Children's Personal Data and the Children’s Code: ICO Issues Guidance on “Likely to be Accessed” by Children

The updated ICO Guidance provides welcome clarity on what online services it considers likely to be accessed by children, including a non-exhaustive list of factors to consider when making such an assessment.

The ICO clarifies that the Children's Code applies to both services that are intended for use by children and also to services that, whilst not aimed at children, are accessed by a "significant number of children". 

The ICO confirms that a "significant number of children" means both the number of children accessing or are likely to access the service.

"Significant" in this context, the ICO confirms, does not mean that a large number of children must be using the service or that children form a substantial proportion of your users – it means that there are more than a de minimis or insignificant number of children using the service. 

This will be a question of fact that organisations should consider on a case-by-case basis, considering a variety of factors relating to the type of service, how it has been designed and the personal data processing risks that it presents to children. 

Some of the factors the ICO suggests that organisations consider include:

• whether children can access the service;
• the number of child users of the service and the proportion of total UK users or total UK children this represents;
• any advertisements targeted at children;
• any complaints received from parents or third parties about children accessing the service; and
• the type of content, design features and activities which are appealing to children.

The ICO guidance also includes helpful case studies to show organisations how to consider and apply the Children's Code.