UK AADC Standards 7 and 13 — Presenting privacy settings without nudges: session or permanent changes, easy reversion, no pre…
Privacy settings must default to the highest level for children; services must not use nudge techniques to encourage children to weaken their privacy protections
Where this comes from
Provision: Standards 7 and 13 — Presenting privacy settings without nudges: session or permanent changes, easy reversion, no pre-selection or asymmetric design (ICO Age Appropriate Design Code, statutory guidance under DPA 2018 s 123)
Instrument: UK Age Appropriate Design Code
Citation: Data Protection Act 2018 s 123/s 127; ICO Age Appropriate Design Code, Standard 7 — Default settings AND Standard 13 — Nudge techniques (two separate standards with their own headings; not one provision)
Text version: ICO Age Appropriate Design Code (statutory code of practice under Data Protection Act 2018 s 123; in force from 2 September 2020 with a transition period to 2 September 2021 - date not independently verified on the ICO pages), fifteen standards as displayed on ico.org.uk on 2026-09-23. The Data (Use and Access) Act 2025 has amended UK GDPR and the ICO has signalled a revised code: check for a reissued code before relying on this text.
Who it applies to
It applies when all of these are true:
- Service is likely to be accessed by children under 18
…unless:
- Nudges that lead children towards more protective privacy settings are permitted where appropriate. (ICO AADC Standard 13 - pro-privacy nudges)
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Default profile visibility: private (not public)
- Default data sharing: off (opt-in, not opt-out)
- Default location tracking: off
- Default contact discoverability: off
- User can change any default via settings
Questions people ask
- Does UK AADC Standards 7 and 13 — Presenting privacy settings without nudges: sess… apply to my service?
- It applies when Service is likely to be accessed by children under 18. It does not apply where Nudges that lead children towards more protective privacy settings are permitted where appropriate. (ICO AADC Standard 13 - pro-privacy nudges).
- From when does this apply?
- UK AADC Standards 7 and 13 — Presenting privacy settings without nudges: sess… applies from 2 September 2021. Its current status is: in force.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.