Children’s Data Protection — United Kingdom & Morocco
In 2018, the UK created the Children’s Code, legislation requiring digital platforms to protect minors’ personal data by default. Morocco’s Law 09-08 on personal data protection remains the reference framework. But in 2026, how many parents actually know what these laws protect — and what they do not?
The UK Children’s Code: what it requires
In force since September 2021, the Children’s Code requires online services likely to be used by minors to:
- Disable geolocation and profiling by default
- Ban “dark patterns” (deceptive interfaces) that push children to share more data
- Assess and minimise the impact of services on minors
- Not use children’s data for commercial purposes without explicit consent
In 2023, TikTok was fined 12.7 million pounds by the ICO for violations involving data from 1.4 million British children under 13. In 2022, Meta was fined 405 million euros by the Irish data authority for unlawful processing of minors’ data on Instagram.
Morocco’s Law 09-08 and child protection
Law 09-08 on personal data protection has been in force since 2009, supervised by the CNDP. Its specific application to minors’ data remains less developed than in Europe. Updates are expected as Morocco progressively aligns with international standards. Notably, Morocco has ratified the UN Convention on the Rights of the Child, which includes the right to privacy for minors (Article 16).
What the law does not cover — and what parents must do
No law can cover in real time what your child voluntarily shares. The most sensitive data — photos, location, conversations — is often shared by the child themselves, outside any legal protection. Real protection requires:
- Teach what personal data is — First name, school, address, photo in school uniform, location: all can be used to identify or locate a child.
- Review privacy settings on every app — Most apps collect more data than necessary. Regularly check permissions for camera, microphone, and location.
- Avoid school email for account creation — It can reveal the school, city, and full name of the child.
- Explain the digital footprint — What your child posts today can be found in 10 years. This reality must be understood from the earliest age.
Most concerning platforms for children’s data
A Privacy International report (2023) analysed 136 apps popular with children. Results: 72% collected data for advertising, and 48% transmitted data to third parties without clear user information. Highest-risk categories: gaming apps, video creation tools, and online learning platforms. Cyber Sqool includes dedicated digital privacy modules to prepare children to navigate this complex landscape.
