UK AADC Standard 15 — Online tools (ICO Age Appropriate Design Code, statutory guidance under DPA 2018 s 123)
Provide accessible tools for children to exercise data rights and report concerns
Where this comes from
Provision: Standard 15 — Online tools (ICO Age Appropriate Design Code, statutory guidance under DPA 2018 s 123)
Instrument: UK Age Appropriate Design Code
Citation: Data Protection Act 2018 s 123/s 127; ICO Age Appropriate Design Code, Standard 15 — Online tools; the underlying data-subject rights derive from UK GDPR (not independently re-verified against the GDPR text in this unit)
Text version: ICO Age Appropriate Design Code (statutory code of practice under Data Protection Act 2018 s 123; in force from 2 September 2020 with a transition period to 2 September 2021 - date not independently verified on the ICO pages), fifteen standards as displayed on ico.org.uk on 2026-09-23. The Data (Use and Access) Act 2025 has amended UK GDPR and the ICO has signalled a revised code: check for a reissued code before relying on this text.
Who it applies to
It applies when all of these are true:
- Service is likely to be accessed by children under 18
…unless:
- For the youngest children the code expects tools suitable for use by parents (0-5) or with an adult's help (6-9); parental involvement follows the child's age, not identity verification. (ICO AADC Standard 15 - age-range recommendations)
Scope in the source's own terms
- Service has child users who may exercise data rights
- Service operates under GDPR (EU scope; block moved from UK-GDPR authorship)
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Users can submit a report from the content/profile in context
- Each report gets an identifier and a tracked status through to resolution
- Reporters and affected users are notified of the outcome where required
- Report volumes and outcomes are captured for any required transparency reporting
- Submitting a report creates a tracked case with a reference
Evidence an auditor expects
- User-interface evidenceUser testing
Child-accessible data rights interface
Screenshots showing age-appropriate tools for data access, deletion, and portability
- Process recordDocument review
Data rights request handling process
Process documentation for handling children's data rights requests
- User-interface evidenceUser testing
Concern reporting mechanism
Child-accessible way to report privacy concerns or issues
Questions people ask
- Does UK AADC Standard 15 — Online tools (ICO Age Appropriate Design Code, statutor… apply to my service?
- It applies when Service is likely to be accessed by children under 18. It does not apply where For the youngest children the code expects tools suitable for use by parents (0-5) or with an adult's help (6-9); parental involvement follows the child's age, not identity verification. (ICO AADC Standard 15 - age-range recommendations).
- From when does this apply?
- UK AADC Standard 15 — Online tools (ICO Age Appropriate Design Code, statutor… applies from 2 September 2021. Its current status is: in force.
- What evidence does an auditor expect?
- Child-accessible data rights interface; Data rights request handling process; Concern reporting mechanism.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.