Children and Online Privacy: What Data Apps and Websites Collect

Why Children Online Privacy Matters

When a child downloads an app, creates a social media account, or plays an online game, they typically enter into a data relationship with the company behind that product, often without fully understanding what data is collected, how it is used, or how long it is retained. Children generate significant amounts of personal data: location information, browsing behaviour, communication patterns, interests, and in some cases biometric data such as facial images from selfie filters.

Privacy matters for children for the same reasons it matters for adults, and for some additional ones. Data collected in childhood can persist for years or decades. The digital footprint a teenager creates today may be visible to future employers, educational institutions, or personal partners. Data can be used to build detailed profiles for targeted advertising or, in worst-case scenarios, accessed by malicious actors.

A number of countries have introduced specific legislation to protect children online privacy, including the Children Online Privacy Protection Act (COPPA) in the United States, the UK Children Code (Age Appropriate Design Code), and provisions under the General Data Protection Regulation (GDPR) in Europe. These laws place restrictions on what data can be collected from minors and how it can be used. However, enforcement is imperfect and parental awareness remains important.

What Data Apps and Websites Commonly Collect

The data collected varies by service, but common categories include:

• Account data: Name, email address, date of birth, phone number, and any profile information entered during registration
• Usage data: What features are used, for how long, at what times, and in what sequence
• Device data: Device type, operating system, unique device identifiers, and IP address
• Location data: Precise GPS location if location access is granted, or approximate location derived from IP address
• Content data: Photos, videos, messages, and files shared or stored within the app
• Behavioural data: Browsing history, search queries, purchases, and interactions with advertisements
• Communication data: Messages sent within the platform and, in some cases, contact lists

Free apps and services are almost always monetised through advertising, which requires building user profiles. The data your child generates is the product being sold to advertisers.

Reading Privacy Policies and Permissions

Privacy policies are legally required but notoriously difficult to read. Some practical approaches:

• When installing an app, review the permissions it requests before granting them. An app requesting access to contacts, camera, microphone, and location when these seem unnecessary for the app core function is a concern.
• Grant the minimum necessary permissions. Most devices allow you to review and revoke app permissions at any time in settings.
• Look for the key questions in privacy policies: what data do they collect, who do they share it with, how long do they keep it, and what rights do you have to access or delete it?
• Seek out simplified privacy summaries. Some organisations and apps now publish privacy summaries alongside their full policies.

Managing Privacy Settings on Common Platforms

Most major platforms used by children offer privacy settings that can significantly limit data collection and sharing:

• Social media platforms (Instagram, TikTok, Snapchat): Set profiles to private, disable location sharing, turn off ad personalisation where available, review which third-party apps have been granted access to the account
• Google and YouTube: Review and manage account activity, turn off location history and ad personalisation, consider using YouTube Kids rather than standard YouTube for younger children
• Gaming platforms (Xbox, PlayStation, Nintendo Switch): Configure privacy settings through the platform parental controls to limit what information is publicly visible on your child profile
• Mobile devices: Regularly review app permissions in device settings and revoke access to location, contacts, camera, and microphone for any app that does not require them

Your Rights and Your Child Rights

In many countries, parents have the right to request access to data collected about their children, request corrections, and request deletion. Under GDPR in Europe, individuals have a right to erasure. Under COPPA in the United States, parents can review and request deletion of data collected from children under 13. These rights are not always easy to exercise in practice, but they exist.

When children reach an age where they are creating accounts in their own names, typically 13 or older on most platforms, they gradually take on more responsibility for their own data. Building privacy literacy before they reach this age prepares them to make more informed choices.

Teaching Children About Their Digital Footprint

Children who understand that their online activity creates a lasting record make more thoughtful choices. Key concepts to build from primary school age:

• Anything shared online can be seen by others, can be copied, and can be difficult or impossible to fully remove
• Apps and websites use information about you to show you adverts
• Your location can sometimes be identified from photos or posts even if you do not explicitly share it
• Thinking before posting is a habit worth developing early

Frame these conversations around empowerment and informed choice rather than fear. Children who understand how the system works are better equipped to navigate it safely than those who are simply told to be careful without understanding why.