The Code specifies that when used by a child, online services must use their highest privacy settings by default, unless there is a "compelling" reason to do so while keeping into account the best interests of the child. This includes not allowing access to data by other users, location tracking, or behavioural profiling (such as algorithmic curation and targeted advertising). The amount of data collected from children must be minimized, only collecting data that is strictly necessary to deliver service elements that a child is "actively and knowingly engaged" in. A service may not disclose a child's personal data to a third party without a compelling reason to do so.
