Privacy information for children: what to publish on your school website
If your school runs an app or portal that children use, your website needs privacy information in plain language children can understand, with a version for parents.
Check this on my websiteWho it applies to
- Published on
- Every school and trust website
- School type
- Academies and maintained schools
- School stage
- All stages, from early years to sixth form
- Only applies to
- Where the school or trust itself provides an online service likely to be accessed by children (portals, apps); a public information website alone is not treated as such a service
- Does not apply to
- No school types are excluded
When it's due
Keep it up to date
There's no fixed date. Update it whenever something changes.
What's needed
Publish a short, plain explanation of how each school-run app or portal uses children's data, with a version for parents, on the privacy notice page on your website.
What it must contain
4 parts- Says what the service does with children's dataMust: Required by law, statutory guidance or the academy's funding agreement.
- Gives children the privacy information in clear, plain language they can understandMust: Required by law, statutory guidance or the academy's funding agreement.
- Provides the privacy information in a format suitable for parentsShould: Recommended in official guidance, such as the DfE's. Not a legal requirement in itself.
- Lets children or parents choose which version of the privacy information they seeShould: Recommended in official guidance, such as the DfE's. Not a legal requirement in itself.
What the official sources say
Set out in 1 official source:
Children's code: standard 4 transparency
“The controller shall take appropriate measures to provide any information referred to in Article 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject the information may be provided orally, provided that the identity of the data subject is proven by other means.”
Must: Required by law, statutory guidance or the academy's funding agreement.§ 'Why is it important?' section, block quote of GDPR Article 12 (introduced by 'Article 12 of the GDPR requires you to provide children with this information in a way in which they can access and understand it')
Firstly you need to provide the privacy information set out in Articles 13 and 14 in a clear and prominent place on your online service. You should make this information easy to find and accessible for children and parents who seek out privacy information.
Should: Recommended in official guidance, such as the DfE's. Not a legal requirement in itself.§ 'How can we make sure that we meet this standard?', 'Provide clear privacy information'
Show 3 more from this source
Provide full privacy information as required by Articles 13 & 14 of the GDPR in a format suitable for children within this age group. Allow children to choose between written and video/audio options.
Expected: Inspectors expect to see it, though it isn't a legal requirement.§ 'Tailor your information to the age of the child', recommendations table, row 10-12 (rows 13-15 and 16-17 carry an equivalent sentence)
Provide full privacy information as required by Articles 13 & 14 of the GDPR in a format suitable for parents.
Expected: Inspectors expect to see it, though it isn't a legal requirement.§ 'Tailor your information to the age of the child', recommendations table, rows 0-5, 6-9 and 10-12 (identical sentence in each)
You should make all versions of resources (including versions for parents) easily accessible and incorporate mechanisms to allow children or parents to choose which version they see, or to down-scale or up-scale the information depending on their individual level of understanding.
Should: Recommended in official guidance, such as the DfE's. Not a legal requirement in itself.§ 'Tailor your information to the age of the child'
Questions schools ask
Do schools need a children's privacy notice for their apps?
Academies and maintained schools must. It only applies to where the school or trust itself provides an online service likely to be accessed by children (portals, apps); a public information website alone is not treated as such a service.
What does privacy information for children need to include?
Says what the service does with children's data; children the privacy information in clear, plain language they can understand; Provides the privacy information in a format suitable for parents; Lets children or parents choose which version of the privacy information they see.
When do we need to update children's privacy information?
Keep it up to date. There's no fixed date. Update it whenever something changes.
Where does the requirement for the privacy information for children come from?
It is set out in Children's code: standard 4 transparency.
Recent changes to the official guidance
The official sources for this requirement don't publish dated change notes. We check them for changes ourselves.
We last checked these sources on 21 September 2026.
Is this on your school's website?
Enter your school email address and we'll check your website for this requirement.
It's free, and the result arrives by email.
Official wording that does not apply to schools (5)
– While schools are not Information Society Services (ISS) and are not in scope of the Children’s code, edtech providers may be in scope of the code.
The code applies to edtech services that are likely to be accessed by children on a direct-to-consumer basis. These are services which are directly available to users on open platforms, such as the web or via an app store.
This code applies if children are likely to use your service. A child is defined in the UNCRC and for the purposes of this code as a person under 18.
The code does not apply to edtech providers where all the following criteria are met: – the edtech service is not accessed on a direct-to-consumer basis; – the edtech provider only processes children’s personal information to fulfil the school’s public tasks and educational functions (as determined by the school); and – the edtech provider acts solely on the instruction of the school, and does not process children’s personal information in any other form beyond these instructions.
This code does not apply to websites or apps specifically offering online counselling or other preventive services (such as health screenings or check-ups) to children. This is because s123 scopes out ‘preventive or counselling services’. However, more general health, fitness or wellbeing apps or services are covered.
Official sources last checked 21 September 2026 · register version 1.0.4