Quarterly BAS Due (July–September)
Form 1099-NEC & Contractor Payment Reporting Check
Why this matters.
The Age Appropriate Design Code, known as the Children’s Code, sets out 15 standards under sections 123–125 of the Data Protection Act 2018 for any online service “likely to be accessed by children” in the UK — a threshold that catches far more general-audience websites and apps than most businesses realise. It requires privacy settings to be high by default, age-appropriate application of data protection principles, and proportionate age assurance where a service isn’t suitable for children but might still attract them. After a transition period, full compliance has been expected since September 2021, but 2026 has marked a decisive shift from guidance to active enforcement.
In February 2026, the ICO fined Reddit £14.47 million and MediaLab, operator of Imgur, £247,590, both for failing to implement adequate age assurance measures. Alongside these fines, the ICO published a Children’s Code Strategy update reviewing age assurance practices across 17 platforms popular with children, and launched a targeted monitoring programme focused on services that rely solely on self-declaration — simply asking a user to tick a box confirming their age — as their only check. The ICO is also coordinating enforcement with Ofcom under the Online Safety Act, and a Digital Fairness Act addressing manipulative design and dark patterns aimed at children is expected later in 2026. Any business running a website, app, or online service that could reasonably be accessed by under-18s should review its age assurance and default privacy settings now.
