UK AADC Standard 14 — Connected toys and devices (ICO Age Appropriate Design Code, statutory guidance under DPA 2018 s 123)
Ensure connected toys and devices include tools for code compliance and safe defaults
Where this comes from
Provision: Standard 14 — Connected toys and devices (ICO Age Appropriate Design Code, statutory guidance under DPA 2018 s 123)
Instrument: UK Age Appropriate Design Code
Citation: Data Protection Act 2018 s 123/s 127; ICO Age Appropriate Design Code, Standard 14 — Connected toys and devices
Text version: ICO Age Appropriate Design Code (statutory code of practice under Data Protection Act 2018 s 123; in force from 2 September 2020 with a transition period to 2 September 2021 - date not independently verified on the ICO pages), fifteen standards as displayed on ico.org.uk on 2026-09-23. The Data (Use and Access) Act 2025 has amended UK GDPR and the ICO has signalled a revised code: check for a reissued code before relying on this text.
Who it applies to
It applies when all of these are true:
- Service is likely to be accessed by children under 18
- Service is used in an educational context
…unless:
- Electronic toys or devices that do not connect to the internet and only store personal data within the device itself are outside the code, because the provider has no access to the personal data. The former 'marketed to adults only' row had no source. (ICO AADC Standard 14 - scope)
Scope in the source's own terms
- Product is a connected toy or device for children
- Product is a connected/IoT device
- Product is sold in UK
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Personal data is encrypted in transit and at rest
- Access to personal data is role-restricted and access is logged
- A documented incident-response / breach-notification procedure exists and is tested
- Third-party processors are bound by equivalent security obligations
- Unauthorized role cannot read personal-data endpoints (403)
Evidence an auditor expects
- Technical controlTechnical audit
Device privacy defaults
Evidence that connected device ships with protective default settings
- Policy documentDocument review
Parental control documentation
User guide documenting available parental controls and privacy tools
Questions people ask
- Does UK AADC Standard 14 — Connected toys and devices (ICO Age Appropriate Design… apply to my service?
- It applies when Service is likely to be accessed by children under 18; Service is used in an educational context. It does not apply where Electronic toys or devices that do not connect to the internet and only store personal data within the device itself are outside the code, because the provider has no access to the personal data. The former 'marketed to adults only' row had no source. (ICO AADC Standard 14 - scope).
- From when does this apply?
- UK AADC Standard 14 — Connected toys and devices (ICO Age Appropriate Design… applies from 2 September 2021. Its current status is: in force.
- What evidence does an auditor expect?
- Device privacy defaults; Parental control documentation.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.