All EU member states have until May 2018 to incorporate the General Data Protection Regulation (GDPR) into British law. Article 8 states that, unless member states decide otherwise, children under the age of 16 years old will require parental permission to use “information society services”, which refers to most online resources. Most provisions of the GDPR are to improve personal data protections for the general public. Some provisions specifically concern additional protections for children, given their supposed lower levels of media literacy. Sonia Livingstone, LSE and Kjartan Ólafsson, University of Akureyri, and George Maier, LSE, look at the complex web of factors that influence children’s commercial media literacy.
The European General Data Protection Regulation (GDPR) protects children’s personal data online through various measures, many still being debated. But since being approved by the EU Parliament in April 2016, it has emerged that the GDPR was formulated without consulting children or their representatives, including parents, or any evidence about children’s understanding of the commercial uses of personal data online.
Crucially, the GDPR assumes that, until they are 16 (unless member states reduce this to 13 – as in Ireland, Poland and Sweden or 15 or 14, as in Austria), children understand too little about the online environment or how to make the unwelcome trade-off between their privacy and their right to participate online, and thus their parental consent is required for children to use information society services.
At stake is a curious if not bizarre scenario to be played out in every European family in which teenagers must ask parental permission for each new service or app or, more likely, lie about their age. To have to ask permission risks a drastic restriction on the freedom of young internet users as independent rights-holders to access information, entertainment and forms of expression and participation. To lie about one’s age risks losing such safety provisions as exist for teens online.
What does the evidence tell us?
Most research on children and consent has concerned consent to medical procedures or to participation in research. Both contexts permit individual decisions in the best interests of the child (as required by the UNCRC), and so they relate poorly to the generic age restrictions typically implemented by online providers of sites and services.
Some research has examined children’s understanding of privacy in personal relationships online, but not in relation to commercial providers. This suggests that children (like adults, in fact) think of privacy in contextual not absolute terms – they judge how data will be used in terms of their understanding of who has access to it, in the situation before them, rather than in terms of later or wider or unintended uses or misuses of their data.
This leaves us with little knowledge of the best overall age at which children can reasonably consent to commercial providers using their personal data. For the GDPR to have been informed by evidence, new research should have been commissioned. But it was not.
In the UK, Ofcom’s 2016 media use and attitudes survey of 5-to 15-year-olds includes useful proxy indicators (i.e. relevant but approximate) about children’s grasp of personal data privacy. These offer some worrying indications. For example, among 12-15 year olds:
17% agree “I will give details about myself to a website or app to be able to get something that I want.”
- 13% of those with a social media profile agree “getting more followers is more important to me than keeping my information private.”
- 58% think: “I can easily delete information that I have posted about myself online if I don’t want people to see it.”
How does commercial media literacy change with age?
A telling question in the Ofcom survey asked children who use search engines to look at the image below – described as a picture from a Google search for ‘children’s trainers’ – and explain why the three results at the top of the page have been listed first.
As the graph below shows, age matters a lot. Only a quarter of 8-11 year-olds got the answer right (“these are adverts/sponsored links/paid to appear here”), and one third said they didn’t know. Just under half of 12-15 year olds (and only 6 in 10 of adults) got the right answer.
The point about this simple test is that it poses a challenge – if people can’t get the answer right, what regulatory weight can be placed on their media literacy more generally?
No magic switch at 13 or 16
Bearing in mind the question of whether 16 year olds are more informed than 13 year olds, we then looked at the age trends in getting the right answer by year. As the graph below shows, this does not give strong grounds for a cut-off at 13 or 16 or any other age, although the trend is clear.
A poor 15-year old knows about the same as a well-off 11-year old
In addition to age, further factors differentiate among children who are, after all, a far from homogenous group. Below we show the predicted probability of a child giving the right answer by their age and the socio-economic status (SES) of their household, as the child’s age varies from 8 to 15 years.
Those from more deprived homes are the more disadvantaged in their understanding of the commercial nature of the internet. For example, a 15-year old from a low SES home (DE) knows about the same as a 11-year old from a high SES home (AB). So, for any given age of consent, a socio-economic gap will remain and the consequences for the child will be unequal.
Active parenting can increase a child’s chance of understanding
Next we show the predicted probability of giving a correct answer by SES as parental mediation activities vary from doing nothing up to 12 different activities (restrictive, monitoring, enabling, etc.). So, parents can help (or hinder) their children’s grasp of the commercial nature of the internet.
The breadth of child’s internet use builds their media literacy
Do children’s own internet activities improve (or hinder) their understanding? The graph below shows the predicted probability of giving a correct answer by SES as their online activities increase from doing little or nothing online to doing lots of different things (including communication, gaming, learning, etc.).
So the more experience of the internet children have, the more they understand it. The irony is that if parental consent is required but not obtained for those aged up to 16 to use the internet, they may not have the opportunity to develop the media literacy they’ll need when they do gain access, leaving them vulnerable.
The GDPR fails both to protect children and to provide for their positive rights
We have shown that children’s commercial media literacy improves from 13 to 16 years old, potentially justifying raising the age of parental consent. But even by 16 their understanding is not very great, nor much lower that the understanding of adults, including parents. Worryingly, a socio-economic gap prevails across all age groups.
A substantial piece of regulation such as the GDPR should surely manage fairly to balance the risks and opportunities of internet use in children’s best interests, protecting them in terms of privacy and safety risks yet enabling them to fulfil their rights to online provision and participation. By 16 years old, UK teenagers are only learning what they need to know to give informed consent to use of their personal data. But as other research shows, already by 13 (and even younger) children are learning and benefiting from internet access in ways key to their wellbeing.
Moreover, informed consent depends on many other factors – the child’s capacity and maturity, their family circumstances, and their best interests as regards the balance of risks and opportunities. In a better world, the question would not be whether teenagers should be 13 or 16 to give consent online. Rather, it should be, how can society support children from a wide range of backgrounds to gain the benefits of internet use without commercially exploiting them?
This post gives the views of the authors and does not represent the position of the LSE Media Policy Project blog, nor of the London School of Economics and Political Science.
 Here we included data from the 2016 adults’ media use and attitudes survey (fieldwork 2015). Bear in mind that the sample is not large enough for confident conclusions about the findings by year of age, although it is robust for age groupings and for overall age trends.
 Using statistical techniques of multiple regression, we examined the importance of household socio-economic status (SES), with activities and parental mediation held at the average.
 Parent mediation is measured as a simple count of actions parents claim to take in relation to their child’s internet use (QP28). The median number of actions taken by parents is 4 out of a potential maximum of 12 such actions.
 Activities are measured as a simple count of 18 items in Q13 (online creative activities), Q14 (civic activities), Q20 (social media), Q44 (playing online games), plus using the Youtube website or app. The median number of activities for children aged 8-15 is 3 out of a potential maximum of 18 activities.