The day’s top stories from around the world
Where the real conversations in privacy happen
Original reporting and feature articles on the latest privacy developments
Alerts and legal analysis of legislative trends
Exploring the technology of privacy
A roundup of the top Canadian privacy news
A roundup of the top European data protection news
A roundup of the top privacy news from the Asia-Pacific region
A roundup of the top privacy news from Latin America
A roundup of US privacy news
Talk privacy and network with local members at IAPP KnowledgeNet Chapter meetings, taking place worldwide.
Advisory Board, KnowledgeNet Chapter Chair and Young Privacy Professional applications are now open. (Leadership positions are for members only. Join today.)
Have ideas? Need advice? Subscribe to the Privacy List. It’s crowdsourcing, with an exceptional crowd.
Looking for a new challenge, or need to hire your next privacy pro? The IAPP Job Board is the answer.
Locate and network with fellow privacy professionals using this peer-to-peer directory.
Review a filterable list of conferences, KnowledgeNets, LinkedIn Live broadcasts, networking events, web conferences and more.
Understand Europe’s framework of laws, regulations and policies, most significantly the GDPR.
Steer a course through the interconnected web of federal and state laws governing U.S. data privacy.
Learn the intricacies of Canada’s distinctive federal/provincial/territorial data privacy governance systems.
Develop the skills to design, build and operate a comprehensive data protection program.
Add to your tech knowledge with deep training in privacy-enhancing technologies and how to deploy them.
Introductory training that builds organizations of professionals with working privacy knowledge.
Learn the legal, operational and compliance requirements of the EU regulation and its global influence.
Meet the stringent requirements to earn this American Bar Association-certified designation.
The global standard for the go-to person for privacy laws, regulations and frameworks
The first and only privacy certification for professionals who manage day-to-day operations
As technology professionals take on greater privacy responsibilities, our updated certification is keeping pace with 50% new content covering the latest developments.
Recognizing the advanced knowledge and issue-spotting skills a privacy pro must attain in today’s complex world of data privacy.
The first title to verify you meet stringent requirements for knowledge, skill, proficiency and ethics in privacy law, and one of the ABA’s newest accredited specialties.
The IAPP’S CIPP/E and CIPM are the ANSI/ISO-accredited, industry-recognized combination for GDPR readiness. Learn more today.
Mostre seus conhecimentos na gestão do programa de privacidade e na legislação brasileira sobre privacidade.
Certification des compétences du DPO fondée sur la législation et règlementation française et européenne, agréée par la CNIL.
Use the Vendor Demo Center, Privacy Vendor List and Privacy Tech Vendor Report to easily identify privacy products and services to support your work.
On this topic page, you can find the IAPP’s collection of coverage, analysis and resources related to international data transfers.
The IAPP’s US State Privacy Legislation Tracker consists of proposed and enacted comprehensive state privacy bills from across the U.S.
This tracker organizes the privacy-related bills proposed in Congress to keep our members informed of developments within the federal privacy landscape.
Access all reports and surveys published by the IAPP.
Access all white papers published by the IAPP.
IAPP members can get up-to-date information here on the California Consumer Privacy Act and the California Privacy Rights Act.
The IAPP’s EU General Data Protection Regulation page collects the guidance, analysis, tools and resources you need to make sure you’re meeting your obligations.
This chart maps several comprehensive data protection laws to assist our members in understanding how data protection is being approached around the world.
This interactive tool provides IAPP members access to critical GDPR resources — all in one location.
Join DACH-region data protection professionals for practical discussions of issues and solutions. Presented in German and English.
P.S.R. 2022 is the place for speakers, workshops and networking focused on the intersection of privacy and technology.
Europe’s top experts predict the evolving landscape and give insights into best practices for your privacy programme.
Gain exclusive insights about the ever-changing data privacy landscape in ANZ and beyond.
Explore the full range of U.K. data protection issues, from global policy to daily operational details.
Concentrated learning, sharing, and networking with all sessions delivered in parallel tracks — one in French, the other in English.
The world’s top privacy conference. Whether you work in the public or private sector, anywhere in the world, the Summit is your can’t-miss event.
View our open calls and submission instructions.
Increase visibility for your organization — check out sponsorship opportunities today.
Review upcoming IAPP conferences to see which need to be included in your schedule for the year ahead.
Start taking advantage of the many IAPP member benefits today
See our list of high-profile corporate members—and find out why you should become one, too
Don’t miss out for a minute—continue accessing your benefits
Review current member benefits available to Australia and New Zealand members
A new era of children’s privacy rules has arrived. New laws focusing on the safety and mental health of kids and teens will have wide-ranging implications for the design of digital systems. California’s Age-Appropriate Design Code Act, which will go into effect July 1, 2024, is the first law in the United States to reform privacy practices through the operation of youth design standards. The law is part of a trend of proposed bills and regulations that go far beyond traditional privacy harms, introducing new considerations, standards and liabilities that privacy professionals should become familiar with as soon as possible.
For more than two decades, the privacy of U.S. children online has been shaped primarily by operation of the Children’s Online Privacy Protection Act and the associated COPPA Rule, kept up to date by the U.S. Federal Trade Commission. COPPA was a landmark bill in 1998, at a time when only 41% of adults browsed the internet. Now, consumers of all ages seem to always be online, and digital devices and services have become ubiquitous in every aspect of our daily lives.
Policymakers have noticed this trend and are scrutinizing the plethora of potential harms to consumers. In October 2021, after a whistleblower brought attention to ongoing risks on Meta’s platforms related to misinformation, mental health and safety — with particular attention to the disproportionate risks of harm to children and teens — the Senate Commerce Subcommittee on Consumer Protection, Product Safety and Data Security convened a hearing with representatives from Snapchat, TikTok and YouTube. At that time, IAPP Senior Westin Research Fellow Müge Fazlioglu, CIPP/E, CIPP/US, reflected on the enhanced bipartisan scrutiny flowing from the whistleblower complaint and the lived experience of many parents: The digital world may be too complex for parents to hold sole responsibility for protecting their kids online.
When applied to the vulnerable population of kids and teens, the regulatory response to this bundle of concerns has coalesced around the idea of “age-appropriate design.” This concept has been famously spearheaded by Beeban Kidron, a British baroness and U.K. House of Lords member who started the 5Rights Foundation, which is pushing the adoption of this regulatory approach in both the U.K. and the U.S. Although the concept of “privacy by design” has long been an influence on the practice of privacy, age-appropriate design asks those who develop digital products and services to go farther in two ways: Considering potential impacts to specific vulnerable populations and thinking broadly about the harms that can be perpetuated through design features.
The U.K. Information Commissioner’s Office was first to put these ideas into practice through the promulgation of its Age Appropriate Design Code, a “code of practice” that essentially serves as an implementing regulation under the Data Protection Act of 2018. The U.K. Children’s Code focuses on implementing 15 standards, which are “not intended as technical standards, but as a set of technology-neutral design principles and practical privacy features.” These include a duty of loyalty for the “best interests of the child,” a duty of care to avoid “the detrimental use of data,” privacy-protective defaults (including for geolocation and profiling) and data minimization.
Since the U.K. Children’s Code went into effect, the ICO has been reviewing the compliance efforts of over 50 entities, with a focus on social media, gaming and streaming service organizations. In its one-year anniversary update, the ICO described the positive changes it has witnessed in that time. Noted changes include Nintendo’s update to only allow users older than age 16 to create their own account and set their own preferences, Google’s update that allows anyone under 18 to request their images be removed from Google image search, YouTube’s update that changed default settings for autoplay videos and bedtime reminders, and Meta’s updated policy limiting ad-targeting based on age, gender and location for users under 18. Active enforcement of the Children’s Code is expected. Just this month, the ICO issued a notice of intent against TikTok relating to alleged children’s privacy violations—with a proposed fine of £27 million.
With the passage of California’s Age-Appropriate Design Code Act, this style of regulatory scrutiny is now in the U.S. On Sept. 15, the California AADC was signed into law by Gov. Gavin Newsom, D-Calif., after passing unanimously in both state legislative chambers. When it enters into force on July 1, 2024, the law will apply to any entity that qualifies as a “business” under the California Privacy Rights Act and operates “online products, services, or features” that are “likely to be accessed” by children. Note: when the law refers to “children” it includes all minors under 18.
Likelihood of access by children under the California AADC is determined in a much broader fashion than the traditional COPPA “actual knowledge” standard. A business will need to determine whether it is “reasonable to expect” that its online product, service or feature will be accessed by youth “based on the following indicators,” which appear to be a disjunctive list of elements:
Although age verification is not required under the California AADC, businesses must estimate the age of minor users with a “reasonable level of certainty appropriate to the risks.” In the alternative, the law provides that the business can treat all users as though they are children under the AADC. In practice, this means that a business must either provide two versions of its service — one for youth and one for adults — and implement measures to properly sort its users or simply conform its overall design to the privacy-protective requirements of the AADC.
California’s AADC broadly tracks the requirements of the U.K. Children’s Code. The operational takeaways for businesses designing covered systems include the following:
For interpretive questions and future guidance, California’s AADC creates a new multistakeholder rulemaking entity, the California Children’s Data Protection Taskforce. Although early versions of the bill would have been enforced by the California Privacy Protection Agency, the final version empowers the California attorney general to enforce its provisions, with a 90-day cure period and a financial penalty of up to $7,500 per violation per child.
In the style of the age-appropriate design codes, a pending bill at the federal level known as the Kids Online Safety Act aims to strengthen data protection and online safety for minors up to 16. KOSA would apply to “a commercial software application or electronic service that connects to the internet and that is used, or is reasonably likely to be used, by a minor.” A covered entity would need to address “physical, emotional, developmental, or material harms to minors … including:
Although KOSA was voted out of the Senate Commerce Committee unanimously July 27, it has been the subject of critical feedback from some industry and civil society groups, including the Electronic Frontier Foundation, which argues the bill would require too much data collection and gives too much power to parents. Nevertheless, the Biden administration has continued to signal a strong interest in enhancing digital protections for kids and teens after featuring the topic in the 2022 State of the Union Address. In a set of “Principles for Enhancing Competition and Tech Platform Accountability” released Sept. 8, the administration again highlighted the importance of “prioritizing safety by design standards and practices for online platforms, products, and services” including by “restricting excessive data collection and targeted advertising to young people.”
The types of considerations embodied in the California AADC and U.K. Children’s Code are here to stay. In fact, a similar bill was recently introduced in the New York state senate. Even those organizations not covered under existing laws would do well to begin modifying processes to adapt to this new normal. Traditional impact assessments often consider the risks of privacy harms to “average” consumers. Moving forward, privacy professionals should engage with those who design and build digital systems to ensure the unique risks to vulnerable populations are also considered throughout the data life cycle. This starts with children and teens, but it may not end there. Policymakers are increasingly embracing an understanding of privacy rights that is responsive to the needs of other at-risk groups, from seniors to persons with disabilities to minoritized groups. Adapting early to this trend may pay dividends for privacy teams everywhere.
Submit for CPEs
If you want to comment on this post, you need to login.
The IAPP is the largest and most comprehensive global information privacy community and resource. Founded in 2000, the IAPP is a not-for-profit organization that helps define, promote and improve the privacy profession globally.
The IAPP is the only place you’ll find a comprehensive body of resources, knowledge and experts to help you navigate the complex landscape of today’s data-driven world. We offer individual, corporate and group memberships, and all members have access to an extensive array of benefits.
© 2022 International Association of Privacy Professionals.
All rights reserved.
Pease International Tradeport, 75 Rochester Ave.
Portsmouth, NH 03801 USA • +1 603.427.9200
About Author
