The UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

Given the importance of protecting freedom of expression and addressing specific issues relating to the digital news industry we have developed a set of FAQs in consultation with the News Media Association.

These FAQs reflect the safeguards and regulation already in place for this sector and the proportionate approach that can be taken to conforming to the code, linked to the level of risk posed by the sector.

These FAQs have been developed for the news media, to help ensure the Code has proportionate implementation. They were drawn up in response to issues raised during the consultation period of the Code with input from the News Media Association.

The FAQs are intended to provide clear advice on issues that would benefit from specific clarification. The FAQs may be revised to ensure that remains the case and the Commissioner will consult with the News Media Association over any such changes.

Are digital news media covered by the Code?

There is no exemption for the news media in the Data Protection Act 2018 provisions on the Code. Given the evidence that children often use news media, many digital news media services will fall under the ‘likely to be accessed by children’ test. These services typically process children’s personal data to inform personalised news and digital advertising feeds. Personal data may also be shared with third parties or used for other purposes.

That said, the ICO recognises that digital news media are not a core concern for children online, so the provisions of the Code can be applied in a risk-based and proportionate way to reflect this.

What impact will the Code have on news content?

None. The ICO is not a content regulator. The focus in the Code is on the use of personal data to personalise content feeds (suggesting particular content to particular users, based on their previous browsing history), rather than regulating the content itself.

The Code makes clear the importance of children’s own fundamental right to receive information by having access to the media. We recognise the safeguards already present in existing regimes for regulating the media that balance regulation with the public interest in journalism. For media services that already comply with these existing safeguards there should be no impact on the news content they provide.

Will news media need to formally age-verify their digital services in order to allow users to access news content?

No. We recognise the importance of open access to digital news media, including for children to use it to learn about the world around them. The code reflects a risk-based approach. We have acknowledged the general level of risk for this industry and for those who live up to their existing obligations, this will be low. Ultimately, the approach that news media services will have to take to establish the age of their users will depend on how their service uses personal data. Online services have a choice. The code makes clear that formal age verification will not always be needed to establish age and self-declaration can be used if appropriate to the level of risk.

They can either:

  • establish age with a level of certainty that is appropriate to the risks to children that arise from their use of personal data, or
  • ensure they follow the Code and protect the personal data of all users by default instead (so that they don’t have to establish age as above).

We will work with the news media industry during the Code’s transition period (12 months) to enable proportionate and practical measures to be put in place for either scenario.

How will the Code affect digital advertising?

The Code will not prevent the media from using behavioural advertising.

We acknowledge the importance of this revenue stream to the media industry, something we have also recognised in our wider work on ad tech.

Under existing legislation (the GDPR and PECR) user consent is already needed before behavioural advertising can take place. The Code says that profiling must be switched off by default for child users, or all users if age is not established. Valid GDPR and PECR consent and transparency for cookies will allow this profiling for advertising to be ‘switched on’.

The ICO recognises that the risk from behavioural advertising is also lowered when the media apply the relevant Advertising Standards Authority codes.

What about privacy information, will we have to create multiple versions to conform to the Code?

No. Where the information you are trying to convey is the same, regardless of the age of the user, you will be able to create a single version provided that this is, in fact, genuinely accessible to all who are likely to visit your website.

How are you guarding against disproportionate outcomes?

The Code has been developed in the context of the ICO’s Regulatory Action Policy, approved by Parliament. This embodies a proportionate and risk based approach to any regulatory action. The Code also incorporates this approach and specifically references the importance of freedom of expression and respecting a child’s right to access information online. In accordance with section 127 of the Data Protection Act 2018, the Commissioner and the Courts must take the Code, and therefore its proportionate approach, into account wherever relevant when considering compliance with the law.

What else will news media need to do to conform to the other standards in the Code?

Once the process for laying the Code in Parliament is complete, there will be a transitional period of 12 months. During this period we are committed to assisting industry to develop solutions to conform with the Code. We particularly recognise that small organisations have specific needs for further assistance, including those within the news media sector. We will dedicate a workstream within our implementation programme to assisting local news media and helping them conform with the Code in practice.