Privacy Policy For Apps Used By Children

Maya is getting ready to launch a homework app for 9 to 14 year olds. The product is looking great: children can create profiles, track their progress, upload answers and earn badges. Then her developer asks, What should we put in the children's privacy policy?

That's the right question to ask before launch. If your app or platform is likely to be used by children, privacy isn't just a box to tick. Under the UK GDPR, the Data Protection Act 2018 and the ICO's Age Appropriate Design Code, children's data gets extra protection.

The good news is that this can be handled in a clear, practical way. You need a children's privacy policy and privacy notice children and parents can actually understand, and you need the product settings and data practices to match what the notice says.

Do You Need A Children's Privacy Policy For Your App?

Yes, if your app collects personal data from children or is likely to be accessed by children, you should have a children's privacy policy or privacy notice.

In UK data protection language, a privacy policy is usually called a privacy notice. It explains who you are, what personal data you collect, why you collect it, who you share it with and what rights people have. For children, that explanation needs to be especially clear and age-appropriate.

Personal data can include much more than a child's name. For an app, it may include:

• Account details, such as a username, email address or date of birth
• Profile information, such as school year, interests, photos or avatars
• Usage data, such as lessons completed, messages sent or in-app behaviour
• Device data, such as IP address, device identifiers and location information
• Parent or guardian details, such as an email address used for consent or billing
• Special category data, such as health information, if your app collects it

You may need a children's privacy notice even if children aren't your only users. If children are likely to use the service, the ICO expects you to think about their needs.

For example, if you run a gaming platform aimed at teenagers but don't actively check ages, it's risky to assume all users are adults. Your privacy approach should match the users you're likely to have, not just the users you hoped to attract.

What Does The Age Appropriate Design Code Require?

The Age Appropriate Design Code applies where children are likely to access your online service, so many apps, websites, games and platforms need to consider it.

The Code is also known as the Children's Code. It sits alongside the UK GDPR and Data Protection Act 2018, and the Information Commissioner's Office, known as the ICO, is the UK regulator that oversees it.

The Code is built around 15 standards. You don't need to memorise them to make a good start, but you do need to design your app with children's best interests in mind.

In practice, that usually means you should:

• Set privacy settings to high by default
• Collect only the data you genuinely need
• Avoid using children's data in ways that could harm them
• Explain privacy information in language suitable for the child's age
• Turn off geolocation by default unless you have a strong reason
• Avoid nudging children to weaken their privacy settings
• Be careful with profiling, targeted advertising and recommendation systems
• Give parents and children clear tools to manage privacy choices

The Code covers children under 18. That matters because a privacy notice for a 6 year old won't look the same as a privacy notice for a 16 year old. You may need different wording, screens or explanations for different age groups.

Say Maya's homework app has users aged 9 to 14. She decides to use two versions of the notice: one with simple, visual language for younger users, and one with more detail for parents and older children. That approach is often more useful than trying to make one dense document work for everyone.

What Should Your Children's Privacy Notice Include?

Your children's privacy notice should include the usual UK GDPR privacy information, written in a way children and parents can understand.

At a minimum, you should cover the following sections. This is a useful outline, but it isn't a finished legal document. A lawyer should tailor it to your app, your data flows and your product design before you use it.

1. Who We Are: Name your business, explain what your app does and say how users can contact you.
2. What Information We Collect: List the types of personal data you collect, such as account details, usage data, location data or uploaded content.
3. How We Collect It: Explain whether data comes from the child, a parent, a school, the device or third party services.
4. Why We Use It: Explain each purpose, such as running accounts, saving progress, keeping the app safe, personalising content or sending service updates.
5. Our Lawful Bases: Set out the UK GDPR lawful bases you rely on, such as contract, consent, legitimate interests or legal obligation.
6. When We Need Parent Or Guardian Consent: Explain when you ask for parent or guardian involvement, especially for younger children.
7. Who We Share Data With: Name or describe hosting providers, analytics tools, payment providers, schools or support tools.
8. How Long We Keep Data: Give practical retention periods, such as deleting inactive child accounts after a set period.
9. Children's Rights And Parent/Guardian Involvement: Explain children's rights to access, correct, delete, restrict or object to certain uses of data, and explain when a parent or guardian can help exercise those rights on the child's behalf.
10. How To Complain: Give your contact details and explain that users can also contact the ICO.

Be careful with lawful bases. If you rely on consent for an online service offered directly to a child, the UK age at which a child can give their own consent for that purpose is 13. For children under 13, you generally need consent from someone with parental responsibility if consent is your lawful basis.

Consent isn't always the right lawful basis. For example, you may use contract to provide the core service, legitimate interests for some safety measures, and consent for optional marketing or certain cookies. The right answer depends on the feature and the data involved.

How Do You Make A Privacy Notice Child-Friendly?

You make a privacy notice child-friendly by using clear language, layered information and design choices that help children understand what will happen to their data.

A child-friendly notice doesn't mean you remove the legal detail altogether. It means you present the key points in a way the child can grasp, with extra detail available for parents, carers or older users.

Use Simple, Direct Wording

For younger users, write as though you're explaining the feature out loud. For example, instead of saying we process usage data to improve user experience, you might say we look at how people use the app so we can fix problems and make lessons better.

Avoid long sentences and vague phrases. Children should be able to tell:

• What information you're asking for
• Why you want it
• Whether they have a choice
• Who else may see it
• How they can ask for help

Layer The Information

A layered notice can work well. You might use short pop-up explanations at the point of collection, a child-friendly privacy page and a fuller parent version.

For example, when Maya's app asks a child to choose an avatar, the screen says: Your avatar helps other people in your class recognise your profile. Don't use a photo of yourself unless your parent or teacher says it's okay. The full privacy notice then explains profile images, sharing and deletion rights in more detail.

Match The Notice To The Product

Your privacy notice should match what your app actually does. If your notice says location is off by default, the app settings need to reflect that. If your notice says you don't sell children's data, your advertising and analytics set-up needs to support that statement.

This is where copied templates often fall down. They may look polished, but they can miss your app's real data flows, age range, third party tools and consent journey.

What Compliance Checks Should You Do Before Launch?

You should check your data flows, age assurance, default settings, consent process and third party tools before your app goes live.

A practical pre-launch privacy review should cover both the words in your privacy notice and the way your product actually behaves.

Pre-Launch Checklist

• Map Your Data: List every type of personal data you collect, where it comes from, where it's stored and who can access it.
• Check Whether Children Are Likely To Use The App: Look at your branding, app store category, content, ads, user research and likely audience.
• Decide Your Age Approach: Work out whether you need age gates, age ranges, parent verification or different notices for different age groups.
• Review Lawful Bases: Match each data use to a UK GDPR lawful basis, rather than relying on one broad statement for everything.
• Complete A DPIA: If your online service is likely to be accessed by children and processes their personal data, you should complete a DPIA before launch. The DPIA should assess and mitigate risks to children and document how you comply with the Children's Code.
• Set High Privacy Defaults: Check location, visibility, messaging, profiling and sharing settings.
• Review Third Party Providers: Check processors, hosting, analytics, crash reporting, payment tools and support software.
• Prepare Your Cookie And Tracking Notices: If you use cookies or similar technologies, your privacy collection notice and the Privacy and Electronic Communications Regulations, known as PECR, may also apply.
• Plan For Rights Requests: You usually have one month to respond to a data subject access request under the UK GDPR.

For a worked example, imagine Maya's app collects a child's first name, age, school year, learning progress and parent email address. It also uses a crash reporting tool and basic analytics.

After mapping the data, Maya removes exact dates of birth and collects age range instead. She turns off precise location completely because the app doesn't need it. She keeps learning progress for 24 months after the account becomes inactive, in line with a data retention policy, then deletes or anonymises it. She also updates her processor contracts with the hosting and analytics providers.

Those choices make the privacy notice easier to write because the product is doing less with children's data in the first place.

What If Your App Uses Analytics, Ads Or AI Features?

If your app uses analytics, ads or AI features, you need extra checks because these tools can create higher privacy risks for children.

Analytics can be useful for improving your app, but you should still ask whether you need the level of detail you're collecting. Aggregated statistics are usually less risky than tracking individual children across sessions, devices or services.

Advertising needs particular care. Behavioural advertising and profiling children can be difficult to justify, especially where children may not understand how their data is being used. If your business model depends on advertising, you should get tailored advice on what can be done safely.

AI features also need careful thought. If your app uses AI to recommend content, assess a child's performance, moderate messages or generate personalised feedback, your AI governance policy and your privacy notice should explain this in plain language. You should also consider:

• What data the AI tool receives
• Whether the tool provider uses data to train its own models
• Whether any decisions have a legal or similarly significant effect on the child
• How you test for inaccurate, unfair or inappropriate outputs
• How children or parents can question or report a problem

For example, if Maya adds an AI tutor that reviews a child's written answers, she needs to check whether those answers are sent to a third party AI provider, how long they are kept and whether they're used for model training. Her privacy notice should say, in simple terms, that the app uses an AI tool to give feedback and that a parent or teacher can ask for help if the feedback seems wrong.

The ICO can issue significant penalties for serious UK GDPR breaches, including fines of up to £17.5 million or 4% of annual worldwide turnover, whichever is higher. For most small businesses, the more immediate risks are launch delays, app store issues, complaints from parents or having to rebuild features after launch.

Key Takeaways

• If your app collects children's data or is likely to be used by children, you need a privacy notice that fits the UK GDPR, the Data Protection Act 2018 and the Age Appropriate Design Code.
• Children under 18 receive extra protection, and children under 13 usually need parent or guardian consent where consent is your lawful basis for an online service.
• Your privacy notice should explain what data you collect, why you use it, who you share it with, how long you keep it, children's rights, and when parents or guardians can help exercise those rights on a child's behalf.
• Child-friendly privacy notices work best when they're layered, clear and matched to the child's age and the app's actual features.
• Before launch, map your data, complete a DPIA before launch if your online service is likely to be accessed by children and processes their personal data, review third party tools and check that high privacy settings are switched on by default.
• Analytics, advertising and AI features can raise extra risks, so it's worth checking those carefully before children start using the app.

If you'd like help with your children's privacy notice, app data protection checks, age-appropriate design review or third party data contracts, you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.