Code of Practice for Online Safety, App Distribution Services

The Code applies to App Distribution Services designated or to be designated under section 45K(1) of the Broadcasting Act 1994. It requires the provider of a designated service to minimise all users' exposure to harmful content (sexual content, violent content, suicide and self-harm content, cyberbullying content, content endangering public health, and content facilitating vice and organised crime) through content guidelines and content moderation of the apps it distributes.

For children, defined as anyone below 18, the provider must have systems and processes, including age verification or another means of age assurance, so that a user's age or age range can be established with reasonable accuracy. Unless the service restricts children's access entirely, a child's account must have differentiated, more restrictive default settings.

Age assurance must be implemented consistently with the Personal Data Protection Act 2012's data-protection provisions and the Personal Data Protection Commission's guidelines on children's personal data, including data minimisation. A provider that has not yet implemented age assurance must submit an implementation plan and timeline to IMDA for its agreement. The provider must also use technology to proactively detect and swiftly remove child sexual exploitation and abuse material.