the Children’s Code maintained by the Information Commissioner’s Office, which sets standards for services likely to be accessed by children, while research from UNICEF examines children’s digital rights worldwide. More coverage is available from our homepage.

From consent boxes to design duties

The conceptual change is the important part. Older rules focused on consent: who agreed to data collection, and at what age. Newer frameworks focus on design. If a service is likely to attract children, its default settings must be private, location tracking off, profiling for advertising restricted, and design tricks that nudge children into sharing more data are prohibited outright. Several large platforms have paid substantial penalties under these regimes, and product teams now involve child-safety specialists at the design stage rather than after a regulator writes to them.

Age assurance is the hardest piece. Asking for identity documents protects children but creates privacy risks for everyone, and estimation techniques based on selfies or behaviour raise their own accuracy and bias questions. Our technology coverage has followed regulators trying to square the circle: demanding effective checks while insisting the checks themselves collect as little data as possible. There is no settled answer, and different countries are landing in different places, which global platforms experience as a patchwork of conflicting duties.

What changes for families

For parents, the practical effect should be safer defaults: accounts for teenagers that start private, messages from strangers restricted, and recommendation systems barred from pushing sensitive content at young users. The rules also give families stronger rights to see, delete and challenge the data held about a child. None of it replaces conversation. Children still encounter risks in private chats, group messages and games that formal rules reach imperfectly, and they are most likely to tell an adult about a problem when earlier, smaller disclosures were met with curiosity rather than confiscation.

Duties for schools and developers

Schools and app developers face their own homework: auditing which services pupils use, what those services collect, and whether a free tool is quietly monetising children’s attention. The direction across jurisdictions is consistent even where details differ. Childhood is becoming a protected category in digital design, with duties placed on companies rather than blame placed on parents. After a decade in which the burden sat almost entirely on families, that redistribution may be the rules’ most important feature.

Children themselves deserve a place in this conversation, and the better regulators have begun insisting on one. Consultation exercises that ask teenagers how platforms actually feel to use have surfaced problems adults missed: the social cost of a private account in a friendship group built on public ones, the way read receipts and streaks manufacture obligation, and how quickly a joke shared in one context becomes a screenshot in another. Rules written only from adult anxieties tend to produce blunt bans that children route around in an afternoon. Rules informed by young users stand a better chance of changing design where it matters, at the level of defaults, prompts and pressures built into the product. Protecting children online, in other words, turns out to require listening to them, which may be the least technological and most important reform of all.