{"id":199074,"date":"2026-08-04T06:42:14","date_gmt":"2026-08-04T05:42:14","guid":{"rendered":"https:\/\/legalvision.co.uk\/?p=199074"},"modified":"2026-08-06T04:16:22","modified_gmt":"2026-08-06T03:16:22","slug":"gdpr-child-protection-requirement","status":"publish","type":"post","link":"https:\/\/legalvision.co.uk\/uncategorised\/gdpr-child-protection-requirement\/","title":{"rendered":"GDPR and Child Protection: What Are Businesses’ Legal Requirements?"},"content":{"rendered":"\n

Businesses that process children’s personal data in the UK must comply with the UK GDPR<\/em> and the Data Protection Act 2018<\/em>, and must apply higher protections than they apply to adults. Since 5 February 2026, Article 25 of the UK GDPR<\/em> requires providers of online services likely to be accessed by children to take children’s higher protection matters into account when they design those services. The Information Commissioner’s Office also enforces the Age Appropriate Design Code, a statutory code of practice setting 15 standards for online services children use. Those standards include high privacy settings by default, profiling switched off, and privacy information a child can understand. This article explores the UK’s data protection law regime, some critical considerations for protecting children’s data, and the importance of seeking tailored legal advice to help your business protect children’s data and mitigate risk.<\/p>\n\n\n\n

The UK Data Protection Framework For Children’s Data<\/h2>\n\n\n\n

<\/a><\/a>Two laws set the baseline: the UK GDPR<\/em><\/a> and the Data Protection Act 2018<\/em><\/a>. They apply whenever you process personal data, whether the person is 8 or 48.<\/p>\n\n\n\n

What The Data (Use and Access) Act 2025 Changed<\/h3>\n\n\n\n

The Data (Use and Access) Act 2025<\/em><\/a> amends both laws directly. One change is specific to children. Article 25 of the UK GDPR<\/em>, the data protection by design and by default obligation, now carries an extra step. If you provide an information society service likely to be accessed by children, you must take children’s higher protection matters into account when you choose your technical and organisational measures. <\/p>\n\n\n\n

\n

The Act defines those matters as how children can best be protected and supported when using the service, and the fact that children need specific protection because they may not understand the risks or their rights, and because their needs change with age. Preventive and counselling services sit outside this requirement.<\/p>\n<\/div>\n\n\n\n

Which Services Are In Scope<\/h3>\n\n\n\n

“Information society service” covers most things you would call an online service: apps, websites, games, streaming, connected devices. “Likely to be accessed by children” does not mean aimed at children. If children use your service, you are in scope.<\/p>\n\n\n

\n \"Front\n
\n
GDPR Essentials Factsheet<\/div>\n
\n

This factsheet sets out how your business can become GDPR compliant.<\/p>\n <\/div>\n \n\nDownload Now<\/a> <\/section>\n <\/div>\n\n\n\n\n

The Children’s Code<\/h3>\n\n\n\n

<\/a>The Age Appropriate Design Code<\/a>, often called the Children’s code, sits on top. It is a statutory code of practice with 15 standards for online services likely to be accessed by children. Put the best interests of the child first. Default to high privacy settings. Keep geolocation and profiling switched off unless you have a compelling reason. Drop nudge techniques that push children towards weaker privacy choices. The ICO uses the code when it assesses whether you have met your obligations under the UK GDPR<\/em>.<\/p>\n\n\n\n

Why Children’s Data Carries More Risk<\/h2>\n\n\n\n

Children often do not appreciate what they are handing over. A 12-year-old ticking a box does not weigh the consequences the way an adult does.<\/p>\n\n\n\n

The data itself is frequently sensitive. Health details, learning and performance records, biometric identifiers, and behavioural data captured while a child uses an app. Mishandled, it can follow the child for years.<\/p>\n\n\n\n

\n

The regulatory exposure is real. The higher maximum fine under the UK GDPR<\/em> is \u00a317.5 million or 4% of total worldwide annual turnover, whichever is greater. That figure comes from the ICO’s data protection fining guidance. Children’s data is also a stated ICO enforcement priority under its Children’s code strategy.<\/p>\n<\/div>\n\n\n\n

Then there is the commercial side. Parents decide which services their children use, and schools and other institutional buyers ask about data handling during procurement.<\/p>\n\n\n\n\n\n Continue reading this article below the form\n <\/i>\n<\/a>\n

\n
\n Need legal advice?\n
\n \n Call 0808 196 8584<\/a> for urgent assistance.\n
\n Otherwise, complete this form, and we will contact you on the same business day.\n <\/span>\n <\/div>\n\n \n\n
\n