The Information Commissioner was required to prepare the Age Appropriate Design Code (the code) by Parliament under s123 of the Data Protection Act 2018 (DPA 2018) in order to address risks in the use of children’s personal data by online services, and resulting harms to children. Parliament deemed that specific regulatory intervention was necessary because, particularly in the context of wider online harms, self-regulation of age appropriate design had proved to be ineffective.