Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

ICO research highlights growing gap between parental confidence and children's digital reality

Fifty two per cent of children would bypass an age check, rising to 64 per cent where a parent had already helped them do it, according to ICO research published today. The Information Commissioner's Office (ICO) found that 31 per cent of parents admitted assisting their children in circumventing age limits. This new research highlights a significant gap between parental confidence in online controls and the reality of children's digital lives.

The ICO's research, based on an online survey of over 4,000 children aged eight to 17 and their parents, also found that 91 per cent of parents reported using controls or monitoring tools. However, 41 per cent of children stated they had tried to circumvent these measures, with nearly half finding it easy. In depth interviews with 30 children and their parents further illustrate the emotional complexities, with many parents feeling resigned rather than empowered by the digital landscape.

One eight year old boy, Theo, agreed to sharing precise geolocation data with 141 vendors and 71 ad partners without understanding consent, stating he "just pressed consent…It’s just to get it away… I don’t know [what consent means], but I think it means close. It just stops it [the pop up]." The ICO's Switched on to privacy campaign encourages parents to engage in regular conversations with their children about online privacy, noting that children who discuss privacy weekly are more likely to feel safer. The campaign offers a framework: chat, choose, check.

The ICO's children's code strategy continues to drive improvements, securing commitments from Snapchat to strengthen age assurance measures and enhancing interactive map features on Snapchat and Instagram. Work with EdTech providers has also led to significant improvements, with 98 per cent of 596 recommendations acted upon across 28 providers since April 2024, protecting an estimated five million child users.

Children's Code strategy

Who this binds
Online service providers, including social media platforms and EdTech companies, must implement robust age assurance and privacy by design measures for child users.
What changed
Snapchat committed to strengthening age assurance measures and improving interactive map features for children, as part of the ICO's ongoing children's code strategy.
What to check
Organisations should review their age assurance mechanisms and privacy settings for child users, ensuring they meet the standards promoted by the ICO's children's code.
What this does not mean
This research and strategy update does not introduce new legal obligations beyond those already established by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Send this to your team

The ICO's latest research reveals 52 per cent of children would bypass age checks, prompting continued regulatory action under the children's code, including commitments from Snapchat to enhance age assurance and map features.

Today's question

A social media platform operating in New York is developing a new feature that uses AI to personalize content feeds for all users, including those under 18. Under the New York SAFE for Kids Act, what is the primary obligation for this platform regarding its minor users?

  1. Implement robust age verification for all users, but no further action is required for personalized feeds.
  2. Obtain verifiable parental consent before providing algorithmically personalized feeds to users under 18.
  3. Disable all personalized content features for users under 18, regardless of parental consent.
  4. Provide an opt out mechanism for personalized feeds for minors, without requiring parental consent.

Answer this question on the site

Worth knowing

  1. California Privacy Protection Agency settles with two data brokers for registration failures and privacy violations

    Data brokers operating in California must ensure they are properly registered under the Delete Act and comply with CCPA requirements for consumer rights requests, as CalPrivacy is actively enforcing these provisions.

  2. New Jersey becomes third state to regulate data driven pricing this year

    New Jersey based consumer facing businesses must now account for state level regulation of data driven pricing practices.

  3. Dutch Data Protection Authority launches pilot for Fundamental Rights Impact Assessment under AI Act

    Organizations planning to deploy high risk AI systems should consider participating in pilot programs like the AP's FRIA initiative to prepare for upcoming AI Act compliance obligations.

  4. Australian hotel chain leaks guests' PII after third party database breach

    Organisations must reinforce their vendor risk management programmes to mitigate the privacy risks associated with third party data processors, as demonstrated by the Australian hotel chain's PII leak.

  5. ANPD decision on Discord analysed for digital economy implications

    Privacy professionals managing digital platforms should review the ANPD's decision on Discord for insights into regulatory interpretations of platform risk architecture and preventative civil liability.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.