Is AI tutoring safe for under-13s in the UK?

It depends entirely on the service. Under UK GDPR, processing a child's data lawfully is harder than processing an adult's, and the ICO's Children's code expects high-privacy defaults, data minimisation and no detrimental use of data for any service likely to be used by under-18s. Services where the parent holds the account and can see every session are the cleanest posture, because an adult is exercising the data rights and supervising the use.

What does the ICO Children's code require of an AI tutor?

The Age Appropriate Design Code is a statutory code of practice with fifteen standards. The ones that bite hardest on a tutoring product are best interests of the child, data minimisation, high-privacy default settings, no detrimental use of data, transparency in language a child can understand, and restraint on profiling and nudge techniques. It applies to any online service likely to be accessed by under-18s in the UK.

Does the Department for Education allow AI tutors?

The DfE's position is that generative AI has real potential in education, alongside expectations about data protection, intellectual property and product safety. It publishes separate product safety standards for generative AI in education, updated in January 2026 to add standards on cognitive development, emotional and social development, mental health and manipulation. That guidance is addressed to schools and to the companies selling to them, not to parents — but it is a fair yardstick for a product you buy yourself.

Will my child be exposed to inappropriate content?

AI tutors built on frontier models have strict safety policies in the model itself, so the risk is far lower than an open chat app with no subject and no boundaries. Ofcom's May 2026 report found that one in ten AI users aged 8-17 have used AI as someone to talk to or 'as a friend', mostly for personal advice — which is the use a tutoring product should decline rather than compete for. Verify that the service publishes a safeguarding policy, and check what it says happens when a child raises something distressing.

Are conversations used to train AI models?

It varies, and it is the single question most worth asking. The right answer is an explicit 'no' in the privacy policy, covering the provider and any model vendor behind it. If the wording is hedged — 'we may use anonymised data to improve our service' — assume yes. aitutors.me does not train any model on your child's conversations, and neither does the model provider on the commercial path it uses.

How long should an AI tutor keep my child's data?

There is no fixed legal number, but the ICO's data-minimisation standard means a provider should keep it only as long as it needs it and should be able to tell you what that period is. Anything beyond 30 days deserves a justification. aitutors.me soft-deletes session records after 30 days by default, and the parent can shorten that to seven days or to the end of each session, or extend it to 90.

Is AI Tutoring Safe for Kids? A UK Parent's Guide

For a well-designed AI tutoring service in 2026 the answer is yes — but only if four questions check out, and only a minority of services answer all four. This guide is for UK parents weighing an AI tutor for a Year 7–9 child. It sets out what the UK's own regulators expect, and how to verify a provider's claims before paying anyone.

How many children are already using AI?

More than half. Ofcom's Children and parents: media use and attitudes report, published on 21 May 2026 from fieldwork in November and December 2025, found that 56% of UK children aged 8–17 say they have used AI, rising to 66% of 16–17s. Among those who have used it, 51% use AI for schoolwork or homework — up from 34% in 2023 and 45% in 2024, though Ofcom cautions that the trend is indicative because its method changed.

That is the reason this question is not academic. The realistic choice in most UK households is not whether a child meets AI, but which AI they meet and on whose terms.

One more figure from the same report is worth sitting with, because it is not about homework at all: one in ten AI users aged 8–17 (11%) say they have used AI as someone to talk to, or "as a friend". Ofcom's qualitative study links that mostly to children seeking personal advice. A tutor that knows where its job ends — and hands a distressed child a helpline rather than a conversation — is answering a need that is already in the room.

What does "safe" actually mean?

Three dimensions, and a service has to pass all three:

Data safety — what happens to your child's conversations and account data
Content safety — what the AI says back, especially under pressure
Safeguarding — how the AI responds when a child shares distress or a signal of harm

A service strong on one and weak on the others is not safe overall. Score all three before signing up.

What do the UK rules actually require?

Three documents give you a yardstick. None of them is written for parents, which is exactly why quoting them at a provider works.

The ICO's Children's code

The Information Commissioner's Office publishes Age appropriate design: a code of practice for online services — the Children's code. It is a statutory code, and it applies to any online service likely to be accessed by under-18s in the UK, which includes an AI tutor bought by a parent for a 13-year-old.

It sets fifteen standards. The ones that bite hardest on a tutoring product are:

Best interests of the child as the primary consideration in design
Data minimisation — collect only what the service actually needs
Default settings set to high privacy, without the child having to find them
No detrimental use of data — nothing that works against the child's wellbeing
Transparency in language a child of that age can understand
Restraint on profiling and nudge techniques — the levers that keep a user on a service longer

The Commissioner's foreword makes the case in one line worth remembering while you shop: "One in five UK internet users are children, but they are using an internet that was not designed for them."

The DfE's guidance on generative AI in education

The Department for Education publishes Generative artificial intelligence (AI) in education (first published March 2023, last updated August 2025). Its position is that generative AI has genuine potential in education, set alongside expectations about data protection, intellectual property and product safety.

It is written for schools and colleges in England, not for you. But if you want to know what a professional would ask before letting this product near a child, that is the document, and its companion — Generative AI: product safety standards — is more specific still. Updated in January 2026, it adds standards covering cognitive development, emotional and social development, mental health and manipulation, on top of the filtering and data expectations you would expect. A consumer AI tutor is under no legal obligation to meet it. Asking whether it does is still the fastest way to find out how seriously a company has thought about this.

Keeping children safe in education

Your child's school works to Keeping children safe in education, the DfE's statutory safeguarding guidance. It is worth knowing it exists for one practical reason: if an AI tutor surfaces something worrying, the school's designated safeguarding lead is a real person with a real duty, and telling them is usually a better next step than telling the software company.

The four questions every UK parent should ask

1. Where is conversation data stored, and for how long?

The ICO's data-minimisation and storage-limitation expectations mean a provider should be able to answer this in one sentence. Ask:

Where are the servers — UK, EEA, or elsewhere?
What is the retention period? Anything beyond 30 days needs a justification.
Can you delete it on demand, and how fast?

How aitutors.me answers: the database is Supabase Postgres in the London (eu-west-2) region, encrypted at rest, with no transfer outside the UK and EEA for our own processing. Session records are soft-deleted after 30 days by default, and from the dashboard a parent can shorten that to seven days or to the end of each session, or extend it to 90. We do not store verbatim transcripts of what a child types — only the tutor's short note of what was covered.

2. Will my child's conversations train AI models?

This is the biggest privacy question, and the one where hedged wording is most common. The policy should contain an explicit "no training" clause covering both the service and the model vendor behind it. If it says "we may use anonymised data to improve our service", assume yes.

How aitutors.me answers: we do not train any model on your child's conversations, now or later, and neither does the model provider on the commercial path our servers use. It is the first line of the "What we never do" section on our privacy page, not a sub-clause somewhere.

3. What happens on a safeguarding indicator?

The right answer: the tutor stops teaching, surfaces a real helpline, ends the session, and tells the parent. The wrong answer is "the AI tries to help" — an AI is not a counsellor and should not act like one.

How aitutors.me answers: a safeguarding signal stops the session and returns one fixed message — "If you're struggling, please talk to a parent or call Childline 0800 1111." We do not counsel and we do not continue the lesson. The billing parent is emailed within the hour, and that email says the child showed a sign of struggling and that we paused the session — not the words they used. A child will not be honest with a tutor that forwards the transcript. The one stated exception is our anonymous surfaces, the free demo and the site guide, where there is no account and therefore nobody to email; the pause and the Childline message are identical there. The whole flow is written up on our safeguarding page.

4. Who holds the account?

Under UK GDPR, processing a child's data lawfully is more demanding than processing an adult's, and the cleanest posture is an adult holding the account, exercising the data rights, and able to see what happened.

How aitutors.me answers: the parent holds the account and is the data controller for their child's session data; we act as the processor on the parent's instructions. Every session appears in the parent's dashboard. We are registered with the ICO under registration ZC127414, which you can look up on the ICO's public register — as you can for any provider that claims to be registered.

A verification checklist

Before you pay anyone:

☐ The privacy policy names a data controller and a lawful basis
☐ There is an explicit "no training on user data" clause, covering the model vendor too
☐ A retention period is stated in days, not in adjectives
☐ A safeguarding policy is published and linked, not promised on request
☐ The company appears on the ICO's public register
☐ The service says what it does when a child asks it to just give the answer

A provider that will not answer these in writing has answered them.

Why "safe" is not the same as "harmless"

A safe AI tutor refuses things — including doing your child's homework. Anti-cheating is part of safety, because the educational outcome is the thing you are paying for, and a tool that quietly hands over answers is doing measurable harm while appearing to help. Ofcom's figure is that 51% of child AI users now use it for schoolwork or homework. How much of that is work being done for them rather than learned is our inference and not theirs — but it is the exact failure a Socratic tutor is built to refuse.

Our tutors use a four-level hint ladder and never give the final answer. That is a safety property, not a feature.

Where to get more help

UK Safer Internet Centre — plain advice for parents and carers on children's online life
Childline — 0800 1111 — free, confidential, 24/7, for the child themselves
Your school's designated safeguarding lead — the person whose job this actually is

Written by Duke Harewood, founder of aitutors.me and author of AI Tutors for Key Stage 3. Every external source above was checked on 12 August 2026. Last updated 12 August 2026.