As part of its Children’s Code Strategy, the Information Commissioner’s Office (ICO) reviewed 34 social media platforms (SMPs) and video sharing platforms (VSPs) that give access to under-18s.
Following concerns raised by the review, the ICO has asked 11 of these platforms to clarify issues relating to default privacy settings, geolocation and age assurance and explain how these conform with the Children’s code. It has also raised concerns relating to targeted advertising and set out the changes needed to ensure compliance with both the Children’s code and data protection law generally.
In its Children’s Code strategy published in April 2024, the ICO highlights how children using online services are particularly vulnerable to:
- being inappropriately identified or targeted by strangers;
- having their location tracked; or
- being sent harmful communications.
It also refers to its recent enforcement actions against platforms for failing to protect children’s personal information, including:
- Issuing a fine of £12.7m to TikTok for breaches of data protection law, including failing to use children’s personal data lawfully.
- Investigating Snap’s risk assessment process in relation to its ‘My AI’ generative AI chatbot.
The strategy sets out the ICO’s regulatory focus for 2024- 2025 on the processing of children’s data by SMPs and VSPs:
- Default privacy and geolocation settings. Children’s location information can be misused to compromise their physical safety or mental wellbeing. Children’s profiles should be private by default and geolocation settings turned off by default.
- Profiling children for targeted advertisements. Using children’s information to tailor the adverts they see may impact their autonomy and control over their personal information or lead to financial harm (e.g. via in-service purchases). Unless there is a compelling reason to use profiling, it should be turned off by default.
- Using children’s information in recommender systems. Using behavioural profiling and analysis of children’s searches to generate content feeds may result in them receiving harmful content such as self-harm, suicide ideation, misogyny or eating disorders, spending longer on a platform than they otherwise would and providing platforms with further personal information.
- Using information of children under 13 years old. Platforms that use consent as their legal basis for processing must obtain parental consent to process personal information of children under 13. How they gain consent and use age assurance technologies to assess the age of users and apply appropriate protections are important in mitigating the potential harms facing children.
The ICO expects SMPs and VSPs to design data protection safeguards into their services to ensure they are appropriate for children’s use and development needs and says it will:
- focus on identifying the most serious risks to children’s privacy in these areas; and
- use its regulatory enforcement powers to bring about compliance where necessary, including fines or enforcement notices.
In August the ICO launched a call for evidence to obtain stakeholders’ views and evidence on two areas of children’s privacy:
- The use of children’s personal information in recommender systems including:
- How children’s information is currently being used to design recommender systems and recommend content to children on SMPs and VSPs.
- Examples of good practice related to the collection and use of children’s personal information in recommender systems.
- The use of personal information of children under 13 years old including:
- Evidence about the effectiveness of profiling techniques to identify children under 13 years old.
- Evidence of approaches to reduce the risk of children trying to circumvent age assurance.
- Use and development of innovative new age assurance practices.
The evidence obtained will inform the ICO’s ongoing work to improve how SMPs and VSPs protect children’s privacy. Those wishing to contribute must do so by the closing date of 11 October 2024.
How does this affect my business?
If your business operates an online service that is likely to be accessed by people under 18, it must comply with the Children’s code.
We can help you determine whether your service is subject to the Children’s code and carry out the risk assessments, produce the documentation and implement the privacy-by-design that is necessary to comply with the code.
Compliance with the Children’s code isn’t just about avoiding ICO action: addressing it from an early stage can help you build a resilient, sustainable, reputable, user-friendly and popular online service.
For more information on the relevant areas mentioned in this article please click below:
