The Children’s Code

The code applies to information society services likely to be accessed by children in the United Kingdom. PC Guardian runs on a computer a child uses, records information about that child, and shows it to an adult. There is no argument to be had about whether we are in scope.

The code is not a certification and nobody issues a badge for it. What it requires is that the design of the service can be explained and defended. This page is that explanation.

What the code asks. That the best interests of the child are a primary consideration when the service is designed.

What we do. Several product decisions were taken against the grain of what would sell better, because of this standard.

• Nothing about the content of a child’s life is captured — not keystrokes, screens, messages, microphone or camera. Products in this category that do capture those things sell perfectly well. We decided we could not justify it to the child.
• The agent cannot be hidden. A child who discovers later that they were watched secretly has learned something about the adult that we would rather they did not learn.
• When screen time runs out the screen locks. Nothing is closed and no process is killed, because a child losing an hour of homework to a time limit is a failure of ours, not a lesson for them.
• A blocked child is given a way to argue: a button that asks an adult, with room to say why, and an answer that usually arrives quickly.

What the code asks. That a DPIA is carried out to assess and mitigate the risks to children who are likely to access the service.

What we do. A DPIA is mandatory before launch and is one of the seven release criteria for version 1.0.0, alongside the external penetration test and the bypass verification. The conformance assessment against this code is documented as part of the same work.

Being honest about sequence: this page states the design position. The formal assessment is completed before the product is offered, and this page is updated to record it when it is.

What the code asks. A risk-based approach to recognising the age of users, so the standards can be applied effectively to each child.

What we do. Age is known rather than estimated. The carer enters a date of birth for each child and an age band follows from it, which sets the starting rules: what a seven-year-old gets is not what a fifteen-year-old gets. Every one of those defaults is then the carer’s to change.

We do not guess age from behaviour, and we do not build an age estimate from anything a child does. Guessing would mean profiling, which standard 12 is about, and there is no need for it when an adult in the household can simply tell us.

What the code asks. Privacy information that is concise, prominent and in language suited to the age of the child, with explanations offered at the point the use of data is activated.

What we do. Transparency is built into the product rather than published next to it.

• The tray icon is always visible. Right-clicking it opens a plain-English screen listing which categories are blocked, how much screen time is left today, that website addresses are recorded, that keystrokes and screens are not, how to ask for something, and the first name of the adult who sets the rules.
• When something is blocked, the child is told what and why, immediately, with a button to ask about it.
• The same information is written on the public site, addressed to the child in the second person, so a child can read it before it is installed and check afterwards that it turned out to be true.

What the code asks. That children’s data is not used in ways shown to be detrimental to their wellbeing, or contrary to industry codes and government advice.

What we do. The data is used to enforce the rules an adult set and to show that adult what happened. That is the whole of it. It is not sold, not shared for anybody else’s purposes, not used to advertise anything to anybody, and there is no model anywhere being trained on it.

We also assess ourselves against the Coalition Against Stalkerware criteria. Not capturing content is the first line of that; operating visibly is the second.

What the code asks. That you uphold your own published terms, policies and community standards.

What we do. What we publish is deliberately the kind of thing that can be checked. The bypass table on the front page is our own internal attack list, unedited, including the one attack we do not defend against. Each of those attacks is verified as blocked on Windows Home, Pro and Enterprise before a release goes out.

The promise that protection continues when a payment fails is a rule in the requirements with a test against it, not a line in an advert. If we broke it, the build would fail before a customer noticed.

What the code asks. That settings are high privacy by default, unless there is a compelling reason for a different default.

What we do. The defaults are the protective ones. Adult content, gambling, violence, hate and extremism, file sharing and anonymisers are blocked in every age band from the moment a child is added. Safe search is enforced by default. Blocking programs run out of the Downloads and temporary folders is on by default, and so is blocking installers.

Two defaults are deliberately not the strictest, and it is worth saying which and why. USB mass storage blocking is off by default, because a memory stick with schoolwork on it is a more common reality than a memory stick with a portable browser on it, and it is one switch to turn on. And the older age bands start with social media, streaming, gaming and chat open, because a fifteen-year-old handed a machine that blocks all four will simply stop using it, and the carer will uninstall the product in week three.

There is no privacy setting to get wrong here, because there is no sharing, no advertising and no profiling to opt out of.

What the code asks. That only the minimum personal data needed for each element of the service is collected and retained.

What we do. The design decision that matters most here is where the filtering happens. The component that inspects addresses runs on the PC itself. What is sent to us is events — something blocked, something allowed by a permission the carer granted, time used, a rule changed — and not a browsing history. There is no “visited and it was fine” record anywhere in the system, so none exists to be lost, subpoenaed or sold.

• A child’s record is a first name, a date of birth and a derived age band.
• Their picture is drawn from a short text seed. No photograph is ever uploaded, because there is nowhere to upload one to.
• The only free text about a child in the entire product is the reason they may attach to a request, capped at two hundred characters.
• No location data of any kind is collected.

The full inventory, field by field, is in the privacy notice.

What the code asks. That children’s data is not disclosed unless there is a compelling reason to do so, taking account of the child’s best interests.

What we do. We do not disclose children’s data. There is no sale, no sharing for anybody else’s purposes, and no analytics company involved.

Two overseas services are used and neither holds a child’s account: Stripe takes card payments from the adult, and Expo delivers notifications to the adult’s phone. The one honest qualification is that a notification has to say which child asked for what, so the text of that single message passes through a delivery service on its way to the phone. We would rather write that down than leave it to be discovered.

Separately, an allowed address has to be resolved by somebody. Allowed lookups go to Cloudflare’s family resolver, failing over to Quad9, over an encrypted connection, carrying no name and no account identifier. The alternative is the household’s broadband provider seeing the same lookups in plain text, which is what happens on a PC without this installed.

What the code asks. That geolocation is off by default, that an obvious sign is shown when location is being tracked, and that any option making a child’s location visible to others defaults back to off at the end of each session.

What we do. This product collects no location data at all. There is no GPS, no Wi-Fi positioning, no location derived from an address, and no map anywhere in the console. The only IP address recorded anywhere is in the audit log, against an adult making a change in the console, and it is not used to derive a location.

What the code asks. That where parental controls are provided, the child is given age-appropriate information about them — and that where a service lets a parent monitor a child’s activity, the child is given an obvious sign when they are being monitored.

What we do. This is the standard the entire product is judged against, and it is the reason for the single design rule we will not trade away: PC Guardian does not hide.

• The tray icon is always present and cannot be hidden or suppressed by anyone.
• The transparency screen is one right-click away and needs nobody’s permission to open.
• There is no stealth mode, no silent install, and no plan to add either.
• The terms of use make the account holder confirm, for each child, that the child has been informed.

What the code asks. That options which use profiling are off by default, and that profiling is only allowed where there are appropriate measures to protect the child from harmful effects.

What we do. There is no profiling in this product to switch off. Decisions are made by matching an address or an application against lists and against rules a specific adult set. Nothing is inferred about a child, nothing is learned from their behaviour, and nothing is scored.

Automated decisions are made constantly — that is what a filter is — and how they are made, and how a child challenges one, is set out in the privacy notice.

What the code asks. That nudge techniques are not used to lead or encourage children to provide unnecessary personal data, or to weaken or turn off their privacy protections.

What we do. Nothing on a child-facing surface asks a child for data or encourages a weaker setting. The block page offers exactly one action — ask a grown-up — and it is a plain button, not a persuasion pattern. There is no streak, no reward, no gamification of compliance, and nothing that makes a child feel watched into behaving.

We take the same approach with the adult. The limits of this product are published on the front page, above the price, rather than in a footnote after it.

What the code asks. That connected toys and devices include effective tools to enable conformance with the code.

What we do. This standard does not apply. PC Guardian is software that runs on a Windows PC. There is no connected toy, no companion hardware, no microphone, no camera and no internet-of-things device of any kind in the product.

What the code asks. That prominent and accessible tools are provided to help children exercise their data protection rights and report concerns.

What we do. A child using an enrolled PC has, without needing anyone’s permission: the transparency screen listing exactly what is recorded, the request button on every block, and the visible tray icon that proves the software is there.

Beyond the machine, a child can write to us at the address at the foot of this page. We do not refuse a request because the person making it is a child, and how such requests are handled — including the difficult cases where a child and a carer want different things — is set out in the privacy notice. A child can also complain to the Information Commissioner’s Office directly, without our involvement and without an adult’s.

Kinship carers and foster carers are one of the three people this product was designed around, because they sometimes have to evidence to somebody else that reasonable protective measures are in place. A screenshot of a dashboard is not evidence.

This page describes how the product is designed. Two pieces of formal work sit behind it and are completed before the first public release rather than before this page was written:

• the Data Protection Impact Assessment, signed off;
• a documented conformance assessment against all fifteen standards.

When those are complete this page is updated to say so, with the date. Saying it now would be quicker and it would not be true.