---
title: "United Kingdom — Children & Vulnerable Groups | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/united-kingdom/children-and-vulnerable-groups/
source_html: /jurisdictions/united-kingdom/children-and-vulnerable-groups/index.html
description: "United Kingdom — Children & Vulnerable Groups (Amber, 5 sub-modules, 5 claims): Children"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 4ca6800d9a9486b029ff4cab25037632d6da4e4dbb69472346d30424ed189129
generator: "fe-fleet/md-twin@1.0"
---
# United Kingdom — Children & Vulnerable Groups | Data Protection Monitor

### D9Children & Vulnerable Groups5 sub-modules5 claimsAmber▾#

Children's protections are mature, statutory and actively enforced (amber reflects ongoing enforcement gaps industry-wide); dependent-adults sub-module is an evidenced gap.

Primary framework Age Appropriate Design Code (Children's code), DPA 2018 s.125; UK GDPR

Supervisory authority [Information Commissioner's Office (ICO)](https://ico.org.uk/)

Traffic-light rationale — Amber Children's protections are mature, statutory and actively enforced (amber reflects ongoing enforcement gaps industry-wide); dependent-adults sub-module is an evidenced gap.

#### Sub-modules (5)

#### Key findings (1)

- Reddit and MediaLab fined for children's privacy/age-assurance failures. — [Reddit issued with £14.47m fine for children's privacy failures](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/reddit-issued-with-1447m-fine-for-children-s-privacy-failures/)

Category narrative 209 words

The UK sets the digital age of consent for Information Society Services (ISS) at 13 under Art. 8 UK GDPR and s.9 DPA 2018 (where a child is under 13 and the controller relies on consent, parental responsibility holder authorisation is required). Beyond Art. 8 consent, the statutory Age Appropriate Design Code (Children's Code, issued under s.123 DPA 2018 and in force since September 2021) applies to ALL online services 'likely to be accessed by children' under 18 regardless of lawful basis, mandating 15 standards anchored in the best interests of the child: high privacy by default, geolocation off by default, minimal data collection, no nudge techniques, and a default prohibition on profiling children for behavioural advertising. From 5 February 2026, DUAA 2025 s.81 inserts Art. 25(1B) UK GDPR (' children's higher protection matters'), requiring providers of ISS likely to be accessed by children explicitly to embed children's higher protection into Art. 25 Data Protection by Design and by Default assessments. Active enforcement is demonstrated by the ICO's £14.47 million fine against Reddit, Inc. on 23 February 2026 for unlawful processing of under-13s' data, failure to deploy effective age assurance, and failure to complete a Children's Code DPIA, alongside parallel Ofcom age-assurance enforcement under the Online Safety Act 2023.

Evidence 5

Sources and claims (5)
- Confirmed[Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/introduction-to-the-childrens-code/) — The Children's code applies to information society services likely to be accessed by children under 18, including UK-based and non-UK companies processing UK children's personal data, even if children are not the target audience.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/reddit-issued-with-1447m-fine-for-children-s-privacy-failures/) — The ICO fined Reddit £14.47m for failing to apply any robust age assurance mechanism, resulting in no lawful basis for processing personal information of children under 13.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/imgur-owner-medialab-fined-over-children-s-privacy-failures/) — The ICO fined MediaLab (Imgur) £247,590 for failing to implement any age assurance measures to determine the age of users between September 2021 and September 2025, exposing children to harmful content.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/02/imgur-owner-medialab-fined-over-children-s-privacy-failures/) — UK law requires that online services using personal information of children under 13 rely on consent given by the child's parent or carer where consent is the chosen lawful basis; MediaLab was found to lack such parental consent measures for Imgur.observed 2026-07-28
- Confirmed[Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/age-appropriate-design-a-code-of-practice-for-online-services/code-standards/) — Children's code Standard 10 requires profiling to be switched off by default unless the organisation can demonstrate a compelling reason accounting for the best interests of the child, with protections against harmful content effects.observed 2026-07-28