UK AADC Standard 14 - Connected toys and devices
Ensure connected toys and devices include tools for code compliance and safe defaults
Where this comes from
Provision: Standard 14 - Connected toys and devices
Instrument: UK Age Appropriate Design Code
Citation: Information Commissioner's Office, Age Appropriate Design: a code of practice for online services, Standard 14
Text version: ICO Age Appropriate Design Code (statutory code under Data Protection Act 2018 s 123), issued 2 Sept 2020
Who it applies to
It applies when all of these are true:
- Service is likely to be accessed by children under 18
- Service is used in an educational context
…unless:
- Products clearly marketed to and purchased by adults only are not in scope. (ICO AADC Standard 14)
Scope in the source's own terms
- Product is a connected toy or device for children
- Product is a connected/IoT device
- Product is sold in UK
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Personal data is encrypted in transit and at rest
- Access to personal data is role-restricted and access is logged
- A documented incident-response / breach-notification procedure exists and is tested
- Third-party processors are bound by equivalent security obligations
- Key rotation completes without loss of access to data encrypted under the prior key
Evidence an auditor expects
- Technical controlTechnical audit
Device privacy defaults
Evidence that connected device ships with protective default settings
- Policy documentDocument review
Parental control documentation
User guide documenting available parental controls and privacy tools
Questions people ask
- Does UK AADC Standard 14 - Connected toys and devices apply to my service?
- It applies when Service is likely to be accessed by children under 18; Service is used in an educational context. It does not apply where Products clearly marketed to and purchased by adults only are not in scope. (ICO AADC Standard 14).
- From when does this apply?
- UK AADC Standard 14 - Connected toys and devices applies from 2 September 2021. Its current status is: in force.
- What evidence does an auditor expect?
- Device privacy defaults; Parental control documentation.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.