UK's Children's Code

• Know your audience – what age ranges are using your service? Until you know this you don't know what the risks are or what controls to put in place to mitigate these risks. Some of the ways to establish age include self-declaration; identifiers; account holder confirmation; age verification, but new methods are in development including the use of AI.
• Conduct a DPIA to identify all data collected and to understand the risks associated to the data processing. The ICO has a handy template you can use.
• Include privacy settings which are on by default. For example, a user's account should be set to private and it should allow them to enable and disable public sharing in a platform or community.
• Provide child friendly accessible privacy and just in time notices letting the child know why the service is asking for information and what it will be used for.
  
• Consider the best interests of the child. For example, does the service really need to collect all the personal information it does to provide the experience, introduce warning if the child has been playing for a lengthy period and don't use nudge techniques to push the child into certain behaviors.
• Switch off geo location unless there is a justifiable and compelling reason to use it. Make sure it is clear to the user if location tracking is on and only use this feature if it is essential to the functioning of the service. Build in measures to ensure that it is turned off and a child's location is not visible to others if it is not required or being used. Of course, a lawful basis for processing this data is required as it is for processing any personal data.
  

If you follow the standards of the code and bake privacy into your design you will be building brand trust and integrity which in turn supports lifetime value and engagement, a win win.

To keep your business on the right track and avoid hefty penalties, contact our privacy experts today.