Children’s data and privacy online Growing up in a digital age An evidence review Sonia Livingstone ▪ Mariya Stoilova ▪ Rishita Nandagiri December 2018 1 Table of contents 1. Executive summary ........................................................................................................................ 3 2. Acknowledgements ........................................................................................................................ 5 3. Introduction .................................................................................................................................... 6 3.1. Context .................................................................................................................................... 6 3.2. Aims of the project and the evidence review ......................................................................... 8 4. Methodology .................................................................................................................................. 8 5. Children’s privacy online: key issues and findings from the systematic evidence mapping ..... 10 5.1. Conceptualising privacy in the digital age............................................................................. 10 5.2. Dimensions of children’s online privacy ............................................................................... 12 Interpersonal privacy .................................................................................................................... 13 Institutional privacy ...................................................................................................................... 13 Commercial privacy ....................................................................................................................... 14 Types of digital data ...................................................................................................................... 16 5.3. Privacy and child development ............................................................................................. 17 5.4. Children’s negotiation of privacy and information disclosure .............................................. 21 5.5. Children’s privacy protection strategies ............................................................................... 22 5.6. Media literacy ....................................................................................................................... 23 5.7. Differences among children .................................................................................................. 26 Socio-economic inequalities .......................................................................................................... 26 Gender differences ........................................................................................................................ 27 Vulnerability .................................................................................................................................. 28 5.8. Privacy-related risks of harm ................................................................................................ 28 5.9. Privacy protection and children’s autonomy ........................................................................ 30 5.10. Supporting children ........................................................................................................... 30 6. Recommendations ....................................................................................................................... 34 Appendices ........................................................................................................................................... 36 Appendix 1: Detailed methodology .................................................................................................. 36 Approach ....................................................................................................................................... 36 Search terms and outcomes ......................................................................................................... 36 Databases searched ...................................................................................................................... 38 Screening ....................................................................................................................................... 39 Coding ........................................................................................................................................... 40 Appendix 2: List of coded sources .................................................................................................... 41 Appendix 3: Glossary ........................................................................................................................ 48 References ............................................................................................................................................ 51 Cover image: Max Pixel 2 1. Executive summary by recent high-profile privacy issues and infringements. Children’s autonomy and dignity as actors in the In order to capture the full complexity of world depends on both their freedom to engage children’s privacy online, we distinguish and their freedom from undue persuasion or among: (i) interpersonal privacy (how my ‘data influence. In a digital age in which many everyday self’ is created,2 accessed and multiplied via actions generate data – whether given by digital my online social connections); (ii) institutional actors, observable from digital traces, or inferred privacy (how public agencies like government, by others, whether human or algorithmic – the educational and health institutions gather and relation between privacy and data online is handle data about me); and (iii) commercial becoming highly complex. This in turn sets a privacy (how my personal data is harvested significant media literacy challenge for children and used for business and marketing (and their parents and teachers) as they try to purposes). understand and engage critically with the digital environment. The key privacy challenge (and paradox) With growing concerns over children’s privacy and currently posed by the internet is the the commercial uses of their data, it is vital that simultaneous interconnectedness of voluntary children’s understandings of the digital sharing of personal information online, environment, their digital skills and their capacity important for children’s agency, and the to consent are taken into account in designing attendant threats to their privacy, also services, regulation and policy. Using systematic important for their safety. While children evidence mapping, we reviewed the existing value their privacy and engage in protective knowledge on children’s data and privacy online, strategies, they also greatly appreciate the identified research gaps and outlined areas of ability to engage online. potential policy and practice development. Individual privacy decisions and practices are Key findings include: influenced by the social environment. Children negotiate sharing or withholding of personal Children’s online activities are the focus of a information in a context in which networked multitude of monitoring and data-generating communication and sharing practices shape processes, yet the possible implications of this their decisions and create the need to balance ‘datafication of children’1 has only recently privacy with the need for participation, self- caught the attention of governments, expression and belonging. researchers and privacy advocates. Institutionalised aspects of privacy, where Attempts to recognise children’s right to data control is delegated – voluntarily or not – privacy on its own terms are relatively new and to external agencies such as government have been brought to the fore by the institutions, is becoming the norm rather than adoption of the European General Data the exception in the digital age. Yet there are Protection Regulation (GDPR, 2018) as well as gaps in our knowledge of how children experience institutional privacy, raising questions about informed consent and children’s rights. 1 ‘Datafication’ refers to the process of intensified monitoring and data gathering in which people The invasive tactics used by marketers to (including children) are quantified and objectified – collect personal information from children positioned as objects (serving the interests of others) have aroused data privacy and security rather than subjects (or agents of their own interests concerns particularly relating to children’s and concerns); see Lupton, D. and Williamson, B. (2017) The datafied child: The dataveillance of children and implications for their rights. New Media & Society 19(5), 2 ‘Data self’ refers to all the information available 780-94. (offline and online) about an individual. 3 ability to understand and consent to such privacy online threats due to their lack of datafication and the need for parental digital skills or awareness of privacy risks. approval and supervision, especially for the While issues such as online sexual exploitation youngest internet users. While the and contact with strangers are prominent in commercial use of children’s data is at the current debates, more research is needed to forefront of current privacy debates, the explore potential links between privacy risks empirical evidence related to children’s and harmful consequences for children, experiences, awareness and competence