UK plans tougher online privacy rules for children

Sites will have to set highest possible privacy settings, turn off data-mining practices

LONDON • Britain unveiled sweeping new online protections for children, issuing expansive rules despite widespread objections from a number of tech companies and trade groups.

The rules will require social networks, gaming apps, connected toys and other online services that are likely to be used by people under 18 to overhaul how they handle those users' personal information.

In particular, they will require platforms such as YouTube and Instagram to turn on the highest possible privacy settings by default for minors, and turn off by default data-mining practices such as targeted advertising and location tracking for children in the country.

The rules unveiled on Tuesday are the most comprehensive protections to arise from heightened global concern that popular online services exploit children's information, suggest inappropriate content to them and fail to protect them from sexual predators. These protections far outstrip narrower rules in the United States, which apply only to online services aimed at children under 13.

The new rules will soon be submitted to Parliament, which called for online standards for children as part of a 2018 data protection law and is unlikely to change them. The code should go into effect between eight and 10 weeks after it is sent to lawmakers.

"This is a significant shift in the landscape," said Ms Elizabeth Denham, Britain's information commissioner, an independent regulator who drafted the new rules. "The code is a set of principles and standards that requires companies to think about, to focus on and to be accountable for the way they are serving children."

The tech industry lobbied Ms Denham to weaken the rules, arguing that they were too onerous, vague and broad. In particular, some industry experts said the code would cause online services to collect even more personal data in order to distinguish their child users and treat them differently.

Mr Antony Walker, the deputy chief executive of techUK, an industry group that represents Amazon, Facebook, Google and other companies, said in a statement: "While we support the code's ambition, we do have real reservations."

He added that his group was particularly concerned that the code "could lead to some unnecessary age-gating of online services". Trade groups also say smaller companies may have to curtail free services for children because it could be more difficult to make money from advertising to them.

Mr Dom Hallas, executive director of Coalition for a Digital Economy, an advocacy group for start-ups that has received funding from Google, Intuit and Stripe, said: "Some people may see this as a victory for children, but we'll actually see a restriction in the services that start-ups can build for kids."

Ms Denham did not weaken the rules in response to the industry pressure, but she did clarify and amend some provisions. For instance, the final code suggests that instead of trying to determine a user's age, online services could just apply the standards for children to all users.

The new rules, called the Age-Appropriate Design Code, are intended to give minors in Britain special rights and protections online - much like in the real world where children generally have the right to attend school and are prohibited from going to bars.

Ms Denham said: "We already treat children differently in the offline or analogue world than we do adults. So why shouldn't we also treat them differently in the virtual world?"

The code lays out 15 principles that sites, apps and other online services likely to have users under 18 in Britain must follow. Among other things, it prohibits such services from influencing minors to share unnecessary personal information or select weaker privacy options.

It also requires sites and apps to collect as little personal information as possible from minors. And it prohibits online services from using children's personal data in ways that could be detrimental to them, such as by automatically recommending sexual or violent content based on their searches.

That is of particular concern in Britain, where teenager Molly Russell committed suicide, which her family said was influenced by her seeing images of self-harm on Instagram. The social media site subsequently banned such images.

Companies with major violations of the code could face fines of 4 per cent of their annual worldwide revenue.

The rules underscore a growing movement by regulators on both sides of the Atlantic to rein in tech industry data-mining practices.

NYTIMES

Join ST's Telegram channel and get the latest breaking news delivered to you.

A version of this article appeared in the print edition of The Straits Times on January 23, 2020, with the headline UK plans tougher online privacy rules for children. Subscribe