UK data watchdog proposes a 16-rule code of practice for online services to protect children's privacy that includes ending “nudge techniques” and more
Context & Ripple Effects
In April 2019 the UK Information Commissioner's Office put forward a 16-rule code of practice aimed at how online services treat children's data — banning 'nudge techniques' that steer kids into weakening their own privacy, and defaulting profiles to private. The proposal did not stay theoretical: it hardened into the Age Appropriate Design Code, which took legal force in September 2021 backed by fines of up to £17.5M or 4% of annual worldwide turnover.
What makes the 2019 proposal worth rereading is where its logic led. The same regulator pair later moved from data defaults into content itself — Ofcom proposing that platforms retune algorithms to hide 'toxic' material from children — and by 2026 the ICO and Ofcom were demanding 'highly effective age checks' to keep under-13s off social media entirely.
First-order effects
- Platforms serving UK users must rebuild child-facing defaults around the 16 rules — private-by-default profiles, no nudge techniques, minimal data collection — rather than relying on children to opt into protection.
- The ICO converts from advisory to enforcement posture: services that ignore the code face fines scaled to worldwide turnover, making compliance a board-level cost line for global platforms.
Second-order effects
- Because most major services run one global product, UK-mandated child defaults tend to propagate outward — competitors matching each other's safest setting rather than maintaining region-specific builds.
- Ad-tech and engagement-optimization suppliers lose a lucrative segment: techniques like streaks and notifications engineered for children become regulatory liabilities, shifting product incentives toward retention designs that survive scrutiny.
Third-order effects
- If the pattern holds, children's online regulation escalates from privacy design rules to content and access control — algorithmic curation duties and age verification becoming standard obligations rather than proposals.
- Design-for-children stops being a compliance niche and becomes a template regulators reach for first when governing platform features, with the UK code serving as the reference other regimes adapt.
The trend: Children's online safety regulation is escalating from privacy-by-design codes toward mandated age checks and algorithmic content controls, with the UK's ICO and Ofcom setting the pace.