ICO sets its 2024–2025 priorities to protect children’s online privacy

The ICO introduced its Children’s code of practice in 2021, with a view to ensuring that children’s personal data is better protected in the digital world and has since been working with online services, including websites and games.

Now, the ICO has set out its priorities for 2024 – 2025 for protecting children’s personal data online, building on the progress which it has made to date, and based on the needs for improvement over the coming year.

In the ICO update earlier this month, the Information Commissioner, John Edwards, stated:

• “Children’s privacy must not be traded in the chase for profit. How companies design their online services and use children’s personal information have a significant impact on what young people see and experience in the digital world.”
• “I’m calling on social media and video-sharing platforms to assess and understand the potential data harms to children on their platforms, and to take steps to mitigate them.”

In its Children’s code strategy, the ICO explains that, where organisations fail to properly protect children’s information, it can leave them vulnerable to:

• being inappropriately identified or targeted by strangers;
• having their location tracked; or
• being sent harmful communications.

The ICO has said that it will focus in 2024 – 2025 on social media and video sharing platforms, taking a closer look at the following key areas in particular:

1. Default settings for privacy and geolocation

The ICO says that, by default, children’s:

• geolocation settings must be turned off; and
• profiles must be set to private.

This is due to the inherent risks (related to both their physical safety and / or mental wellbeing) associated with being able to track or ascertain a child’s location.

2. Targeted advertisements for children based on profiling

According to the ICO:

• it may be the case that children do not realise that their information is being collected, nor that it is being used by advertisers to tailor their adverts to them;
• as a result, children may lose “autonomy and control” over their information; and
• this could, ultimately, lead to harms to the child or others, such as financial harms where an advert encourages an in-service charge.

As such, the ICO states that profiling for the purposes of targeted advertising should be off by default unless there is a compelling reason for doing otherwise.

3. Recommender systems’ use of children’s information

A recommender system is a technology that uses complex algorithms to analyse lots of data (for example, your past purchases or browsing history) to suggest things which may be of interest to you.

The ICO notes that content feeds based on a recommender system may “create pathways to harmful content” for children, such as:

• self-harm;
• suicidal ideas;
• misogyny; or
• eating disorders.

The ICO also notes that these recommender systems may also lead to the increased use of the platform by a child and therefore the sharing of more of that child’s personal data with the platform.

4. Children aged 12 years and younger

Under the UK GDPR, only children aged 13 or over can give their own consent for the processing of their personal data through services provided online, such as social media, online games or app stores. For children aged 12 years or younger, a parent or guardian with parental responsibility must provide consent.

As such, the ICO stresses the importance for services to consider:

• how consent is gained in practice; and
• how they might use age assurance technologies to assess users’ ages and apply protections appropriately.

Organisations processing online personal data relating to children should carefully consider the four key areas of focus identified by the ICO and seek to take real, practical steps in line with the ICO’s objectives and to minimise the risks identified by the ICO.