Children's Rights in the Digital Environment

Digital Age of Consent Digital Age of Consent Emma Day, Independent Human Rights Lawyer

Committee on the Rights of the Child - General Comment No.25: Children s Rights in the Digital Environment Child consulted for GC 25: I would like to obtain clarity about what really happens with my data ... Why collect it? How is it being collected? ; I am ... worried about my data being shared .

General Comment No.25: Childrens Rights in the Digital Environment Where consent is sought to process a child s data, States parties should ensure that consent is informed and freely given by the child or, depending on the child s age and evolving capacity, by the parent or caregiver, and obtained prior to processing those data. Where a child s own consent is considered insufficient and parental consent is required to process a child s personal data, States parties should require that organizations processing such data verify that consent is informed, meaningful and given by the child s parent or caregiver. States parties should ensure the right of children to withdraw their consent and object to personal data processing where the data controller does not demonstrate legitimate, overriding grounds for the processing. They should also provide information to children, parents and caregivers on such matters, in child-friendly language and accessible formats.

Terms and conditions children are asked to consent to are long and complex Users would need a university level education to understand most platform T&Cs BBC study, 2018 Mobile apps ask users for as many as two hundred permissions, and on average they ask for five Neil Richards, 2021

Childrens capacity to understand and consent to data processing Livingstone et al., Children s conception of privacy online , LSE 2018 Age 5-7 Interpersonal privacy A developing sense of ownership, fairness and independence Learning about rules but may not follow, and don t get consequences Use digital devices confidently, for a narrow range of activities Getting the idea of secrets, know how to hide, but tend to regard tracking/monitoring as helpful Starting to understand the risks of sharing but generally trusting Privacy management means rules not internalised behaviour Still see monitoring positively, as ensuring their safety Privacy risks linked to stranger danger and interpersonal harms Struggle to identify risks or distinguish what applies offline/online Institutional and commercial privacy Limited evidence on understanding of the digital world Low risk awareness (focus on device damage or personal upset) Few strategies (can close the app, call on a parent for help) Broadly trusting 8-11 Still little research available Gaps in ability to decide about trustworthiness or identify adverts Gaps in understanding privacy terms and conditions Interactive learning shown to improve awareness and transfer to practice

Childrens capacity to understand and consent to data processing cont Age 12-17 Interpersonal privacy Online as personal space for expression, socialising, learning Concerned about parental monitoring yet broad trust in parental and school restrictions Aware of / attend to privacy risks, but mainly seen as interpersonal Weigh risks and opportunities, but decisions influenced by desire for immediate benefits Institutional and commercial privacy Privacy tactics focused on online identity management not data flows (seeing data as static) Aware of data traces (e.g. ads) and device tracking (e.g. location) but less personally concerned nor aware of future consequences Willing to reflect and learn retrospectively; media literacy education best if teens can use new knowledge to make meaningful decisions

Rights-based analysis of the law on children s consent in the digital world - Professor Simone Van der Hof Although children s cognitive ability can rival that of adults from around 13, they take much longer to mature socially and emotionally and are still more prone to irrational and risky behaviour than adults children must be challenged to reflect on what it means to be a digital citizen and consumer, how internet governance and economics operate and, thus, influence society, and how to make fair and versed decisions that are in line with your thoughts, beliefs and sentiments, and ensure protection of your rights.

Data literacy and consent A certain level of knowledge regarding the data economy is a prerequisite for any individual to have agency over their own data, and for them to give or withdraw their consent to data sharing and processing. Global Privacy Assembly working group on digital education (DEWG) - October 2021 report focuses on allowing children and young people to develop the competences and skills needed to grow into responsible digital citizens.

Where do we go from here? 1) More and better data governance for children - governments are the duty bearers for children s rights and should not leave all the hard decisions to children and parents 2) Privacy by design technology companies need to proactively respect children s rights 3) Data literacy for children, parents and caregivers, educators, and society