The Information Commissioner's Office (ICO) has released a list of 16 recommendations for social media platforms to use when designing for children, including turning off geolocation by default and letting them know when a parent is watching.
In a report called 'Age appropriate design: a code of practice for online services,' the ICO repeatedly states that design decisions have to be made in the best interests of the child, and that its suggestions can only be ignored if the relevant company can prove it's acting for the child and not itself.
One of the most interesting rules in the proposal is the section on "nudge techniques," also known as "dark patterns." The report defines these as "design features which lead or encourage users to follow the designer’s preferred paths in the user’s decision making," and you'll recognise what they mean as soon as you see the example graphics:
Yep, those crappy ways tech platforms try to trick you into doing what they want. Like instead of making the options "yes" or "no," making them "YES" and "later."
The report also specifically calls out Facebook's Likes and Snapchat's Streaks as ways of encouraging people to interact more so the platform can harvest more data, and warns against using these techniques for children.
Some of the suggestions we'd actually like to see enacted for everyone -- like the transparency requirement:
The privacy information you provide to users, and other published terms, policies and community standards, must be concise, prominent, and in clear language suited to the age of the child. Provide additional specific ‘bite-sized’ explanations about how you use personal data at the point that use is activated
And the requirement to keep geolocation features off unless specifically requested:
You should also provide a clear indication of when the child’s location is and isn’t being tracked (e.g. by use of a clear symbol visible to the user), and ensure that location tracking can’t be left on inadvertently or by mistake.
You should make sure that any option which make the child’s location visible to others is subject to a privacy setting which reverts to ‘off’ every after each session.
And defaulting to the highest privacy settings:
Settings must be ‘high privacy’ by default (unless you can demonstrate a compelling reason for a different default setting, taking account of the best interests of the child).
These requirements might actually be enabled for all of us if companies can't implement robust enough age verification -- the report says in that case they'll have to assume all users are children. We're kind of OK with that, especially having read Facebook comment sections.
The proposals were developed in partnership with parents, designers, developers, academics and children themselves. They'll now go to public consultation until the end of May, and if approved, tech companies could see themselves fined up to four per cent of their (global!) turnover if they don't comply. Ouch.
Information Commissioner Elizabeth Denham comments:
"This is the connected generation. The internet and all its wonders are hardwired into their everyday lives. We shouldn’t have to prevent our children from being able to use it, but we must demand that they are protected when they do. This code does that."
However, she added that more is needed:
"The ICO’s Code of Practice is a significant step, but it’s just part of the solution to online harms. We see our work as complementary to the current focus on online harms, and look forward to participating in discussions regarding the Government’s white paper."
Meanwhile, Baroness Beeban Kidron OBE, who chaired the parliamentary debate that led to this report, comments:
"I welcome the draft code released today which represents the beginning of a new deal between children and the tech sector.
For too long we have failed to recognise children’s rights and needs online, with tragic outcomes.
I firmly believe in the power of technology to transform lives, be a force for good and rise to the challenge of promoting the rights and safety of our children. But in order to fulfil that role it must consider the best interests of children, not simply its own commercial interests. That is what the code will require online services to do. This is a systemic change."