What the Age Appropriate Design Code means for kids’ privacy

Britain’s Age Appropriate Design Code is often presented as a compliance exercise, yet its deepest effect is on product design. The UK Information Commissioner’s Office has applied it since September 2021 to online services likely to be accessed by under-18s. Its standards require providers to put children’s best interests first, collect less data, explain services in language children can understand, and avoid interface choices likely to cause harm.

For Australia, the code is a benchmark rather than directly binding law. The Privacy Act 1988, Australian Privacy Principles and Office of the Australian Information Commissioner remain central, while eSafety rules add another layer for some services. Australian families in Sydney and Melbourne encounter the same ad-supported apps, social platforms and game economies, often without an equivalent child-specific design standard. The comparison shows where Australian policy could become clearer and more protective.

Why child privacy needs design rules

Privacy law traditionally tells organisations what they may do after a person has supplied data. A child-centred code changes the starting point. It asks service providers to consider what children actually experience, how easily settings can be changed, and whether a business model depends on pressures a child may not recognise. That matters for products used at school, in gaming communities or for socialising with friends.

The code covers “relevant services,” including many apps and websites likely accessed by children, even if they were not designed primarily for them. Its 15 standards address age assurance, data minimisation, default privacy, parental controls, geolocation, profiling, transparency and mechanisms for reporting harm. The regulatory point is practical: compliance cannot be separated from interface design, default settings or retention schedules.

This is where comparisons with privacy law limits show why broad rights need detailed implementation. A general right to privacy has little force if a child cannot understand an apparently harmless prompt or if an app makes the intrusive option easiest. The code treats those details as part of the law itself, giving Australian regulators and courts a clearer model for asking whether a service was reasonably designed for the people using it.

Safer defaults for young users

Default privacy is one of the code’s strongest ideas. A new account should not begin as public, location tracking should not begin as continuous, and contact uploads should require a clear reason. These defaults matter because children often accept prompts quickly, particularly when a game, video or messaging app offers social access in exchange for information. Privacy should not depend on a child understanding the commercial exchange.

The same principle applies to nudging. Interface details can steer users toward more sharing, longer sessions or purchases without clearly presenting the consequence. A discussion of everyday design details shows how minor choices can shape behaviour. The code treats dark patterns as a risk to children’s autonomy, requiring providers to present choices fairly and avoid design tricks that encourage excessive use or harmful disclosure.

Parental controls create a further tension. Adults need tools to set limits and respond to safety concerns, yet controls should not become a hidden surveillance system. A parent dashboard that records every message or location movement may transfer the privacy problem rather than solve it. Good controls provide meaningful supervision with narrow access, clear retention periods and information a child can understand as they grow older.

Age assurance without more exposure

Age assurance is among the most difficult requirements. Services need enough information to apply age-appropriate protections, yet asking every young person for a passport scan, school identity or exact birth date can create a sensitive identity file. The code allows different methods, including age estimation and proportionate checks, and expects providers to assess the risk before choosing one. It does not make universal document collection the default answer.

Australia faces the same technical and commercial problem as services expand across the local market. A Brisbane game studio may release a free social title to reach a global audience, monetise it through advertising and still operate on a modest budget; a large platform may be able to offer secure age checks without making them universal. Any Australian rule should require privacy-preserving assurance, prohibit reuse of identity documents for advertising, and set deletion deadlines so verification does not become permanent profiling.

Minimum-age proposals for social media also show why a narrow focus on access checks is insufficient. Blocking one category of account can push children toward anonymous chat sites, livestreaming services or direct messages where safeguards may be weaker. The broader lesson from the UK code is to assess the whole environment: algorithmic recommendations, private communication, purchasing, reporting systems and the incentives that keep children engaged. An age gate protects one door while leaving several windows open.

Advertising, profiling and data brokers

Commercial surveillance is where children’s data can acquire a life beyond the service that collected it. A platform may infer interests from searches, group activity and time spent in features, then share or license those signals for advertising. Australia already has a lively data-broker and ad-tech market, and local publishers, retailers and app businesses participate in a wider advertising chain whose transactions may be hard for families to see.

The code restricts targeted advertising based on profiling and prohibits certain design and monetisation practices that can harm children. Its significance lies in the idea that a child’s activity cannot simply be treated as an unrestricted commercial asset. Data collected to operate a game should not automatically become a behavioural profile sold to unknown third parties.

Australian privacy law does not offer every child the same protection in every setting. The Privacy Act covers government agencies and many organisations above the statutory turnover threshold, while some smaller services fall outside its reach. Its child-consent rule is also only one part of a wider design assessment. A stronger Australian approach would combine enforceable privacy rules with minimum data standards, limits on brokers and transparency about advertising relationships in Australian apps.

Schools, devices and institutional power

A child’s relationship with a public school is another setting where consent is uneven. In Sydney, a student may receive a tablet, a cloud account and access to learning platforms managed by the state education department or a school. Families often have little practical choice, and the student may have no meaningful way to object to monitoring. The institution collecting more data does not mean the child has less need for privacy.

Melbourne schools face similar combinations of managed devices and bring-your-own-device programs, alongside apps used for attendance, homework and teacher communication. The need to safeguard students from bullying and inappropriate content is genuine, but it does not justify indefinite retention of browsing histories or invisible activity scoring. A school system should apply the age-appropriate logic of necessity and proportionality: collect what supports a defined educational purpose, then delete it.

The concern is not limited to schools. A review of workplace messaging surveillance describes how monitoring and productivity scoring can turn ordinary communication into managerial data. Applied in a school, that pattern can chill help-seeking, discourage honest discussion and train children to accept permanent observation. Clear purpose limits, restricted access and meaningful review are essential wherever children are asked to use technology supplied by an adult authority.

From principles to a practical first step

For Australian providers, the most useful lesson is to make child impact part of every major product review. A privacy impact assessment should identify the likely age range, explain the child’s experience, test whether defaults are safe, and consider what happens after data leaves the platform. Those steps suit the Australian market because they apply to everything from start-ups to established brands, without requiring a separate policy for every design choice.

Regulators could build on this by publishing child-centred design expectations under the Australian Privacy Principles. eSafety can contribute expertise on harmful content and platform accountability, while the OAIC can address data minimisation and third-party reuse. Providers need enough detail to act consistently; families need plain information about what a service sees, what it shares and who can make decisions on a child’s behalf.

At the next Monday morning check-in, the family will open the settings of the child’s three most-used apps, change one intrusive default and record who can see the result. That documented change becomes the household’s first concrete privacy step, with a clear record of what was altered and who retains access.