Children’s Code commitment

The fifteen standards, on every under-18 surface.

The ICO Age Appropriate Design Code is a statutory code of practice under section 123 of the Data Protection Act 2018. TutorStudio is in scope as an information society service likely to be accessed by children. The fifteen standards below are the AADC, paired with the architectural commitment we hold ourselves to on each.

Standards 1–3

Foundations: best interests, DPIAs, age.

Every design decision affecting a child is justifiable against child-benefit; every feature processing child data carries a current DPIA; every account’s age band is derived from a documented authoritative source. These three standards are the spine of every other AADC obligation.

Standard 1

Best interests of the child

Child-benefit is the deciding lensWhere child-benefit and commercial benefit conflict, child-benefit wins. Specs carry an explicit best-interests argument; design review records the decision.

Standard 2

DPIAs

Current, registered, architecturally gatedEvery feature processing child data carries a DPIA in the registry. An expired DPIA disables the feature until refreshed. The DPIA registry is a database artefact, not a folder of PDFs.

Standard 3

Age appropriate application

Bands derived, not storedAge is captured from an authoritative source at account creation; the band (under-13 · 13–15 · 16–17 · adult) is derived at read-time so birthday transitions do not require a migration.

Standard 0

The under-13 default

Strictest applicable wins on uncertaintyIf the age band cannot be determined, the account defaults to under-13 until resolved. Failing strict is a deliberate design choice.

Standards 4–8

Data rights: see it, choose it, port it, delete it.

Transparency, lawful basis, data minimisation, default settings and data sharing — the five standards that govern every child-data interaction. Each defaults to the most privacy-preserving setting, ships with a just-in-time explainer, and respects the right to walk away cleanly.

Standard 4

Transparency

Three notices, one update cycleAdult, 13–17 and under-13 privacy notices ship in parallel and update together. Just-in-time explainers render at every significant child-data collection point.

Standard 7

Default settings

Strictest applicable, every timeUnder-18 accounts default to public-off, peer-visibility-off, profiling-off, marketing-off. A less-private default requires a documented compelling reason and a DPO sign-off.

Standard 8

Data minimisation

Justified per active engagementEvery field collected from a child is tied to an element of service the child is actively and knowingly engaged in. Speculative or bundled collection is prohibited.

Standard 6

Policies and community standards

Published policies are enforced policiesEvery published policy carries a tooled enforcement path, an audit log and an appeals route. An unenforced policy is itself a breach.

Standards 9–12

Engagement: calm by design, never extractive.

Engagement, gamification, profiling and nudge mechanics demonstrated to harm child wellbeing are prohibited even with consent. AADC standards 9, 10, 11 and 12 govern data sharing, geolocation, parental controls and profiling — the surfaces where a child is most likely to be exploited.

Standard 9

Data sharing

Compelling reason onlySharing child data with a third party requires a compelling reason that survives a best-interests test. No bundled cross-product sharing.

Standard 10

Geolocation

Off by default · visible when onGeolocation off by default. When a child does enable it for a session, a clear visual cue is rendered. Geolocation switches off automatically when a session ends.

Standard 11

Parental controls

Overt or absentWhere parental controls operate, a visual cue is rendered to the child so monitoring is never covert. Where they would be covert, we do not implement them.

Standard 12

Profiling

Off by default · classifier-gatedBehavioural profiling of under-18s is off by default. Where required for safeguarding (Stage 1 + Stage 2 classifier), output is human-in-loop terminated by a DSL.

Standards 13–15

Controls: the quiet posture.

The final three standards govern nudge techniques, connected toys & devices, and online tools. On TutorStudio this means no streaks, no badges, no leaderboards, no late-evening prompts; clear identification of any embedded third-party tooling; and child-friendly rights-exercise routes.

Standard 13

Nudge techniques

No streaks · no badges · no leaderboardsQuiet hours default 21:00–07:00. No loss-aversion framing. No manufactured urgency. CV-15 governs every notification template.

Standard 14

Connected toys & devices

Not in scope todayTutorStudio does not currently integrate with connected toys or external devices. If that changes, the standard applies in full.

Standard 15

Online tools

Child-friendly rights routesChildren can exercise their data rights — access, correction, deletion, objection — through routes designed in their reading-age register, not buried in adult-tone policy text.

Standard 5

Detrimental use of data

Even with consentEngagement and nudge mechanics demonstrated to harm child wellbeing are prohibited regardless of consent. A ‘soft’ version of a banned mechanic is still banned.

Want the operational detail?

See the security and safeguarding posture.

The trust page carries the procurement-grade evidence. The security page carries encryption, retention and sub-processor posture. The safeguarding page carries the KCSIE 2025 alignment and the DSL pathway.

See trust Security posture Safeguarding posture