What should I ask a baby monitor maker under the ICO Children's Code?

Does the Children's Code apply to my baby monitor?

The ICO's Age Appropriate Design Code — the Children's Code — is a statutory code for online services likely to be accessed by children. Standard 14 covers connected toys and devices: physical products that collect personal data and send it over a network. A Wi-Fi camera that uploads nursery video or audio to an app or cloud sits in that shape of product. The ICO says the code does not apply to electronic toys that never connect to the internet and only store data on the device itself.

A DECT or digital audio set with no app and no cloud is usually outside that connected-device description. This page is for parents who already have, or are about to buy, a networked monitor and want a question list. It is not a ruling that any named model complies, and it is not legal advice.

The ICO writes the connected-toys standard for organisations. Parents can still use the same headings — recording lights, a connection-off control, clear privacy information before purchase — as questions. An unanswered email is information. It is not a safety rating.

What should I ask about recording lights and a connection-off button?

Under the connected-toys standard the ICO tells firms to avoid passive collection and to make it obvious when personal data is being collected. The examples it gives are a light that switches on when the device is recording audio, filming, or collecting data in another way, and a clear sign if a stand-by listening mode is active. It also tells firms to provide a way to switch collection or listening off on the device itself — a connection-off button — or through online controls, so the product can be used unconnected where that is practicable.

• Is there a light or icon on the camera that is on whenever it is filming or recording, including at night?
• If the camera has a listening or wake-word mode, how do we see that mode is active, and can we switch it off?
• Is there a physical switch or a one-tap control that cuts the network connection without pulling the plug?
• If we use that off control, does the parent unit or a local-only mode still work?

How do I ask the maker to delete my child's clips?

The ICO's public guidance on the right to erasure (the right to get your data deleted) says you can ask an organisation to delete personal data it holds, including data collected from a child for an online service. The organisation should reply within one calendar month, unless it can rely on an exemption, and it should also tell others it shared the data with. You can write in plain English; the ICO publishes a template letter.

1. 1
   Find the controller, not only the shop Ask who is the data controller for the app and the cloud clips — the brand on the box, a parent company, or a third-party "connected" supplier. The ICO tells firms they cannot wash their hands of the connected part by outsourcing it.
2. 2
   Say what you want removed List cloud recordings, stills, the child's name or date of birth in the account, and any voice clips. Ask for a factory-reset path that also drops the device from their servers.
3. 3
   Ask how to do it in the app first Which? tests whether you can delete data from a smart monitor if you sell it on. If the app has a delete or close-account control, use that, then email so you have a record.
4. 4
   Keep the date The ICO's one-month clock starts when they have enough to identify you. If they ask for proof of identity, send only what they need.
5. 5
   If they refuse They should explain why and point you to the ICO complaints route. That is their process, not a MayTally service.

What else should I ask under UK PSTI rules?

From 29 April 2024 the UK PSTI product-security regime applies to consumer connectable products, which GOV.UK and the NCSC both list as including baby monitors that join a network. Firms must not ship universal default passwords and must say how long the product will receive security updates. Ask for that support end date in writing if it is missing from the box.

• What is the security-update end date for this exact model, and where is it published?
• Does the camera or app still ship with a shared default password, or must each owner set a unique one?
• Is two-step verification available on the account, as the NCSC suggests turning on where it exists?
• Can I read the privacy notice and terms before I buy, as the ICO asks firms to allow?

What can I paste into one email to support?

Which? has separately reported privacy weaknesses in a popular baby-monitor feature inside a parenting app. Use that as a reason to ask where feeds are hosted — not as a verdict on every brand.

What is this list not?

It is not a ranking, not a claim that any model meets the code, and not advice to skip the Lullaby Trust's room-sharing position. The Lullaby Trust states there is no research showing monitors prevent SIDS, and that a monitor cannot replace a parent or carer in the room for the first six months.

In shortAsk the maker about the recording light, the connection-off control, deletion of the child's clips, the data controller, and the PSTI support date. File the reply. Silence is a data point. It is not a MayTally pass or fail mark.