Taking a prompt from Safer Internet Day, organisations whose products or services are accessible to minors should ensure they are aware of key privacy, data protection and governance obligations.
Children can begin interacting with digital systems early in life. Some digital footprints can then persist into adulthood and influence access to services and profiling outcomes, as well as affecting risks related to tracking, targeted advertising, or access to inappropriate content.
Because minors are a particularly vulnerable group, organisations must treat the digital presence of minors as a high-risk factor – particularly where systems are marketed to or designed to be accessible by minors.
Duties of technological providers: Heightened standards apply
When products or services are accessible by minors, there are heightened expectations to comply with the EU and UK GDPR, particularly regarding data minimisation. It should be noted that children’s data is not automatically classified as special category data under the GDPR. Nevertheless, children’s data is regarded as sensitive in context and warrants specific, enhanced safeguards.
These include:
- Default privacy protection settings
- Use of age-appropriate design and interface
- Parental consent
- Prohibition of intrusive profiling or behavioural tracking – unless it’s strictly necessary and justified
Data minimisation: Collect less, design better
Data minimisation is not only a core legal obligation under the GDPR, but a foundational design principle that reduces risk exposure, demonstrates accountability and sound governance, and enhances trust among stakeholders and users. It is vital to limit data collection and processing to what is necessary to deliver core functionality in products and services – particularly where said services are aimed at minors.
Particular care should be taken with:
- data that is automatically collected
- adoption of Digital Persistent Identifiers (PIDs)
- unstructured free-text fields that inadvertently capture personal data
Governance and accountability: More than a paper exercise
Protecting children’s data should be a core part of an organisation’s data governance. This is due to children likely being less aware of the risks, consequences and safeguards concerned with their privacy rights (GDPR Recital 38). Certain key measures must be taken to ensure that children’s data are protected throughout the privacy lifecycle.
These key measures include:
- documenting risk assessments that explicitly take children’s cognitive abilities into account,
- assigning and demonstrating accountability regarding implementations of consent and age verification mechanisms, and DPIA outcomes, and
- embedding review mechanisms to reflect changes in usage trends, demographics, and evolving regulatory interpretation.
Accountability is a core value in the GDPR and must be demonstrated throughout the entire lifecycle of an organisation’s products and services.
“Our firm belief is that children deserve more than just compliance – they deserve care. That means designing products that respect their privacy by default, limiting data collection, and prioritising safe experiences. Our responsibility goes beyond regulation: we build digital spaces that help children explore and grow without compromising their safety or dignity.”
(Yoto – HewardMills’ Client)
Embedding accountability in practice
Early Data Protection Officer (DPO) engagement is vital as it enables early identification of risks regarding product design choices that intersect with child safety. If the DPO is underutilised, it may result in blind spots and heightened compliance risks, which may, in turn, lead to reputational and regulatory consequences.
The DPO engagement should therefore be integrated into:
- the scoping of products and services
- marketing targeted at children
- internal reviews of any AI-driven recommendations or targeting practices
Conclusion
Safer Internet Day is a reminder that children’s data requires heightened protection in the digital world. Organisations must treat the data of minors as risk-sensitive and be rigorous in their practices regarding data minimisation, early DPO engagement, and demonstrating accountability. Being proactive in these areas reduces regulatory risk, preserves the organisation’s reputation and trust with stakeholders, and enhances ethical design of products and services.
If your organisation delivers products or services accessible to minors, HewardMills can provide the expert DPO support needed to enhance safeguards, reduce risk, and ensure compliance with privacy, data protection and governance obligations. Contact our experienced team today to find out more.
