Child Data Protection in the UK & Morocco: Growth and Safety Ahead

In today’s fast-moving digital world, where children spend more and more time online, protecting their personal data is a vital step toward ensuring a safe and supportive digital environment. The UK’s experience with the Children’s Code offers an example of how legislation can adapt to the times, and it’s worth noting that this journey began only a few years ago. This means other countries, including Morocco, have a real opportunity to develop their own solutions and regulations tailored to their environment, creating strong protections for future generations.

Before the Children’s Code in the UK

Before September 2021, the UK relied on general data protection laws:

  • Data Protection Act 1998 (DPA 1998): Provided a foundation for personal data protection but did not address children’s online privacy specifically.
    Read more

  • Data Protection Act 2018 (DPA 2018): Incorporated the EU General Data Protection Regulation (GDPR) into UK law and included a provision directing the UK’s Information Commissioner’s Office (ICO) to create a specific code for children’s data protection.
    Read more

  • Laws like the Children Act 2004 focused on child welfare in a general sense, but without covering the specifics of the digital world.
    Read more

This shows that even in leading economies, specialised rules for children in the digital space are a recent development.


The Children’s Code: A Step Forward

In September 2021, the UK introduced the Age Appropriate Design Code, a set of 15 mandatory standards to make digital services safer for children.
Key standards include:

  1. Best interests of the child first in all design decisions.

  2. Data minimisation — only collecting what is strictly necessary.

  3. High privacy settings by default.

  4. No geolocation tracking unless absolutely needed.

  5. Clear and age-appropriate explanations of how services work.

  6. Ban on “nudge” techniques that push children to weaken their privacy.

These requirements led to significant changes by major companies, such as disabling targeted ads for children on Instagram and turning off autoplay for children’s videos on YouTube.

Source – ICO
Wired article

Morocco’s Position: A Strong Base to Build On

In Morocco, Law 09-08 (2009) forms the foundation for personal data protection, enforced by the National Commission for the Control of Personal Data Protection (CNDP).
This law ensures important rights, such as notification, access, and correction, and provides a framework that can be strengthened by adding dedicated measures for children’s online privacy.

There are also recent legislative discussions, including a proposal to set the digital age of consent at 16 and require parental approval for processing data of younger children — a sign of readiness to evolve and keep pace with global developments.

Law 09-08 – CNDP
CaseGuard analysis

Comparison

AspectUK Before 2021After Children’s Code (2021)Morocco Today
Legal frameworkDPA 1998 + DPA 2018 + GDPR15 clear, enforceable standardsLaw 09-08 (2009) general
Child-specific protectionsNoneComprehensive and specificStrong base, ready to expand
Supervisory authorityICOICOCNDP
Age verification rulesLimitedMandatory, multi-layeredUnder discussion and review

Conclusion: A Window of Opportunity for Morocco

The UK’s case proves that dedicated legislation for children’s digital safety is a relatively new global trend.
Morocco already has a solid legal foundation and active regulatory oversight. With ongoing discussions about specific protections for children, the next few years could see significant progress.

Acting now to set child-focused standards could position Morocco as a leader in the region, showing that building a safe digital environment is not just a legal responsibility but an investment in the country’s future.


Created with