Today’s children are growing up in an increasingly online world, enhanced even further as educational, social and entertainment interactions have gone digital amid the COVID-19 pandemic.

“It’s become a part of their everyday world,” said U.K. Information Commissioner’s Office Deputy Commissioner Steve Wood, who moderated the “Protecting Children Online: Privacy by Design Approaches” panel during the IAPP’s Global Privacy Summit Online 2021. “Connectivity and knowledge bring great benefit, but equally, evidence is building about how this engagement online brings risks.”

During the panel, Wood, with Roblox Chief Privacy Officer and Vice President of Trust & Safety Remy Malan, U.S. Federal Trade Commission Division of Privacy and Identity Protection Associate Director Maneesha Mithal, and Future of Privacy Forum Director of Youth and Education Privacy Amelia Vance discussed the online risks children face, how data protection and privacy can help mitigate those risks, and effective approaches as we move toward a global consensus on standards.

Children’s personal data — their likes, dislikes and habits — shape their experiences online, and as their brains are still developing, the age group is more susceptible to the dangers of targeted advertising, manipulative design, surveillance and more, Vance said.

“I think it’s going to be incredibly important as new legal structures pop up all over the world to consider what kind of world we want to live in,” she said.

In the U.S., the long-standing Children’s Online Privacy Protection Act, in place since 1998 and amended to keep pace with changes in technology, can be learned from, panelists said. Ireland's Data Protection Commission has published its draft fundamentals for a child-oriented approach, introducing child-specific data protection principles, and the U.K.’s Age Appropriate Design Code will formally go into effect in September, setting 15 standards for children under the age of 18 that Wood said “aim to provide built-in protection to allow children to explore, learn and play online, but also ensure their best interests are the primary consideration when online service providers are designing and developing their services.”

For Roblox, a global online gaming platform designed for children, Malan said a key lesson learned from the development and implementation of COPPA has been the need to build privacy, data protection and safety into processes from the beginning.

“So if you are in the industry, you’re providing a platform; privacy and safety are not built-on things. You can’t take the approach of we’ll build something and later we’ll make sure the data protections are there,” he said. “You have to build it in as a holistic activity into your organization, and it’s something you have to do continuously. It’s not something you stop; it just becomes part and parcel of the way you conduct yourself as an industry player.”

COPPA also gave the company a framework to work and build from, he said.

“We have a framework inside the company which we can use for looking at how to comply with regulation. We are also cognizant different jurisdictions may have different regulations, so part of our platform is designed to help us manage policy implementation that may differ,” he said. “When you become a global platform, you have to be able to create an experience that’s compliant in different jurisdictions, so that becomes part of the complexity of managing a global platform, but it is something that’s possible to achieve."

For regulators, Mithal said it is important to think of ways to future-proof legislation and have a rule-making authority that can revisit rules to keep pace with technology. For example, she said COPPA was revised in 2013 to widen the definition of children's personal information to include things like photos and videos.

“I think having the flexibility to take into account how technology is going to change is very important,” she said.

In striving to protect children online, panelists said parental consent is an important piece of the puzzle, but Vance said it’s not solely sufficient to provide privacy protections kids need online.

“A lot of what happens online is not clear to your average consumer and so even when parents are investigating and trying to do their due diligence for their kids to protect their privacy, it’s not always clear what exactly the risks may be and how the data is used,” she said, adding the protected age for children is being raised in some places and layers of protection are also being built in, like making the sale of data opt-in versus opt-out.

Mithal said the data minimization aspects of COPPA are equally important and companies should monitor their audience to determine whether it has become popular with children, even though they may not have been the intended audience.

“Don’t collect information if you don’t need it, make sure you have retention schedules and are deleting children’s data regularly,” she said.