“There can be no keener revelation of a society’s soul than the way in which it treats its children.” – Nelson Mandela. Children’s online privacy has become increasingly important as they use more digital media than any other generation. Technology provides great opportunities to children, but do they know the risks involved? Parents, do you talk to your children enough? And organisations, are you doing enough to protect children from unnecessary harm? How does your organisation treat children in how it processes their personal data? Remember that data protection laws such as the GDPR in the EU, DPA in the UK, or POPIA in South Africa define children differently. They usually define a child as someone under a certain age: 16 in the EU, 16 or 13 in the UK, and 18 in South Africa.

Let’s look at some of the leading, global developments and how these principles can help organisations design their products and services to put children’s best interests first.

USA

The California Age-Appropriate Design Code Bill

This code was introduced by the State of California in February 2022, to create a digital environment that is safe for children. An environment where they can ‘learn, explore and play’. It’s aimed at protecting minors under the age of 18. The Legislature noted that where digital products were likely to be accessed by children, higher privacy protection by design and by default should be offered.
A business that provides digital goods or services accessible by a child must not:

  • collect information that is not necessary to provide the good or service,
  • collect any precise geolocation information by default, unless they can demonstrate a compelling reason that doing so would be in the child’s best interests,
  • use dark patterns or other techniques that would encourage the children to provide personal information beyond what is necessary and;
  • engage in conduct that is harmful to the consumer’s physical or mental health.

Kids Online Safety Act (KOSA)

KOSA gives families the tools they need to protect children online. The legislation would require social media platforms to put the interests of children first; by requiring them to make safety the default. Senators and policymakers witnessed increasing rates of self-harm, hospitalisations, depression, and even suicide among children and teenagers. This created the need for the Act.
The bill:

  • requires social media platforms to allow children to disable addictive product features, and opt out of algorithmic recommendations;
  • gives parents new controls to help support their children and identify harmful behaviours and;
  • creates accountability for social media and a duty to prevent and mitigate harm.

Ireland

Ireland has produced three beautiful, short guides for children on data protection and their rights under the GDPR. The target of these guides is children aged 13 and above. They support our point about making documents easily accessible and understandable to children.

Ireland's guide on children's online privacy

  1. Data protection – what’s it all about? This guide introduces children and young people to personal data and data protection and their importance. It covers topics such as content posted by children on social media. It also refers to information they might not know is being collected about them, for example, capturing their images on security cameras in malls, or information collected on their phones when they connect to public Wi-Fi.
  2. My data protection rights: Introduces children to a different DP right and how to use it.
  3. Top tips for keeping your data safe online: This guide has 15 useful tips to help children – and indeed everyone, especially adults with children – keep their data safe when they go online.

Actions you can take:

  • Conduct a Data Protection Impact Assessment (DPIA) to understand whether your organisation’s impact is high or low.
  • Keep up to date with child privacy laws and regulations by joining our data protection programme. We summarise the key learnings we come across and update the programme frequently.
  • Contact us for any further help on processing child personal information, we are keen to help you.

This post was written by Michelle Jonker and Thabile Themba