23 ms·

Britain's Age Appropriate Design Code has made inroads into big tech's dominance

82 points by intunderflow 5y ago

pedro2 5y ago
Don't forget the downside: now you have to prove you're over 18, either by submitting more personal info or using a 3rd party which then can track the sites you go to. EDIT: apparently I'm talking about a 2nd, not directly related, bill. See one of the grandchildren comment.
- detritus 5y ago
  Ah ha, so this is where the following concern comes from: https://www.openrightsgroup.org/blog/age-verification-in-the-online-safety-bill/ https://www.openrightsgroup.org/blog/age-verification-in-the... And there was me thinking this was going to be another example of toothless go-nowhere governmental posturing.
  - pjc50 5y ago
    The "online safety bill" is not yet law and is different from the code of practice in the original article. The code of practice was put together by the ICO and not especially publicised, so it ends up being reasonable and proportionate. The "online safety bill" is the conservative side of the UK having yet another go at restricting porn, which will probably fall apart like the last one.
marliechiller 5y ago
Had never heard of this, but what a great piece of legislation. One could argue that given some adults lack of knowledge around what data their apps are collecting, this should perhaps be the default for all users - (possibly even keeping the child-adapted explanations)
- mixmastamyk 5y ago
  Perhaps? Should be part of the human rights to privacy.
Y_Y 5y ago
So instead of do-not-track I should set I'm-twelve-so-you-can't-track-me-loser? I'm not sure they've completely domesticated the the giants of internet commerce with this one, but it does seem like a step in the right direction.
- joe_g_young 5y ago
  I think Facebook and Google have TOS agreements that state a user has to be above the age of 13/14. If you stated your age on Google+ as younger, Google disabled your account.
  - pityJuke 5y ago
    Got caught out by this as a 12 year old. Ah, I just want my good email back!
    - drops 5y ago
      I'd hoped there was a system in place where Google only locks down the account until the user turns 14 (with the birth date info kept), but... they just locked them down? Man.
    - vidarh 5y ago
      My son is 12, but has a bunch of accounts with the wrong birth year because we were fine with him having them (if anything he's overly cautious) and so many sites have opted to just ban under 13 accounts rather than put in place proper solutions. He learnt years ago to never give his real birth year because of that and/or to clear cookies and try again if a site blocked him from registering with his real birth year and refused to let him go back and change it. Those blocks are really unhelpful for everyone but the sites (who get to pretend they don't have children as users) for that reason - they don't stop under 13's from registering, but they do ensure there's no remotely reliable data on who are under 13.
  - s_dev 5y ago
    You can have younger -- you just can't manager your own Google account and another "parent" account must be in charge of it. So like removing your own admin/permissions abilities basically.
brosinante 5y ago
"Nudge techniques" should be banned outright.
- llimos 5y ago
  For anything? Would you ban all advertising? This regulation bans nudging towards a particular goal. That's something that can be legislated for (and would clearly include advertising.)
  - Kliment 5y ago
    Of course I would ban all advertising if it were up to me. There's no question about it.
  - andrepd 5y ago
    > For anything? Would you ban all advertising? Yes, 100%. Advertising is nothing but an unproductive arms race for who can deliver the biggest assault on your mind and your attention. Your life would be better, and all your products cheaper too.
  - Levitz 5y ago
    I don't think banning all advertising is a good idea, there is some of it which is actually honest and useful. A good 95%+ of them are a cancer upon society and even our planet though. I find it insane that we are told to behave as responsible consumers while there is a multibillion dollar industry which sole purpose is to change consumer's behavior.
- indigomm 5y ago
  Nudge techniques like any tool can be used for good or bad. It doesn't inherently make the tool bad.
  - brosinante 5y ago
    Of course they can be used for good or bad. So does heroin (which is fundamentally diamorphine and used medically). The issue is that nudge techniques as they are implemented on the web are overwhelmingly abusive.
pbronez 5y ago
The specific rule here is the UK Information Commissioner's Office (ICO) "Age appropriate design: a code of practice for online services" [0]. There are 15 standards, listed on pages 7-8 of the linked PDF: (1) Best interests of the child: The best interests of the child should be a primary consideration when you design and develop online services likely to be accessed by a child. (2) Data protection impact assessments: Undertake a DPIA to assess and mitigate risks to the rights and freedoms of children who are likely to access your service, which arise from your data processing. Take into account differing ages, capacities and development needs and ensure that your DPIA builds incompliance with this code. (3) Age appropriate application: Take a risk-based approach to recognising the age of individual users and ensure you effectively apply the standards in this code to child users. Either establish age with a level of certainty that is appropriate to the risks to the rights and freedoms of children that arise from your data processing, or apply the standards in this code to all your users instead. (4) Transparency: The privacy information you provide to users, and other published terms, policies and community standards, must be concise, prominent and in clear language suited to the age of the child. Provide additional specific ‘bite-sized’ explanations about how you use personal data at the point that use is activated. (5) Detrimental use of data: Do not use children’s personal data in ways that have been shown to be detrimental to their wellbeing, or that go against industry codes of practice, other regulatory provisionsor Government advice. (6) Policies and community standards: Uphold your own published terms, policies and community standards (including but not limited to privacy policies, age restriction, behaviour rules and content policies) (7) Default settings: Settings must be ‘high privacy’ by default (unless you can demonstrate a compelling reason for a different default setting, taking account of the best interests of the child). (8) Data minimisation: Collect and retain only the minimum amount of personal data you need to provide the elements of your service in which a child is actively and knowingly engaged. Give children separate choices over which elements they wish to activate. (9) Data sharing: Do not disclose children’s data unless you can demonstrate a compelling reason to do so,taking account of the best interests of the child. (10) Geolocation: Switch geolocation options off by default (unless you can demonstrate a compelling reason for geolocation to be switched on by default, taking account of the best interests of the child). Provide an obvious sign for children when location tracking is active. Options which make a child’s location visible to others must default back to ‘off’ at the end of each session. (11) Parental controls: If you provide parental controls, give the child age appropriate information about this. If your online service allows a parent or carer to monitor their child’s online activity or track their location, provide an obvious sign to the child when they are being monitored. (12) Profiling: Switch options which use profiling ‘off’ by default (unless you can demonstrate a compelling reason for profiling to be on by default, taking account of the best interests of the child). Only allow profiling if you have appropriate measures in place to protect the child from any harmful effects (in particular, being fed content that is detrimental to their health or wellbeing). (13) Nudge techniques: Do not use nudge techniques to lead or encourage children to provide unnecessary personal data or weaken or turn off their privacy protections. (14) Connected toys and devices: If you provide a connected toy or device ensure you include effective tools to enable conformance to this code. (15) Online tools: Provide prominent and accessible tools to help children exercise their data protection rights and report concerns. [0] https://ico.org.uk/media/for-organisations/guide-to-data-protection/key-data-protection-themes/age-appropriate-design-a-code-of-practice-for-online-services-2-1.pdf https://ico.org.uk/media/for-organisations/guide-to-data-pro...
nova22033 5y ago
This is a victory? Who was the source for this article? Sir Humphrey?
cardanome 5y ago
I know that this war is already lost but I still strongly believe that children do not belong on the internet. They are too easily influenced and social media makes it easy for them to post stuff that they might later regret. The internet never forgets. And scrolling social media on their tablets does NOT build any worthwhile technological competency. Yes, in the era of desktop computers having early access to technology was very beneficial but smart phones and tablets are way too dumped down to offer much benefits. The new generations are actually less tech savy than many millennials. Also making the internet save for children requires for adults to give up too much freedom. A free internet and a child friendly internet do not mix. The need for age verification is already very problematic, allowing for easier identification and tracking. And yes, again, I know it is not realistic, it would be probably very difficult for children to not participate in social media but still we maybe should talk about how it might not be that great for their development in the first place.
- ethbr0 5y ago
  > I still strongly believe that children do not belong on the internet. They are too easily influenced and social media makes it easy for them to post stuff that they might later regret. [...] Also making the internet [safe] for children requires for adults to give up too much freedom. This is the most concisely I've heard it put. As a member of the last pre-Internet childhood generation, now with children of my own, I cannot agree more. Things used to be better as children. Full stop. Now we have predatory social and game companies abusing legal but immoral dark patterns for addiction, revenue, and data collection, to the detriment of their users' development, mental health, and lives. Edit: Here's a direct link to the Code: https://ico.org.uk/for-organisations/guide-to-data-protection/ico-codes-of-practice/age-appropriate-design-a-code-of-practice-for-online-services/ https://ico.org.uk/for-organisations/guide-to-data-protectio... (If on mobile, click on "Contents" on the top left to navigate down to the individual provisions)
  - altacc 5y ago
    I despair of these dark, addictive patterns . I vet games for my children and I long for the days of simply buying a game and that was it. Now there's a confusing barrage of points, coins, gems, crates, etc... that not only make the game "pay to win" but also create addiction and gambling patterns in young brians. My children think I'm mean for not letting them play the games their friends are playing but I think they're better off for it.
johnnyfaehell 5y ago
Maybe I'm not meant to see the change as I'm an adult but the only change I saw was Google Suite repeatedly telling me that under 18 year olds weren't allowed to use the service. So just denying them access to things has changed.
indigomm 5y ago
It's a shame that the UK government is consulting on watering down data protection laws. Including reducing the effectiveness of the ICO. https://www.computerweekly.com/news/252506493/UK-GDPR-faces-changes-under-planned-reforms https://www.computerweekly.com/news/252506493/UK-GDPR-faces-...
thinkingemote 5y ago
What's interesting it that Wireds own cookie consent form breaks these regulations. No more can companies nudge users to just accept their tracking defaults, they have to be explicitly enabled by the user.
JohnWhigham 5y ago
Setting age appropriate design doesn't change the root problem: companies can do whatever they want with your data with 0 consequences. We need some sort of way to "own" our data, to be able to allow companies to "lease" it when we use their services, and then be able to rescind access (e.g. it's removed their system and all 3rd parties that use it). Something like that.
- mc32 5y ago
  Sounds like a DRM for personal data. DRM gets a bad rap because of its previous use in limiting user rights to things they bought (and owned), but here, in this use case, perhaps DRM has a better use case.
- hinkley 5y ago
  I think someone, somewhere, needs to do a lecture series on how to create an information architecture that facilitates this sort of thing. It would be an uphill battle for me to argue for this at my company, and we are relatively benign as these things go.
- pjc50 5y ago
  > companies can do whatever they want with your data with 0 consequences Not in GDPR land.
james_burden 5y ago
Why can't kids just m*sturbate to hentai and watch people die on ogrish between bouts of diablo 2 like the good old days?
neonate 5y ago
http://web.archive.org/web/20210909032826/https://www.wired.co.uk/article/age-appropriate-design-code-big-tech http://web.archive.org/web/20210909032826/https://www.wired....
fmajid 5y ago
> The platforms have followed the letter of the law because they know that doing so is important in the UK. However, that doesn’t explain why they haven’t simply integrated the required changes in the UK only, and kept their products and services the same elsewhere. Because people are apathetic about their own privacy, but parents are hyper-sensitive to any threat to their children, even imaginary ones, which is why governments always use children as the rationale to justify more surveillance and encryption backdoors. The tech companies don't want that protective impulse to be the trigger that would create a mass movement, which would invariably go much, much further than simply protecting children.
hinkley 5y ago
As I was replying to someone else in this thread, it came to me that maybe part of the solution here is to investigate collaborative game play that involves the parents in the game. Not necessarily as a full peer, or as the leader, but keeping the parent abreast of what's going on. I don't think there was ever a pillow or blanket fort as a child where the parents weren't briefly invited in to see what we did, and I don't think it's quite the same thing to show off your Animal Crossing island on the TV. We could probably find more inclusive ways to do it, especially for games that are skewed younger, during earlier developmental stages.

82 points by intunderflow 5y ago

Don't forget the downside: now you have to prove you're over 18, either by submitting more personal info or using a 3rd party which then can track the sites you go to. EDIT: apparently I'm talking about a 2nd, not directly related, bill. See one of the grandchildren comment.

detritus 5y ago
Ah ha, so this is where the following concern comes from: https://www.openrightsgroup.org/blog/age-verification-in-the-online-safety-bill/ https://www.openrightsgroup.org/blog/age-verification-in-the... And there was me thinking this was going to be another example of toothless go-nowhere governmental posturing.
- pjc50 5y ago
  The "online safety bill" is not yet law and is different from the code of practice in the original article. The code of practice was put together by the ICO and not especially publicised, so it ends up being reasonable and proportionate. The "online safety bill" is the conservative side of the UK having yet another go at restricting porn, which will probably fall apart like the last one.

marliechiller 5y ago

Had never heard of this, but what a great piece of legislation. One could argue that given some adults lack of knowledge around what data their apps are collecting, this should perhaps be the default for all users - (possibly even keeping the child-adapted explanations)

mixmastamyk 5y ago
Perhaps? Should be part of the human rights to privacy.

Y_Y 5y ago

So instead of do-not-track I should set I'm-twelve-so-you-can't-track-me-loser? I'm not sure they've completely domesticated the the giants of internet commerce with this one, but it does seem like a step in the right direction.

joe_g_young 5y ago
I think Facebook and Google have TOS agreements that state a user has to be above the age of 13/14. If you stated your age on Google+ as younger, Google disabled your account.
- pityJuke 5y ago
  Got caught out by this as a 12 year old. Ah, I just want my good email back!
  - drops 5y ago
    I'd hoped there was a system in place where Google only locks down the account until the user turns 14 (with the birth date info kept), but... they just locked them down? Man.
  - vidarh 5y ago
    My son is 12, but has a bunch of accounts with the wrong birth year because we were fine with him having them (if anything he's overly cautious) and so many sites have opted to just ban under 13 accounts rather than put in place proper solutions. He learnt years ago to never give his real birth year because of that and/or to clear cookies and try again if a site blocked him from registering with his real birth year and refused to let him go back and change it. Those blocks are really unhelpful for everyone but the sites (who get to pretend they don't have children as users) for that reason - they don't stop under 13's from registering, but they do ensure there's no remotely reliable data on who are under 13.
- s_dev 5y ago
  You can have younger -- you just can't manager your own Google account and another "parent" account must be in charge of it. So like removing your own admin/permissions abilities basically.

brosinante 5y ago

"Nudge techniques" should be banned outright.

llimos 5y ago
For anything? Would you ban all advertising? This regulation bans nudging towards a particular goal. That's something that can be legislated for (and would clearly include advertising.)
- Kliment 5y ago
  Of course I would ban all advertising if it were up to me. There's no question about it.
- andrepd 5y ago
  > For anything? Would you ban all advertising? Yes, 100%. Advertising is nothing but an unproductive arms race for who can deliver the biggest assault on your mind and your attention. Your life would be better, and all your products cheaper too.
- Levitz 5y ago
  I don't think banning all advertising is a good idea, there is some of it which is actually honest and useful. A good 95%+ of them are a cancer upon society and even our planet though. I find it insane that we are told to behave as responsible consumers while there is a multibillion dollar industry which sole purpose is to change consumer's behavior.
indigomm 5y ago
Nudge techniques like any tool can be used for good or bad. It doesn't inherently make the tool bad.
- brosinante 5y ago
  Of course they can be used for good or bad. So does heroin (which is fundamentally diamorphine and used medically). The issue is that nudge techniques as they are implemented on the web are overwhelmingly abusive.

pbronez 5y ago

The specific rule here is the UK Information Commissioner's Office (ICO) "Age appropriate design: a code of practice for online services" [0]. There are 15 standards, listed on pages 7-8 of the linked PDF: (1) Best interests of the child: The best interests of the child should be a primary consideration when you design and develop online services likely to be accessed by a child. (2) Data protection impact assessments: Undertake a DPIA to assess and mitigate risks to the rights and freedoms of children who are likely to access your service, which arise from your data processing. Take into account differing ages, capacities and development needs and ensure that your DPIA builds incompliance with this code. (3) Age appropriate application: Take a risk-based approach to recognising the age of individual users and ensure you effectively apply the standards in this code to child users. Either establish age with a level of certainty that is appropriate to the risks to the rights and freedoms of children that arise from your data processing, or apply the standards in this code to all your users instead. (4) Transparency: The privacy information you provide to users, and other published terms, policies and community standards, must be concise, prominent and in clear language suited to the age of the child. Provide additional specific ‘bite-sized’ explanations about how you use personal data at the point that use is activated. (5) Detrimental use of data: Do not use children’s personal data in ways that have been shown to be detrimental to their wellbeing, or that go against industry codes of practice, other regulatory provisionsor Government advice. (6) Policies and community standards: Uphold your own published terms, policies and community standards (including but not limited to privacy policies, age restriction, behaviour rules and content policies) (7) Default settings: Settings must be ‘high privacy’ by default (unless you can demonstrate a compelling reason for a different default setting, taking account of the best interests of the child). (8) Data minimisation: Collect and retain only the minimum amount of personal data you need to provide the elements of your service in which a child is actively and knowingly engaged. Give children separate choices over which elements they wish to activate. (9) Data sharing: Do not disclose children’s data unless you can demonstrate a compelling reason to do so,taking account of the best interests of the child. (10) Geolocation: Switch geolocation options off by default (unless you can demonstrate a compelling reason for geolocation to be switched on by default, taking account of the best interests of the child). Provide an obvious sign for children when location tracking is active. Options which make a child’s location visible to others must default back to ‘off’ at the end of each session. (11) Parental controls: If you provide parental controls, give the child age appropriate information about this. If your online service allows a parent or carer to monitor their child’s online activity or track their location, provide an obvious sign to the child when they are being monitored. (12) Profiling: Switch options which use profiling ‘off’ by default (unless you can demonstrate a compelling reason for profiling to be on by default, taking account of the best interests of the child). Only allow profiling if you have appropriate measures in place to protect the child from any harmful effects (in particular, being fed content that is detrimental to their health or wellbeing). (13) Nudge techniques: Do not use nudge techniques to lead or encourage children to provide unnecessary personal data or weaken or turn off their privacy protections. (14) Connected toys and devices: If you provide a connected toy or device ensure you include effective tools to enable conformance to this code. (15) Online tools: Provide prominent and accessible tools to help children exercise their data protection rights and report concerns. [0] https://ico.org.uk/media/for-organisations/guide-to-data-protection/key-data-protection-themes/age-appropriate-design-a-code-of-practice-for-online-services-2-1.pdf https://ico.org.uk/media/for-organisations/guide-to-data-pro...

nova22033 5y ago

This is a victory? Who was the source for this article? Sir Humphrey?

cardanome 5y ago

I know that this war is already lost but I still strongly believe that children do not belong on the internet. They are too easily influenced and social media makes it easy for them to post stuff that they might later regret. The internet never forgets. And scrolling social media on their tablets does NOT build any worthwhile technological competency. Yes, in the era of desktop computers having early access to technology was very beneficial but smart phones and tablets are way too dumped down to offer much benefits. The new generations are actually less tech savy than many millennials. Also making the internet save for children requires for adults to give up too much freedom. A free internet and a child friendly internet do not mix. The need for age verification is already very problematic, allowing for easier identification and tracking. And yes, again, I know it is not realistic, it would be probably very difficult for children to not participate in social media but still we maybe should talk about how it might not be that great for their development in the first place.

ethbr0 5y ago
> I still strongly believe that children do not belong on the internet. They are too easily influenced and social media makes it easy for them to post stuff that they might later regret. [...] Also making the internet [safe] for children requires for adults to give up too much freedom. This is the most concisely I've heard it put. As a member of the last pre-Internet childhood generation, now with children of my own, I cannot agree more. Things used to be better as children. Full stop. Now we have predatory social and game companies abusing legal but immoral dark patterns for addiction, revenue, and data collection, to the detriment of their users' development, mental health, and lives. Edit: Here's a direct link to the Code: https://ico.org.uk/for-organisations/guide-to-data-protection/ico-codes-of-practice/age-appropriate-design-a-code-of-practice-for-online-services/ https://ico.org.uk/for-organisations/guide-to-data-protectio... (If on mobile, click on "Contents" on the top left to navigate down to the individual provisions)
- altacc 5y ago
  I despair of these dark, addictive patterns . I vet games for my children and I long for the days of simply buying a game and that was it. Now there's a confusing barrage of points, coins, gems, crates, etc... that not only make the game "pay to win" but also create addiction and gambling patterns in young brians. My children think I'm mean for not letting them play the games their friends are playing but I think they're better off for it.

johnnyfaehell 5y ago

Maybe I'm not meant to see the change as I'm an adult but the only change I saw was Google Suite repeatedly telling me that under 18 year olds weren't allowed to use the service. So just denying them access to things has changed.

indigomm 5y ago

It's a shame that the UK government is consulting on watering down data protection laws. Including reducing the effectiveness of the ICO. https://www.computerweekly.com/news/252506493/UK-GDPR-faces-changes-under-planned-reforms https://www.computerweekly.com/news/252506493/UK-GDPR-faces-...

thinkingemote 5y ago

What's interesting it that Wireds own cookie consent form breaks these regulations. No more can companies nudge users to just accept their tracking defaults, they have to be explicitly enabled by the user.

JohnWhigham 5y ago

Setting age appropriate design doesn't change the root problem: companies can do whatever they want with your data with 0 consequences. We need some sort of way to "own" our data, to be able to allow companies to "lease" it when we use their services, and then be able to rescind access (e.g. it's removed their system and all 3rd parties that use it). Something like that.

mc32 5y ago
Sounds like a DRM for personal data. DRM gets a bad rap because of its previous use in limiting user rights to things they bought (and owned), but here, in this use case, perhaps DRM has a better use case.
hinkley 5y ago
I think someone, somewhere, needs to do a lecture series on how to create an information architecture that facilitates this sort of thing. It would be an uphill battle for me to argue for this at my company, and we are relatively benign as these things go.
pjc50 5y ago
> companies can do whatever they want with your data with 0 consequences Not in GDPR land.

james_burden 5y ago

Why can't kids just m*sturbate to hentai and watch people die on ogrish between bouts of diablo 2 like the good old days?

neonate 5y ago

http://web.archive.org/web/20210909032826/https://www.wired.co.uk/article/age-appropriate-design-code-big-tech http://web.archive.org/web/20210909032826/https://www.wired....

fmajid 5y ago

> The platforms have followed the letter of the law because they know that doing so is important in the UK. However, that doesn’t explain why they haven’t simply integrated the required changes in the UK only, and kept their products and services the same elsewhere. Because people are apathetic about their own privacy, but parents are hyper-sensitive to any threat to their children, even imaginary ones, which is why governments always use children as the rationale to justify more surveillance and encryption backdoors. The tech companies don't want that protective impulse to be the trigger that would create a mass movement, which would invariably go much, much further than simply protecting children.

hinkley 5y ago

As I was replying to someone else in this thread, it came to me that maybe part of the solution here is to investigate collaborative game play that involves the parents in the game. Not necessarily as a full peer, or as the leader, but keeping the parent abreast of what's going on. I don't think there was ever a pillow or blanket fort as a child where the parents weren't briefly invited in to see what we did, and I don't think it's quite the same thing to show off your Animal Crossing island on the TV. We could probably find more inclusive ways to do it, especially for games that are skewed younger, during earlier developmental stages.