Who must comply with the UK Children's Code?

Any provider of an information society service likely to be accessed by children under 18 in the UK must conform. That is a broad test covering apps, games, social media, ed-tech and connected toys — not only services aimed at children. If under-18s plausibly use your service, the code applies.

What are the most important standards?

The headline standards are high-privacy settings by default, geolocation turned off by default, profiling off by default, no detrimental nudge techniques, and data minimisation. These are where regulators look first because they protect children even when a child never changes a setting.

How does this relate to COPPA in the US?

COPPA is the US Children's Online Privacy Protection Act and applies to services directed at children under 13, requiring verifiable parental consent before collecting data. The UK code is broader (under-18) and design-led rather than consent-led, so the tool flags where a COPPA obligation also exists.

Is a DPIA required for a children's service?

Almost always. The ICO expects a Data Protection Impact Assessment for services likely to be accessed by children, because processing children's data is treated as inherently high-risk. Pair this checker with a DPIA to evidence your assessment of risks to young users.

Does the tool send my answers anywhere?

No. Every standard you mark and the resulting score are computed in your browser. Nothing about your product or its compliance posture is uploaded or stored, so it is safe to run during early internal reviews.

Age-Appropriate Design Code Checker

An Age-Appropriate Design Code Checker that scores your online service against the 15 standards of the UK ICO’s statutory Children’s Code (the Age Appropriate Design Code, or AADC). The code applies to any service likely to be accessed by children under 18 in the UK — a deliberately wide net covering games, social apps, ed-tech and connected products. This tool helps product, legal and trust-and-safety teams turn that into a concrete self-assessment, with cross-references to US COPPA where a parallel obligation exists.

How it works

The AADC sets 15 cumulative standards. The tool lists each as a pass/fail question and computes the share you currently meet:

score = standards met / 15

The standards are: best interests of the child, data protection impact assessments, age-appropriate application, transparency, detrimental use of data, policies and community standards, default settings (high privacy), data minimisation, data sharing, geolocation (off by default), parental controls, profiling (off by default), nudge techniques (none detrimental), connected toys and devices, and online tools to exercise rights. Several standards — high-privacy defaults, geolocation off, profiling off, and no detrimental nudges — are weighted heavily by regulators because they protect a child who never touches a single setting.

Tips and cross-references

A high score is not a substitute for a DPIA: the ICO expects one for any service likely to be accessed by children, because children’s data is inherently high-risk. Where your audience plausibly includes under-13s in the US, the tool flags COPPA, which additionally requires verifiable parental consent before collecting personal data — a consent obligation the UK code does not impose. Treat the failing standards as your remediation backlog, fixing the default-setting and nudge standards first since they have the broadest protective effect.

Everything is calculated locally — none of your answers are uploaded or stored.