Age appropriate design code and the Online Safety Act children's duties

The UK runs two overlapping children's regimes with different regulators. The ICO's Age appropriate design code — the Children's Code, a statutory code under s. 123 DPA 2018 — sets fifteen standards, including data protection by default at the highest privacy setting, no profiling or nudge techniques by default, and data minimisation, and it applies to any information society service LIKELY TO BE ACCESSED by a person under 18. That 'likely to be accessed' test is much wider than 'aimed at children': a general-audience service with meaningful under-18 usage is in scope. Separately, the Online Safety Act's children's safety duties and highly effective age assurance requirements came into force July 25, 2025, enforced by Ofcom, obliging in-scope services to run children's risk assessments and, for certain content, to verify age robustly rather than by self-declaration. Compliance with one does not discharge the other.