Advertising contracts must support children’s privacy settings
The ICO’s latest review found continuing concerns about mobile games’ default privacy settings and ad profiling aimed at children. If your service is realistically used by children, this concerns you too.
The ICO’s latest children’s strategy update identifies continuing concerns about mobile games’ default privacy settings and profiling for targeted advertising, with formal enforcement available where data protection law is breached.
What the ICO’s update actually found
Default privacy settings and profiling for targeted advertising remain a live concern.
The ICO’s children’s strategy progress update, published August 2026, reports on a monitoring programme examining ten popular mobile games and how they protect children’s personal data.
Around 90 percent of UK children play games on digital devices, which is why the ICO is extending its Children’s Code work specifically into mobile gaming, an area its early review found could be especially intrusive by design.
The ICO has identified good practice and secured early commitments from some platforms, and retains formal enforcement powers where data protection law is breached.
Why this is not just a gaming problem
Any advertising-supported service children are likely to use falls inside scope.
The Children’s Code applies based on whether a service is likely to be accessed by children, regardless of whether it is marketed at them. A general-audience app or platform with a meaningful under-18 user base is inside scope in the same way a dedicated children’s game is.
For businesses running advertising or profiling across a broad user base, the practical question is not whether the service is ‘for’ children, but whether children are realistically part of who uses it.
The other half of the update
14 providers, methods listed by Ofcom as capable of being highly effective, now under ICO risk review.
Alongside the gaming review, the ICO is running risk reviews across 14 age assurance providers offering the kinds of methods Ofcom lists as capable of being highly effective, intended to raise standards across that whole ecosystem.
Any business relying on a third-party age assurance provider should expect that provider’s own compliance posture to matter more, not less, over the coming months.
What advertising contracts should actually say
Contracts should document permitted uses and give you a way to verify the technical settings actually work.
Check that advertising SDKs and partners correctly implement whatever privacy choices the platform offers to users, rather than assuming a badge or certification is enough.
Document permitted data uses precisely, restrictions on sharing that data onward to further parties, and a verification right so you can actually check compliance rather than take it on trust.
Build in a prompt suspension mechanism, so a partner found to be non-compliant can be cut off quickly rather than waiting out a notice period while exposure continues.
- SDK and partner implementation checked, not assumed.
- Permitted data uses documented precisely in the contract.
- Verification rights that let you actually confirm compliance.
- Prompt suspension available the moment non-compliance is found.
Where liability should sit
Contractual liability should track who actually controls the technical setting, supported by evidence it works.
Liability clauses should follow each party’s real processing responsibilities, who sets the default, who implements the opt-out, who receives the data, rather than being allocated by convenience or negotiating leverage.
That allocation is only meaningful if it is supported by evidence the technical settings actually function as described. A contractual promise with no way to verify it is not a control, it is a hope.
Questions this raises
Six questions the ICO’s children’s strategy update tends to prompt, answered directly.
What did the ICO’s August update actually cover?
The Information Commissioner’s Office published a children’s code strategy progress update in August 2026, reporting on a review of ten popular mobile games and identifying continuing concerns about default privacy settings and profiling used for targeted advertising to children.
Has the ICO taken enforcement action against specific games?
The update reports a review programme, good practice findings, and early commitments secured from some platforms to strengthen privacy protections, alongside a stated ability to pursue formal enforcement where data protection law is breached.
Does this only affect games aimed at children?
It affects any advertising-supported service children are likely to use, since the Children’s Code applies based on the likelihood of use by children, not a service’s stated target audience.
What is the ICO also doing about age assurance?
It has launched a programme of risk reviews covering 14 age assurance providers offering methods Ofcom lists as capable of being highly effective, aimed at strengthening standards across that ecosystem.
What should a business selling ad space or SDKs actually check?
Whether advertising SDKs and partners correctly implement the platform’s privacy settings, and whether contracts document permitted data uses, restrictions on onward sharing, verification rights and a mechanism to suspend a partner quickly if something goes wrong.
Who carries liability if an ad partner ignores a child’s privacy settings?
Liability should follow each party’s actual processing responsibilities in the contract, supported by evidence the technical settings genuinely work. A contract that assumes compliance without a way to verify it does not protect either party.
Sources
- Information Commissioner’s Office, children’s strategy update, mobile gaming review, published August 2026.
- ICO, Children’s Code strategy progress update.
Running advertising into a service children might use?
Eliga provides embedded commercial and technology counsel to scaling businesses. We can review your ad partner and SDK contracts for exactly this kind of exposure before the ICO’s review reaches your sector.
This page is general information about commercial law and technology. It is not legal advice and does not create a solicitor-client relationship. Take specific advice on anything you are about to negotiate or sign.