In 2023, YouTube faced the first complaint brought under the ICO's Children's Code, accused of collecting children's data without the protections the code requires. This article looks back at that complaint, explains what the Children's Code is, and sets out how the rules protecting children's data online have changed since.
Update: October 2026
This article was first published in March 2023. Since then, the rules protecting children's data online have been strengthened considerably:
- The ICO has stepped up enforcement. In April 2023 it fined TikTok £12.7 million for using the data of children under 13 without parental consent. In 2025 it opened an investigation into how TikTok uses 13 to 17-year-olds' data in its recommender systems, and issued notices of intent to fine Reddit and Imgur over age checks. You can follow its progress in the ICO's Children's Code strategy updates.
- The Online Safety Bill is now law. The Online Safety Act 2023 is in force, and Ofcom's protection of children codes have applied since 25 July 2025. Risky sites and apps must now use effective age checks, and the largest platforms must stop the most harmful content reaching children's feeds.
- Children's protection is now written into UK GDPR. Since 5 February 2026, section 81 of the Data (Use and Access) Act 2025 requires online services likely to be used by children to take account of "children's higher protection matters" when designing how they handle personal data.
The original story (March 2023)
A British parent made the first complaint against YouTube under the Children's Code. Duncan McCann, a father of four and head of accountability at the 5Rights Foundation, alleged that YouTube collected the location, viewing habits and preferences of millions of children using its main site, and the ICO said it would look into the complaint. The story was reported by Computing and the BBC.
YouTube's terms of service set a minimum age of 13, but the complaint pointed to Ofcom research showing heavy, often unsupervised use by younger children. In 2021, YouTube was the most popular site among children aged 3 to 17, while the dedicated YouTube Kids app was used far less. YouTube said it had stronger default settings for younger users and that YouTube Kids offered additional protections.
What is the Children's Code?
The Children's Code, also known as the Age Appropriate Design Code, is a statutory code of practice from the ICO. It came into force in September 2020, and online services had a 12-month transition period to comply, so it has applied in full since September 2021.
It sets out 15 standards for online services likely to be used by children, from apps and games to social media and streaming sites. Among other things, it restricts or bans:
- profiling children by default
- location tracking switched on by default
- "nudge" techniques that encourage children to share more data or weaken their privacy settings.
The ICO's concern is that the unregulated use and sharing of children's personal data can cause physical, emotional and financial harm. That includes privacy risks, inappropriate advertising, and design features such as autoplay that keep children online for long periods. Find out more in the ICO's guide The Children's Code: what is it?
What this means for schools
The Children's Code applies to online services, not to schools themselves. But schools choose and recommend apps and platforms every day, so it's a useful benchmark:
- When choosing edtech or online services for pupils, check that suppliers can show how they meet the Children's Code, and record this in your DPIA.
- Be cautious about directing younger pupils to platforms with a minimum age of 13, such as the main YouTube site. Consider sharing videos through school systems instead.
- Remember that platform age limits and safety settings change. Review them as part of your online safety and filtering arrangements.