Protecting children's privacy in a digital world

The IAPP conducted a case study centered around a hypothetical app, “PerfectPetPal” (PPP), a pet simulator aimed at attracting a broad audience, including children. This app was created to test the application of various privacy laws. Participants used the app’s scenarios to understand how different privacy regulations impact its operations. For the gamers and privacy-interested amongst us, here is some background information on the fictional app.

About PerfectPetPal 

PerfectPetPal is a pet simulator app with over 100 million monthly active users globally, where users can create, customize, and interact with virtual pets. The app offers various engaging features, including the “Look Alike” tool, which allows users to upload selfies to customize their pets to resemble them, and “PetPoll” a quiz that helps tailor pets to users’ preferences. Users can also take their pets on virtual and real-life walks, known as “prambles,” which suggest pet-related locations and shopping deals. Social interaction is encouraged through “pleagues” interest-based groups where users can share pet photos and tips, and “PetTales” a storytelling feature that creates personalized stories using information shared by users. The app uses a virtual currency called “petcoin” for purchasing items and experiences for pets. Important to mention PPP mentions it’s “data law compliant” status, there are concerns about its extensive data collection, especially from children, and the clarity of its privacy notices and consent processes.

Here are the things that we find noteworthy:

The study shows the importance of determining whether your platform is directed at or likely to be accessed by children. This understanding is vital for implementing appropriate privacy measures, including age verification and parental consent mechanisms, to comply with laws like COPPA and GDPR. Properly identifying your audience helps protect young users and make sure that your platform meets legal requirements.

Conducting Data Protection Impact Assessments (DPIAs) is essential when dealing with children’s data, as it is often considered high-risk due to its sensitivity. A DPIA helps organizations assess potential privacy risks associated with the collection, use, or disclosure of children’s data and develop strategies to mitigate these risks. This is especially important in regions like the EU, Canada, and various U.S. states where conducting DPIAs or Privacy Impact Assessments (PIAs) is mandated by law. The DPIA process should consider the perspectives and experiences of young users and include an intersectional analysis to address the privacy risks for vulnerable children.

For more detailed guidance on performing a DPIA, refer to our blog on DPIAs.

The case study underlines the importance of obtaining verifiable parental consent when collecting children’s data, as required by regulations like GDPR and COPPA. For children under the age of digital consent- typically 13 to 16 depending on the jurisdiction – consent must be obtained from a parent or guardian, and reasonable efforts must be made to verify this consent. Additionally, the data collected should be minimized to only what is necessary for the intended purpose. For instance, collecting extensive personal details such as home addresses and phone numbers without justifiable necessity may violate data minimization principles under GDPR Article 5(1)(c) and similar provisions in U.S. law. Organizations are responsible for making sure that the amount and type of data collected are proportionate to their specific use case, adhering to strict data protection standards.

For more detailed guidance on parental consent, refer to our blog on consent.

The case study reveals the importance of creating privacy notices that are clear, concise, and easily understandable by children and their parents. A 39-page privacy notice, as seen in PPP’s example, is not user-friendly and may violate transparency requirements under regulations like the GDPR and COPPA. These laws mandate that privacy information be provided in plain, non-technical language and be easily accessible, particularly when services are used by children. The GDPR’s Article 12 and guidelines from the ICO and other authorities stress that all information must be presented in a way that resonates with children, potentially using visual aids or simplified formats to enhance understanding.

The user interface plays a vital role in obtaining valid consent and avoiding dark patterns – deceptive design practices that manipulate users, particularly children, into making privacy-compromising decisions. For example, pop-ups with options like “Yes,” “Ask me later,” or “I’m not sure” can confuse children into sharing more data than necessary. Regulatory bodies, including the DPC and FTC, emphasize that such tactics do not meet the standards for valid consent. Instead, interfaces should present choices equally, making privacy-friendly options as straightforward to select as any other. The ICO Children’s Code encourages designs that promote privacy-preserving behaviors.

The case study underscores the need for heightened protection when handling sensitive data, such as biometric and location information, especially concerning children. PPP’s features like “Look Alike,” which uses biometric data, and “pramble,” which utilizes precise geolocation, require strict adherence to privacy laws. Under GDPR Article 9 and various U.S. state laws, biometric data is considered highly sensitive, and its processing is heavily restricted without explicit consent or a clear legal basis. Similarly, geolocation data, particularly when tracking children’s movements, demands privacy measures, including obtaining consent from parents or guardians and keeping in mind data minimization. Organizations have to make sure that such sensitive data is only collected and processed when necessary, with clear and informed consent, to protect children’s privacy and comply with regulatory requirements.

The digital landscape and privacy regulations are continually evolving. Regular reviews and updates to privacy practices are essential to remain compliant and address new risks. Organizations should conduct periodic audits and revise policies as needed to protect children’s privacy effectively and reduce potential legal exposure.