LSE - Small Logo
LSE - Small Logo

Sonia Livingstone

December 12th, 2016

The GDPR: Using evidence to unpack the implications for children online

0 comments | 1 shares

Estimated reading time: 5 minutes

Sonia Livingstone

December 12th, 2016

The GDPR: Using evidence to unpack the implications for children online

0 comments | 1 shares

Estimated reading time: 5 minutes

Sonia LivingstoneThe 2016 European General Data Protection Regulation (GDPR) contains several provisions highly relevant to children and young people. In this post, Sonia Livingstone, Professor of Social Psychology at LSE’s Department of Media and Communications, will discuss empirical evidence to explore issues around the application of the GDPR to children’s online activities.

Throughout this blog series, we have been decoding the implications of the GDPR for children, noting that a range of provisions within the GDPR are of particular importance to their rights to participation and protection, to the balance between parental responsibility versus teen autonomy, and to the challenging media literacy task set for both parents and children by the opaque, ‘black-boxed’ algorithmic operation of the internet industry.

It’s increasingly clear to expert observers that the GDPR is going to be difficult to implement once it becomes UK law in May 2018 (though we must, even post-Brexit). Can the evidence already help to anticipate and resolve uncertainties or point out valuable directions? I’ll concentrate here on Ofcom’s Children and parents: media use and attitudes report 2016, as this covers a lot of relevant information about children’s online activities, media literacy, risks, and the response of their parents.

But first, which questions are pressing? Arguably all provisions in the GDPR are relevant to children along with all other internet users – for instance, importantly, Article 35 requires the conduct of impact assessments to identify risks to the rights and freedoms of all data subjects prior to data processing. Just how robustly this will be implemented, and grounded in what evidence, is yet to be determined, and civil society will be watching closely.

The GDPR’s provision for children is riddled with uncertainties

However, given that children merit particular protections because they may be less aware of online risks to their personal data and rights (recital 38), the GDPR explicitly mentions children in relation to:

  • Article 8: Verified parental consent required for under 16s (or 13s, if member states so determine) to use ‘information society services’.
  • Article 12: Transparency of communication in a ‘concise, transparent, intelligible and easily accessible form, using clear and plain language’ for data subjects, especially children.
  • Recital 71: No data profiling of children (now seemingly defined as under 18). This is stated in a recital not an article, so does this mean that children’s personal data should not (and will not) be collected for commercial profiling purposes? Can children’s data even be reliably distinguished from the rest?
  • Article 57: Effort to ‘promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing’, with special attention to children.

Several questions arise about the relation between children’s online activities, the role of parents and parental consent, and the responsibility of industry and regulators. One of these questions is: How do children understand the privacy and commercial aspects of the internet?

Ofcom’s evidence on children’s media literacy

Each year, Ofcom reports on the results of their survey of a nationally representative sample of children and parents under the broad rubric of ‘media literacy’, providing valuable cross-sectional data and building up a picture of trends over time. Ofcom groups children into 8-11 and 12-15 year olds: to inform the question of whether 13 or 16 year olds can decide for themselves about the opportunities and risks of internet use, I’ll focus on 12-15 year olds. (But note that on the indicators below, the media literacy of 8-11 year olds is generally lower. Also, the media literacy of adults is not always higher, raising questions about whether their parents can and do make informed decisions about young children’s use of services that collect their personal data.)

Where are the gaps in 12-15 year olds’ understanding of the reliability and commercial basis of the internet?

  • Around a quarter (27%) of those who use search engines think that information on the websites returned by a Google search can be trusted. While the BBC website is preferred for “true and accurate information about things that are going on in the world,” this has declined from 52% in 2015 to 35% in 2016, while turning to Google for such information has risen from 17% to 30%.
  • 20% of 12-15 year olds who use social media sites say that most or all of the information they see on social media sites is true. Of those who visit online news sites, 56% think most or all information on sites or apps about news is true.
  • Half know that YouTube (51%) and Google (49%) are funded by advertising and nearly a third don’t know. Only 45% could identify that search results distinguished by an orange box with the word ‘Ad’ written in it were adverts that had paid to appear at the top of the results. 17% thought these were the best results and 17% don’t know.
  • 55% of 12-15-year-old internet users are aware of personalised advertising (an increase from 45% in 2015). They are also more likely than in 2015 (57% vs 47%) to be aware that vloggers might endorse products because they are paid to do so.
  • 17% agree that “I will give details about myself to a website or app to be able to get something that I want”. 13% of those with a social media profile agree that “getting more followers is more important to me than keeping my information private”, compared to 68% who disagree. 58% think that: “I can easily delete information that I have posted about myself online if I don’t want people to see it.”

Let’s not panic – the implication is that many children have a fair idea of the commercial nature of the internet and how it treats their personal data. But the gaps in knowledge are important. Generally, they are greater among younger children and those from poorer or less educated homes. The evidence does not, therefore, give a ringing endorsement for those aged 13+ to use the internet at will. It also suggests that schools are not teaching children all they need to know in the digital age. And it suggests that platforms and content providers are not dealing fairly with the children using their services.

Trading participation for protection rights

Although no child rights advocate would wish to trade rights as the GDPR seems to require, the evidence is clear: many children do not understand, or are confused about, the commercial nature of the internet. Thus keeping the age of parental consent at 16 may prove beneficial, as will improving the fairness and transparency of online services and public awareness of the risks.

On the other hand, if the UK decides to keep the age of consent at 16 rather than reducing it to 13, and if companies then either restrict their services to 16+ (rather than bothering to obtain parental consent) or parents refuse consent for their 13-15 year olds when asked, we must also ask: what might be the cost to children’s online opportunities? To assess this, we can note that, in addition to most children’s considerable pleasure in online communication and entertainment, among 12-15-year-old internet users in 2016:

  • 44% used an internet-enabled device to make a video, 18% music, 16% an animation, 13% a website, 11% a meme or gif, 9% an app or game, 6% a vlog and 4% a robot.
  • 30% of 12-15 year olds have gone online for civic activities such as signing a petition, sharing news stories, writing comments or talking online about the news.

While engaged with only by a minority of 12-15s, albeit a fairly large minority, in principle, any or all of this cohort is free to engage in creative and/or civic activities. Thus in practice around one third would lose out if their internet access became significantly restricted, though the loss of such a freedom goes wider. Since youth digital skills and literacies are much called for to enhance learning, participation and future workplace skills, the potential cost is sizeable.

The pressure is on government, regulators and industry to make this work

Will the GDPR help or hinder? The evidence suggests it may indeed increase children’s online data protection (and, thereby, protection from privacy and marketing risks), given that many young users do not understand the conditions of the services they use, and therefore cannot defend their rights to privacy, fairness or redress. It may also reduce other risks: cyberbullying, unwanted pornography, grooming, etc.

But as other posts in this series suggest, this is likely to come at the cost of regulatory confusion and evasion, parent-child tensions or deceit, the social exclusion of teens whose parents don’t or won’t consent, and loss of children’s communicative, creative and civic opportunities to learn and participate in society, as is their right and society’s need.

 This post gives the views of the author and does not represent the position of the LSE Media Policy Project blog, nor of the London School of Economics and Political Science.

About the author

Sonia Livingstone

Sonia Livingstone OBE is Professor of Social Psychology in the Department of Media and Communications at LSE. Taking a comparative, critical and contextual approach, her research examines how the changing conditions of mediation are reshaping everyday practices and possibilities for action. She has published twenty books on media audiences, media literacy and media regulation, with a particular focus on the opportunities and risks of digital media use in the everyday lives of children and young people. Her most recent book is The class: living and learning in the digital age (2016, with Julian Sefton-Green). Sonia has advised the UK government, European Commission, European Parliament, Council of Europe and other national and international organisations on children’s rights, risks and safety in the digital age. She was awarded the title of Officer of the Order of the British Empire (OBE) in 2014 'for services to children and child internet safety.' Sonia Livingstone is a fellow of the Academy of Social Sciences, the British Psychological Society, the Royal Society for the Arts and fellow and past President of the International Communication Association (ICA). She has been visiting professor at the Universities of Bergen, Copenhagen, Harvard, Illinois, Milan, Oslo, Paris II, Pennsylvania, and Stockholm, and is on the editorial board of several leading journals. She is on the Executive Board of the UK Council for Child Internet Safety, is a member of the Internet Watch Foundation’s Ethics Committee, is an Expert Advisor to the Council of Europe, and was recently Special Advisor to the House of Lords’ Select Committee on Communications, among other roles. Sonia has received many awards and honours, including honorary doctorates from the University of Montreal, Université Panthéon Assas, the Erasmus University of Rotterdam, the University of the Basque Country, and the University of Copenhagen. She is currently leading the project Global Kids Online (with UNICEF Office of Research-Innocenti and EU Kids Online), researching children’s understanding of digital privacy (funded by the Information Commissioner’s Office) and writing a book with Alicia Blum-Ross called ‘Parenting for a Digital Future (Oxford University Press), among other research, impact and writing projects. Sonia is chairing LSE’s Truth, Trust and Technology Commission in 2017-2018, and participates in the European Commission-funded research networks, DigiLitEY and MakEY. She runs a blog called and contributes to the LSE’s Media Policy Project blog. Follow her on Twitter @Livingstone_S

Posted In: Children and the Media | Data Protection | EU Media Policy | LSE Media Policy Project

Leave a Reply

Your email address will not be published. Required fields are marked *