The UK Information Commissioner’s Office has created a new code of 15 principles that aim to make the internet a safer place for children, including the prevention of self-harm or suicidal content, sexual grooming risks, and location sharing. The ICO will allow companies a year of transition to abide by the new rules, and then will enforce the code starting in Fall of 2021.

Companies who fail to enforce the safety code will be breaking the law, and will face fines up to £17m, or 4 per cent of global turnover. Some of the 15 principles will require companies to set default privacy settings to high, set default location sharing services to off, and block “nudge” notifications that encourage children to loosen their privacy settings.

“Personal data often drives the content that our children are exposed to – what they like, what they search for, when they log on and off and even how they are feeling,” said Elizabeth Denham, the information commissioner.

Additionally, the ICO warned companies that do not want to attract children to their site to make it a priority that such users can’t gain access: “If your service is the kind of service that you would not want children to use in any case, then your focus should be on how you prevent access. If your service is not aimed at children but is not inappropriate for them to use either, then your focus should be on assessing how appealing your service will be to them.”

“This transformative code will force high-risk social networks to finally take online harm seriously and they will suffer tough consequences if they fail to do so,” said Andy Burrows, the NSPCC’s head of child safety online policy.

Burrows continued, “For the first time, tech firms will be legally required to assess their sites for sexual abuse risks and can no longer serve up harmful self-harm and pro-suicide content. It is now key that these measures are enforced in a proportionate and targeted way.”

The biggest companies that will likely be affected by this new code will be social media giants such as Facebook, Twitter, Instagram, TikTok, SnapChat and YouTube. Hesitant companies should be made aware that the new code is legally backed by a requirement in the Data Protection Act 2018, citing the “age-appropriate design” of websites.