Privacy by Design: A User Interface Analysis of the Age-Appropriate Design Code

Abstract

The internet provides a wide array of benefits for children, but it also presents a multitude of risks that they may face during its use. Increasingly, research shows how online activities can harm children. In response to these concerns, the United Kingdom’s privacy regulator passed the Age-Appropriate Design Code (AADC) in 2020. The California legislature soon followed with a similar AADC in 2022. Other children's privacy design bills have been introduced in more than eight states since then. The AADC differs from previous children’s privacy laws and regulations, because it is based in the privacy by design regulatory framework, expands coverage to a wider range of services, and focuses on child-friendly design principles. Despite debates about the positive and negative normative implications of the AADC, there is no apparent non-anecdotal research about AADC’s influence on the digital environment in the United Kingdom. This thesis evaluates whether gaps exist between the legal standards and best practices established by the AADC and the actual observed features on online services in the United Kingdom. By analyzing these websites using a user interface analysis, this thesis demonstrates that many online services are not following the best practices outlined in the AADC. Specifically, the findings note that the majority of websites reviewed have default behavioral advertising, anti-privacy nudge techniques, limited privacy settings, and limited child-friendly privacy information displays; all practices that should not be common given the United Kingdom’s AADC. Overall, it appears that the United Kingdom’s AADC has had limited impact on the child-related privacy and well-being practices of its online services, calling into question the efficacy of privacy by design as a regulatory framework in its current form. Ultimately, this thesis suggests that regulators should provide more enforcement and policy guidance to help achieve the intended goals of AADC-type legislation. In order to effectively operationalize the broad principles in the AADC, this thesis argues regulators should provide clarity on best practices, mandate proactive disclosures, expand coverage to include third-party platforms and support child-friendly design development through research grants and incentives for innovative firms.