Consumer Rights in Algorithmic Child Advertising Exposure Limitation Systems in the UK

Algorithmic child advertising exposure limitation systems are technologies designed to identify child users and automatically restrict, filter, suppress or modify advertising shown to them. They may use age-assurance tools, behavioural profiles, contextual signals, browsing history, device information or machine-learning models.

In the UK, this area sits at the intersection of consumer protection, the UK GDPR, PECR, the ICO Children’s Code, advertising regulation and the Online Safety Act.

1. Core consumer-rights issue

The central question is not simply whether a platform has an advertising-limit algorithm. It is whether the system provides children with effective protection rather than merely claiming to provide protection.

The ICO's current guidance expressly treats targeted online advertising to children as processing of children's personal information for direct marketing. Children receive specific protection because they may be less aware of the consequences and risks of marketing and profiling.

Accordingly, consumers may challenge systems that:

• incorrectly classify children as adults;
• expose children to targeted advertising despite an age restriction;
• use excessive personal data to determine advertising eligibility;
• secretly profile children for commercial purposes;
• make the protective setting difficult to disable or understand;
• provide misleading information about advertising protection; or
• fail to give children meaningful control over their data.

2. UK GDPR and children's advertising

The UK GDPR is central where the limitation system processes personal data.

The ICO states that children have the same basic data-protection rights as adults, including rights of access, rectification, objection and erasure, while organisations must consider children's capacity to exercise those rights.

For advertising, organisations must consider:

• lawful basis;
• fairness and transparency;
• data minimisation;
• purpose limitation;
• accuracy;
• security;
• retention;
• children's best interests; and
• appropriate safeguards.

The ICO specifically says that targeted advertising to children can include behavioural advertising and the profiling activities that support it.

3. Right to object to targeted advertising

One of the strongest consumer protections is the right to object to processing for direct marketing.

The ICO confirms that children have the right to object and that this right extends to profiling connected with direct marketing. If a child objects, the organisation must stop using their personal information for that marketing purpose.

Therefore, a dispute could arise where:

A child or parent requests that personalised advertising stop, but the platform's algorithm continues to use behavioural data to select advertisements.

4. Children's Code — profiling should generally be off by default

The ICO's Children's Code is particularly important.

For services likely to be accessed by children, the ICO expects profiling to be switched off by default, unless the organisation can demonstrate a compelling reason to operate otherwise while taking account of the child's best interests. Commercial marketing is specifically identified by the ICO as unlikely to constitute a sufficiently compelling reason.

The ICO also recommends:

• separate settings for different forms of profiling;
• no bundling of advertising consent with unrelated privacy settings;
• clear information when profiling is activated;
• age-appropriate explanations;
• safeguards against harmful consequences; and
• due diligence concerning third parties receiving children's data. 

This creates an important consumer-rights principle:

Child advertising protection should be effective by design, rather than dependent upon a child discovering complicated privacy controls.

5. Age-assurance algorithm disputes

A major emerging issue is incorrect age classification.

For example:

Actual child → algorithm predicts adult → advertising restriction does not activate → targeted advertisement delivered.

Alternatively:

Adult → algorithm predicts child → advertising restrictions unnecessarily applied.

The first scenario raises stronger child-protection concerns, while the second can raise accuracy, fairness and consumer-autonomy concerns.

A platform should therefore consider:

• accuracy of age-assurance technology;
• false-positive and false-negative rates;
• bias between demographic groups;
• transparency;
• data minimisation;
• security of age-assurance information;
• retention periods; and
• alternative methods where automated classification fails.

The Children's Code recognises age assurance as an area where profiling may have a legitimate protective purpose, distinguishing it from commercial profiling.

6. Algorithmic transparency

A child should be able to understand, in an age-appropriate manner:

Why am I seeing this advertisement?

The ICO expects organisations to explain to children what happens to their personal information and what risks may arise when profiling is activated.

Potential consumer complaints therefore include:

• undisclosed behavioural targeting;
• unclear advertising labels;
• misleading claims such as "child-safe advertising";
• failure to disclose profiling;
• inability to determine why an advertisement was shown; and
• inadequate explanations of automated age classification.

7. Automated decision-making

Some advertising systems use algorithms to decide whether a child is eligible for particular advertisements.

The UK GDPR's automated-decision rules become particularly relevant when automated processing produces a legal or similarly significant effect. The ICO says organisations must implement safeguards where solely automated significant decisions are made, including providing information and opportunities for individuals to express their views.

Not every advertisement shown to a child will necessarily constitute such a significant decision. Nevertheless, the ICO emphasises that behavioural advertising can have substantial effects on children's choices and wellbeing, making careful assessment necessary.

8. PECR and electronic marketing

Where electronic marketing communications are involved, the Privacy and Electronic Communications Regulations 2003 (PECR) may apply alongside the UK GDPR.

The ICO states that, in many circumstances, electronic marketing to children requires consent under PECR, with that consent also potentially providing the relevant UK GDPR lawful basis.

Thus, an algorithm cannot necessarily avoid consent requirements merely because the advertisement is delivered automatically.

9. Online Safety Act

The Online Safety Act 2023 adds another layer for qualifying online services.

Ofcom states that services likely to be accessed by children must undertake children's access and risk assessments and implement protections against harmful content where the relevant statutory duties apply. Providers must also maintain appropriate records and review those assessments.

This matters where an advertising algorithm can expose children to harmful or age-inappropriate material.

The legal issue therefore becomes broader than:

"Was the advertisement personalised?"

It may become:

"Did the platform's algorithmic design adequately protect children from foreseeable harmful exposure?"

10. Consumer-protection concerns

From a consumer-law perspective, potentially problematic practices include:

11. Vulnerable-child protection

The issue becomes particularly serious where algorithms infer characteristics such as:

• financial vulnerability;
• emotional state;
• behavioural tendencies;
• interests;
• health-related characteristics;
• consumption patterns; or
• susceptibility to particular products.

The ICO's Children's Code materials recognise that profiling can create risks including targeting children with fraudulent or misrepresented products and targeting age-restricted products.

A responsible system should therefore avoid turning children's vulnerabilities into advertising opportunities.

12. Remedies available to consumers

Depending on the circumstances, consumers may pursue:

1. Data-protection rights — access, rectification, erasure and objection.
2. Complaints to the organisation operating the service.
3. Complaints to the ICO concerning unlawful processing.
4. Advertising complaints where advertising rules are breached.
5. Consumer-protection remedies where representations concerning child safety or advertising practices are misleading.
6. Civil litigation where a legally actionable breach and loss/damage can be established.
7. Regulatory enforcement by competent authorities.

Children's rights can be exercised by children themselves depending on their capacity, and appropriate assistance from parents or carers may be relevant.

13. Key legal test for an algorithmic limitation system

A useful UK compliance framework is:

Age assurance → Data minimisation → Profiling assessment → Best interests → Advertising classification → Automatic restriction → Human/consumer challenge → Monitoring and audit

The organisation should be able to demonstrate that the system does not merely claim to restrict child advertising but actually performs reliably.

14. Emerging legal disputes

Future UK disputes are likely to involve questions such as:

• Algorithmic age-assurance liability: Who bears responsibility when a child is incorrectly classified as an adult?
• Advertising exposure liability: Can a platform be liable for repeated exposure caused by an algorithmic failure?
• Profiling consent: Was the child's consent sufficiently informed and meaningful?
• Parental controls: What happens where parental settings conflict with the child's own data-protection rights?
• Third-party advertising: Is the platform responsible for the conduct of advertising networks receiving children's data?
• Algorithmic discrimination: Does the age-detection system disproportionately misclassify particular groups?
• Dark patterns: Did interface design effectively pressure children into accepting personalised advertising?
• Harmful advertising: Should the platform have prevented advertising of particular products or services to children?
• Algorithmic auditability: Can the platform demonstrate why a particular advertisement was served?
• Data retention: How long can age-assurance and advertising-profile information be retained?

Conclusion

Consumer rights in algorithmic child advertising exposure limitation systems in the UK are increasingly centred on privacy by design, children's best interests, meaningful control, transparency and effective algorithmic safeguards. The ICO's current position is particularly significant: profiling for targeted advertising to children should generally be off by default, and organisations need compelling justification and appropriate safeguards to depart from that approach.

The strongest legal framework therefore combines UK GDPR + PECR + the ICO Children's Code + applicable Online Safety Act duties + advertising/consumer-protection law. The principal emerging issue is likely to be whether companies can demonstrate that their automated advertising-limitation systems actually prevent harmful or inappropriate commercial targeting rather than simply documenting a theoretical protection mechanism.