Ireland's Data Protection Commission continues to demonstrate the repercussions companies will face if they fail to meet the core principles of the EU General Data Protection Regulation. The latest example comes with the DPC's adoption of a 345 million euro fine and corrective measures against TikTok over alleged GDPR violations concerning children's data protection. The enforcement action concerns claims against TikTok's platform settings for kids that it had in place over a five-month span 31... Read More

Over the past few years, regulators around the world have stepped up enforcement of privacy laws that protect minors online. Recently fines and injunctions have been levied against video game companies, education platforms, social media networks, smart speaker manufacturers and other digital services providers for unlawful practices involving young people's personal data. Legislators are active in this space as well. Lawmakers took a hard look at online features and content that enables, facili... Read More

Research from advertising performance platform Adalytics raises questions about YouTube's advertising on children's content and whether its practices led to tracking of children across the web, The New York Times reports. Adalytics identified ads for adult products of over 300 brands designated as "made for kids," while a New York Times analysis found some viewers were taken to brand websites that placed trackers on users' browsers. Spokesman for Google, which owns YouTube, Michael Aciman said t... Read More

The U.S. Senate Committee on Commerce advanced two bipartisan bills to enhance protections for children online, in a move lawmakers called "critical" in addressing a "sobering" crisis. The committee voted favorably to move the Kids Online Safety Act and the Children and Teens' Online Privacy Protection Act, leaving both eligible for consideration by the full Senate. The approvals came days after U.S. President Joe Biden directly endorsed the bills and reiterated he is been calling for enhanced ... Read More

The U.S. Federal Trade Commission is alleging Facebook "repeatedly violated its privacy promises" and is proposing a "blanket prohibition" on parent company Meta's monetization of data of users under 18. The company, meanwhile, called the move "a political stunt." The FTC on Wednesday moved to expand its USD5 billion privacy order with then-Facebook from 2020, claiming the company failed to comply with the order and the Children's Online Privacy Protection Act Rule, misrepresented access to pr... Read More

U.S. Sens. Bill Cassidy, R-La., and Ed Markey, D-Mass., reintroduced the Children and Teens' Online Privacy Protection Act 2.0, which they said updates online privacy protections for children and teens for the 21st century. The bill prohibits internet companies from collecting personal data of users aged 13-16 without consent, bans targeted advertising to children and teens, covers platforms "reasonably likely to be used" by children, and establishes a "Digital Marketing Bill of Rights for Teens... Read More

In late January, California Attorney General Rob Bonta announced one of the agency’s top enforcement priorities for 2023. The attorney general’s office is conducting investigations into popular mobile apps, with a focus on the "retail, travel, and food service industries." The Data Privacy Day investigative sweep came with an added sense of urgency, after the affirmative right to cure within a 30-day period expired at the end of 2022. Now companies that receive inquiries from the California atto... Read More

We have arrived at a tipping point. Policy makers, consumers, technologists and regulators are in agreement: The internet was not designed with children in mind. Lawmakers came to the conclusion that new regulations to support the online protection and development of children and young people are needed. This prompted the recent proliferation of codes, laws, bills and regulatory guidance documents governing how online service providers interact with young people. Key examples are the U.K. Age-A... Read More

The Irish Data Protection Commission published three guides for children to explain data protection and their rights under the EU General Data Protection Regulation. The guides are intended for children ages 13 and older because that is the minimum age required to sign up for many social media platforms. The subject matter of the DPC’s guides are data protection, which would introduce children to the concept of what data is, a guide for educating children about their rights under the EU GDPR, an... Read More

The Arkansas House of Representatives voted on final approval of Senate Bill 396, the Social Media Safety Act, MediaPost reports. The bill aligns with Utah's social media bill on age verification and parental consent for use by minors under age 18. The effective date, pending the governor's signature, is 1 Sept.Full Story... Read More

Meta said its Facebook and Instagram platforms will tighten restrictions on data available to advertisers to target teens, the Guardian reports. Starting in February, advertisers will no longer be able to access a user's gender or posts they have engaged with for targeted advertising. Instead, only a user's age and location will be available. Meta also said teenagers will be offered new options in Facebook and Instagram settings to "see less" of certain types of ads.Full Story... Read More

After years of developing under the surface, teen privacy safeguards in the United States may have finally reached puberty. Although headlines about the Federal Trade Commission’s enforcement action against Epic Games are likely to focus on the high price tag — $275 million in administrative penalties and $245 million in consumer refunds — privacy professionals should zoom in on the operational takeaways for any organization that runs an online site or service used by individuals under 18, wheth... Read More

The U.S. Federal Trade Commission announced Epic Games agreed to a $520 million settlement over alleged Children's Online Privacy Protection Act violations. The settlement covers FTC claims of nonconsensual data collection of users under the age of 13 and unlawful communications that proved harmful to Fortnite video game players. The company will pay $275 million in civil penalties and $245 million in refunds to users affected by "dark patterns." Epic Games also agreed to delete data associate... Read More

The California Age-Appropriate Design Code Act may lead to greater privacy protections for minors across the U.S., Government Technology reports. The law, which goes into effect in 2024, could make it “difficult for technology companies to apply different rules to users in different places,” and could compel them to add stronger protections by default. Technology industry groups could still challenge the law because certain provisions “are overly vague,” such as requiring websites to “estimate t... Read More

The ever-evolving nature of online advertising often leaves children most vulnerable to their messages, whether knowingly or unknowingly. However, in the digital advertising world, children today are even more susceptible to ads that obfuscate the differences between commercials and entertainment, brought in part by so-called influencer culture. As part of receiving public input on the effects online advertising has on children, the U.S. Federal Trade Commission staff held an all-day virtual w... Read More

Children now spend a lot of time playing games online, but the gaming industry has received less scrutiny than social media or streaming platforms over privacy concerns. As gaming grows, the scale of user vulnerability increases as well. Many young people do not understand the data risks posed by online games. Luckily, privacy regulators are increasingly focusing efforts toward protecting children’s safety and autonomy online. Young people enjoy online games because they allow for play, learnin... Read More

On Sept. 2, Ireland's Data Protection Commission issued a landmark decision concerning the processing of children’s data in connection with the Instagram social media service. The decision, issued to Meta Platforms Ireland Limited (Facebook Ireland Limited at the time of commencement of this inquiry) as the controller in question, found multiple infringements of the EU General Data Protection Regulation across legal basis, data minimization, transparency, data protection by design and default, c... Read More

Politico reports Ireland's Data Protection Commission fined Meta's Instagram 405 million euros for children's privacy violations under the EU General Data Protection Regulation. The fine, which is the second-largest GDPR penalty to ever be handed down, covers alleged violations stemming from Instagram's default account settings for children ages 13-17 that exposed email addresses and phone numbers associated with child-operated accounts. The investigation into the allegations began in October 20... Read More

While U.S. Congress is working to devise appropriate regulations for children's online privacy and content moderation, finalization is not on the immediate horizon. The inaction led the California Legislature to take matters into its own hands with final passage of Assembly Bill 2273, the California Age-Appropriate Design Code Act. The bill, which awaits enactment by Gov. Gavin Newsom, D-Calif., after unanimously passing the State Assembly and Senate, is an online safety bill containing unique ... Read More

The New York Times reports a U.S. parent's Google account was suspended after they photographed infections in the private areas of their child for their health care provider to assess. Google's artificial intelligence system for detecting child sexual abuse imagery is used to track down and prevent sharing of such images, but accidental cases as this may be more common, Electronic Frontier Foundation technologist Jon Callas said. Last year, Google filed more than 600,000 reports of child abuse m... Read More

Two federal bills to protect children and teenagers’ online privacy were passed out of the U.S. Senate Committee on Commerce, Science and Transportation during a markup session July 27.   Committee members passed an update to the Children’s Online Privacy Protection Act with a voice vote carried by the Democratic majority and the Kids Online Safety Act, which was approved unanimously, 28-0. Both bills head to the floor for a full vote in the Senate.  COPPA governs how websites and online servi... Read More

There has been curiosity about how long it would take the U.S. Federal Trade Commission to delve into privacy matters once it had a full bench of commissioners and a Democratic majority. The answer took only three days as the agenda for the first public session following the swearing in of Alvaro Bedoya as the fifth and final FTC commissioner led off with a privacy vote. Surprisingly, FTC Chair Lina Khan did not see a party line vote on this first action with the full bench as commissioners vot... Read More

In 1998, the U.S. was the first nation to enact a privacy law specifically tailored to protect children’s data. Nearly 25 years later, COPPA — the Children’s Online Privacy Protection Act — is one of several children’s privacy and data protection laws around the world. LinkedIn Chief Privacy Officer Kalinda Raina, CIPP/US, first encountered the draft COPPA bill while interning at the Center for Democracy and Technology. In the years since, she has helped lead the privacy efforts at Nintendo and ... Read More

The Verge reports Epic Games and Lego announced a new partnership to develop a metaverse space "with the wellbeing of kids in mind." While the companies have not yet decided what the space will look like, they announced development will "protect children’s right to play by making safety and wellbeing a priority; safeguard children’s privacy by putting their best interests first," and "empower children and adults with tools that give them control over their digital experience." Epic Games has str... Read More

Short, strong and to the point. That's what U.S. President Joe Biden angled for with comments on improving children's privacy and online safety in his State of the Union Address Tuesday night. The White House tipped the public off to Biden's planned remarks, giving the privacy community something to look forward to with the address. While the president's words didn't stray from what was prepared, the message was crystal clear. "It's time to strengthen privacy protections, ban targeted advertis... Read More

From the disparities that online monitoring software can exacerbate among remote learners, to the harms teens are exposed to via dark patterns and algorithms, an increasingly complex batch of privacy problems revolve around the use of children’s data. Many of these problems surfaced in public last month when The Wall Street Journal published an investigative series entitled “The Facebook Files” that sought to document the “ill effects” of these platforms. According to one internal study leaked ... Read More

When Kalinda Raina’s 5-year-old started kindergarten last year, she didn’t know how to use her iPad to join a class, submit assignments, take a selfie or show herself on a video call. But she learned all that within the first few weeks of school. Products and services marketed to children and teens have grown drastically in recent years, but the COVID-19 pandemic increased kids’ digital activities at what seemed like lightning speed. Classes, doctor’s appointments, social interactions, even ext... Read More

The Hill reports Google plans to allow kids age 18 and under to request removal of their images from the company's search engine. The child, or their guardian, will be asked to submit a request form at which point Google will consider the request under its requirements for removal. "We believe this change will help give young people more control over their digital footprint and where their images can be found on Search," Google wrote in its announcement.Full Story... Read More

In response to claims that technology companies aren’t doing enough to protect children online, more companies and governments are adding digital age checks online, The New York Times reports. But critics say the changes, some requiring government-issued identification or credit card data, could negatively impact user privacy and anonymity. While those implementing the measures say data protections are in place, Electronic Frontier Foundation Staff Technologist Daly Barnett said, “Either way, th... Read More

The Verge reports Epic Games will offer its parent verification services free for all developers in order to make it easier to design games that protect children's privacy and safety. Last September, the video game publisher acquired safe kidtech company SuperAwesome, enabling it to implement its Kids Web Services program. The acquisition allows developers to "verify the identity of parents or guardians when granting their children permission to use features that collect personal information," t... Read More

UNICEF has published a manifesto that sets out a vision for better global governance of children's data.  Children's data deserves special protection because children are more vulnerable than adults, and younger children depend on adults to consent to data processing on their behalf. Even older children are less able to understand the long-term implications of consenting to their data processing. The use of algorithms in children's education systems, their health care and youth criminal justice... Read More

The H1 2021 Delisted Apps Report by privacy and analytics platform Pixalate found 59% and 25% of applications removed from Apple and Google’s stores, respectively, did not have a privacy policy, VentureBeat reports. Eighty-six percent of the 813,000 apps removed from the Google Play and Apple App stores targeted children 12 and under. The report analyzed more than 5 million apps, finding consumer privacy and security risks.Full Story... Read More

Google and New Mexico Attorney General Hector Balderas reached a settlement over allegations the company’s AdMob platform enabled a game developer to illegally collect personal data from young users, MediaPost reports. The terms of the settlement have not been disclosed. U.S. District Court Judge Martha Vasquez last year dismissed similar claims against Twitter and other advertising technology companies, filed in 2018, but ruled the allegations against Google could move forward. Meanwhile, Balde... Read More

Google announced it is blocking targeted advertising for anyone under 18 years old, Reuters reports. The technology company is also turning off its "location history" for young users and is introducing a policy for users to request the removal of children's images from Google Image search results. "Of course, removing an image from Search doesn’t remove it from the web, but we believe this change will help give young people more control of their images online," Google said in a blog post. Meanwh... Read More

Facebook announced plans to curtail targeted advertising capabilities to minors in the coming weeks. Targeting categories for children under 18 will be limited to age, gender and location, with Facebook noting advocates indicated young people "may not be well equipped" to make decisions on opting out of targeting. The limitations will apply to Facebook's home website and subsidiaries, including Instagram and Messenger. Additionally, Facebook announced new Instagram users age 16 and under will ... Read More

Facebook announced plans to curtail targeted advertising capabilities to minors in the coming weeks. Targeting categories for children under 18 will be limited to age, gender and location, with Facebook noting advocates indicated young people "may not be well equipped" to make decisions on opting out of targeting. The limitations will apply to Facebook's home website and subsidiaries, including Instagram and Messenger. Additionally, Facebook announced new Instagram users age 16 and under will ha... Read More

CNBC reports on efforts to develop artificial intelligence-based toys for kids and how they could risk children's privacy. Among the notable types of smart toys are smart companions, which learn and interact with children, and programmable toys that employ machine learning to educate kids. World Economic Forum’s Smart Toy Awards’ Judging Committee Chair and singer-songwriter Will.i.am said AI toys "will be smarter than the parent and gather all this data that could one day hurt the child" after ... Read More

Vice reports on the potential children's privacy pitfalls associated with financial technology application Greenlight, a kids' finance platform. According to Greenlight's privacy notice, the app has the right to share users' personal data, including names, birth dates, email addresses, location history, purchase history and more, with third-party vendors. The notice also allows Greenlight to serve targeted advertisements based on the data it collects. A spokesperson said the sharing provisions w... Read More

Comparitech reports its research team found one in five of the 500 most popular children’s applications in the Google Play Store breach the Children’s Online Privacy Protection Act. U.S. Sen. Ed Markey, D-Mass., and U.S. Reps. Kathy Castor, D-Fla. and Lori Trahan, D-Mass., sent letters to Amazon, Facebook, Google, Snapchat, TikTok and Twitter asking the companies to give teenagers and young children in the U.S. the same privacy protections as provided under the U.K.’s Age Appropriate Design C... Read More

Regulators in the EU gave TikTok one month to address children’s data concerns, Bloomberg reports. Justice Commissioner Didier Reynders said the EU and consumer organizations have begun a formal dialogue with TikTok to support the company in “complying with EU rules to protect consumers.” TikTok Europe Director of Public Policy Caroline Greer said the application has “taken a number of steps to protect our younger users.”Full Story... Read More

Today’s children are growing up in an increasingly online world, enhanced even further as educational, social and entertainment interactions have gone digital amid the COVID-19 pandemic. “It’s become a part of their everyday world,” said U.K. Information Commissioner’s Office Deputy Commissioner Steve Wood, who moderated the “Protecting Children Online: Privacy by Design Approaches” panel during the IAPP’s Global Privacy Summit Online 2021. “Connectivity and knowledge bring great benefit, but e... Read More

Society's "datafication" also affects children, who are especially vulnerable to the exposure of their personal information. In its children's data and privacy online report, the London School of Economics divides children's privacy into three segments: interpersonal (the creation of children's digital footprints), institutional (how the government and related agencies handle children's data) and commercial (how children's data is used by businesses and for marketing purposes). With the prolifer... Read More

Digital rights advocates said facial recognition technology installed in at least a dozen schools in Delhi, India, is an invasion of children’s privacy, Reuters reports. Internet Freedom Foundation Associate Counsel Anushka Jain said there is no law regulating the collection and use of data, adding “the use of facial recognition technology is an overreach and is completely unjustified.” Software Freedom Law Centre Legal Director Prasanth Sugathan said facial recognition “could cause real harm to... Read More

This is the eighth part of a series of articles examining the most impactful provisions of the California Privacy Rights Act, the consumer privacy ballot initiative that amends the currently in force California Consumer Privacy Act. In the previous piece, I examined the main requirements for businesses regarding right-to-know requests from consumers. This piece turns to other consumer rights expanded upon by CPRA: the rights to deletion, no retaliation and children’s privacy. Right to delete S... Read More

The pandemic has created an era of uncertainty, especially surrounding the issue of student privacy. Schools now face a constant barrage of questions from administrators, teachers, parents, students and community members requesting information pertaining to COVID-19. Before answering these inquiries, schools must decide what information can be shared, how it can be shared, and with whom any information can be shared in a way that protects the students’ privacy. The pandemic also has resulted in... Read More

At the beginning of each school year, there are many papers to be signed. I agree I have (1) read the student handbook, (2) health forms, (3) appropriate use of technology at school, (4) photos of my children for promotional purposes, and so on. Then, this year out of the blue, a new consent shows up — a consent to record classes for operational purposes — and if I don’t sign it, it will significantly impact my child’s education. Wait … what?  This doesn’t sound right. What exactly are opera... Read More

At least once a week, one of my kids asks me how my day was and what I did at work or, more generally, what I do at work. My answer to them is generally along the lines of “I help my colleagues determine what personal information we should be collecting for apps, services and websites; how we should and shouldn’t be using that information; how we help people using those things understand what we’re doing and the choices available to them.” As someone who has been working in technology for more t... Read More