The Information Commissioner’s Office (ICO), the UK’s data protection authority, has put 11 social media and video sharing companies on notice for “poor children’s privacy practices”.
The ICO did not name the firms in question, but said the organisation’s Tech Lab reviewed the children’s privacy practices of 34 social media companies and video sharing platforms (VSP). That means one-third of the businesses investigated fell short of the ICO’s standards.
The issues raised relate to potential violations of the ICO’s Children’s Code, which aims to empower adults and children to preserve young people’s online safety. The code requires businesses to “put the best interests of the child first when they are designing and developing apps, games, connected toys and websites” likely to be accessed by children.
The investigation found “varying levels of adherence” to the code, with some platforms “not doing enough to protect children’s privacy.” The review raised concerns around social media platforms’ privacy settings, age assurances, and their approach to targeted advertising.
The watchdog warned that businesses that fail to comply with the law will face enforcement action.
“There is no excuse for online services likely to be accessed by children to have poor privacy practices,” said Emily Keaney, Deputy Commissioner of the ICO. “Where organisations fail to protect children’s personal information, we will step in and take action. Online services and platforms have a duty of care to children. Poorly designed products and services can leave children at risk of serious harm from abuse, bullying and even loss of control of their personal information.”
Content and consent
The news follows last week’s Media Nations report from Ofcom, which found that children consume an average 74 minutes of VSP content per day. VSPs accounted for 40 percent of children’s total video consumption in 2023.
But despite the reality that children are “growing up in a digital world”, the ICO notes that the online world was not designed with their needs in mind. Content recommendation algorithms, location tracking and targeted advertising all require personal data to inform their systems, and unlike adults, children cannot be expected to understand and choose to consent to these processes.
According to the ICO, “children under the age of 13 cannot consent to an online service processing their personal information.” And while most social media services have a minimum age limit of 13, many have failed to enforce these age restrictions, allowing children to sign up using a false date of birth. Last year, the UK’s Advertising Standards Authority (ASA) found that over 17 percent of children are incorrectly registered on social media platforms with their age given as 18+.
However, the ICO noted that social media companies have made some progress in the area of age assurance. Facebook and Instagram now ask for proof of age, and prevents users from signing up if they repeatedly enter different dates of birth. Meta has also committed not to personalise ads to under-18s based on their online activity.
And last year the regulator fined TikTok £12.7 million for a number of breaches of data protection law, including misuse of children’s personal data. TikTok has appealed the fine, and the case is currently in litigation.
Meanwhile similar measures are also underway in the US. Last week, the Senate passed a pair of online child safety bills restricting data collection and targeted advertising by social media companies. The Children and Teens’ Online Privacy Protection Act (COPPA 2.0) and the Kids Online Safety Act (KOSA) passed near-unanimously through the Senate, but still require approval from the House of Representatives.
“Our world-leading Children’s Code has helped stop targeted advertising at children on some of the biggest social media platforms,” said the ICO’s Emily Keaney. “The code has even encouraged other areas, including tech-famous California, to create their own codes. We’re now building on the code’s achievements to gather more evidence and push for further changes.”
