UK's ICO now mandates websites and apps comply with its children's privacy design code, or face fines of up to £17.5M or 4% of annual worldwide turnover
In the UK, a 12-month grace period for compliance with a design code aimed at protecting children online expires today … Source: Information Commissioner's Office .
Context & Ripple Effects
The deadline follows the ICO's earlier rollout of an age-appropriate design code focused on children’s data and advertising. It turns that guidance into an enforceable operating requirement for websites and apps serving UK users.
Later coverage shows the code becoming a base for broader age-assurance enforcement, from age checks for adult-only services to penalties against platforms over children’s data practices.
First-order effects
- Websites and apps covered by the code must now make their child-data and design practices compliant or face ICO penalties of up to £17.5M or 4% of worldwide annual turnover.
- The ICO gains an immediate enforcement lever over services whose product design, data handling, or advertising treatment falls short of the children’s code.
Second-order effects
- Platforms must treat age assurance and child-specific product controls as compliance functions, a direction later reflected in the ICO’s action against TikTok over children’s data protection.
- Adult-only services and social platforms face a clearer incentive to improve age checks, since the code’s enforcement framework extends beyond a narrow privacy-policy exercise.
Third-order effects
- UK online-safety enforcement is moving toward design-level obligations: services are increasingly judged on whether their access and data systems prevent children from entering unsuitable experiences or being handled as adult users.
- If enforcement continues across major platforms, age verification and child-safe defaults may become durable requirements for products serving the UK rather than optional regional features.
The trend: The UK is turning children’s online privacy from a disclosure obligation into enforceable product-design and age-assurance regulation.