LSE - Small Logo
LSE - Small Logo

Sonia Livingstone

November 8th, 2018

Privacy, data protection and the evolving capacity of the child: what the evidence tells us


Estimated reading time: 5 minutes

Sonia Livingstone

November 8th, 2018

Privacy, data protection and the evolving capacity of the child: what the evidence tells us


Estimated reading time: 5 minutes

The Office of the Children’s Commissioner for England has just published a new report looking at how vast amounts of children’s data is collected, and calling on internet giants and other companies to be transparent about how they are capturing information about children and how it is being used. Sonia Livingstone, LSE Professor of Social Psychology, Mariya Stoilova, researcher on children’s data and privacy online at the LSE, and Rishita Nandagiri, PhD Candidate at the LSE’s Department of Social Policy, explain the findings of their research and how this relates to the new report.

The UK’s Data Protection Act 2018 contains a distinctive paragraph for those concerned with children’s rights (which should be everyone, since children are the canaries in the coal mine for threats to all). Fought for by Baroness Kidron of 5Rights, and addressed to the Information Commissioner, it states:

123 Age-appropriate design code

“(1) The Commissioner must prepare a code of practice which contains such guidance as the Commissioner considers appropriate on standards of age-appropriate design of relevant information society services which are likely to be accessed by children….

“(4) In preparing a code or amendments under this section, the Commissioner must have regard—

(a) to the fact that children have different needs at different ages, and

(b) to the United Kingdom’s obligations under the United Nations Convention on the Rights of the Child.”

This is designed to resolve some of the problems with current regulations regarding children’s data protection in the digital environment, without unduly restricting their right to participate. The regulatory solution is that the balance between participation and protection rights should take account of children’s evolving capacity (article 5 of the Convention).

But, what does this mean in the digital environment?

To figure this out, the Information Commissioner’s Office (ICO) called for evidence-based proposals for online service providers in the UK, in its recent public consultation. To stimulate responses, we recently held a seminar at LSE which examined how we can practically build an environment that pays due regard to children’s rights and well-being, and we joined a consultation held by the Children’s Commissioner which resulted in their latest report on data collected about children.

In our project, Children’s Data and Privacy Online, we conceptualise a framework that distinguishes children’s understanding of different types of data and different types of privacy (according to the context – interpersonal, institutional or commercial). In our response to the Information Commissioner’s consultation, we examined children’s understandings according to their evolving capacity. First we conducted a systematic mapping of the available evidence – this involved a comprehensive search of 19 databases (yielding 9,119 search results) and an expert consultation (adding further 270 results). We then we classified this by the age of the children in each study.

Before noting our findings, we emphasise that research shows that children have different capacities to understand privacy and different needs which cannot be explained entirely by age. This means it is not easy to produce age groupings supported by evidence (as the ICO hopes for), because children do not fall neatly into groupings according to age. Indeed, any age group includes children with very different needs and understandings.

Even for a single child, there is no magic age at which a new level of understanding is reached. The academic community has, by and large, moved beyond those early developmental psychology theories which proposed strict “ages and stages”. But nor does it consider children to be similar at the age of five and fifteen, for instance. Rather, developmental psychology, like clinical psychology and, indeed, the UN Convention on the Rights of the Child, urges that children are treated as individuals, taking into account their specific needs, understandings and circumstances. Their parents broadly agree.

What did we find?

Overwhelmingly, the evidence documents children’s struggles with understanding the multiple dimensions of privacy online – indeed, of the digital environment itself. Many studies reveal that children’s digital and data literacy is patchy, along with the consequences this has for their practices in sharing or protecting their personal data in the digital environment. This is not necessarily for want of interest or ability. Rather, the evidence is clear that children cannot – and cannot be expected to –sufficiently understand many of the ways in which their data is used, or for what exactly their consent is formally required by an online provider. This is for multiple reasons:

  • The complexity of the digital interface presented to a child, usually written in complex language and with little attention to privacy-by-design or rights-by-design.
  • No real choice is attached to a decision about providing personal data or choosing how one’s data are used – if there is no choice but the “take it or leave it” choice to provide data to use a service or not to access the service, children will generally not find the “choice” offered meaningful or worthy of consideration.
  • Uses of personal data concern not only the intent and actions of the online provider but also the digital ecosystem that lies behind them – of data brokers, profiling companies, algorithms combining and calculating across data sets, to service the businesses of many players beyond that initially collecting data from a child: and the UK does not teach its children about this commercial (and state) ecosystem and thus cannot reasonably expect children of any age to understand it.
  • Children learn about the online environment via trial and error, thinking about the consequences of their actions retrospectively and expecting to be able to retract any online activities and avoid future negative consequences. They see their learning errors as inconsequential, giving little thought to how these might transfer across contexts or persist across time, seeing them as of little or no interest to any external parties.

Boiling the research down to its essence, we attempted to map the development of children’s understanding of privacy by age, with the caveat that the differences within as well as across age groups can be substantial:


Bearing in mind the available evidence, and in addition to our specific responses to the Information Commissioner’s Office regarding default privacy settings, data minimisation standards, the presentation and language of terms and conditions and privacy notices, uses of geolocation technology, automated and semi-automated profiling, and so forth, we recommended that:

  • Child-rights-respecting policies for the digital environment are needed to balance protection and autonomy, and prevent discrimination and long-term consequences.
  • Sustained media (data, digital, critical) literacy education from an early age is vital, but not a “silver bullet”.
  • Support children by supporting parents, teachers, and welfare bodies to be able to address “best interests” and vulnerabilities.
  • Privacy-by-design, mechanisms for redress, enforcement, evaluation are all important and should be informed by strong evidence base and children’s voices.

Our consultation response, which includes summaries of 64 of the most relevant empirical studies – itself a wealth of information – is now in the public domain and may answer any further questions you may have.

This article gives the views of the authors and does not represent the position of the LSE Media Policy Project blog, nor of the London School of Economics and Political Science.

About the author

Sonia Livingstone

Sonia Livingstone OBE is Professor of Social Psychology in the Department of Media and Communications at LSE. Taking a comparative, critical and contextual approach, her research examines how the changing conditions of mediation are reshaping everyday practices and possibilities for action. She has published twenty books on media audiences, media literacy and media regulation, with a particular focus on the opportunities and risks of digital media use in the everyday lives of children and young people. Her most recent book is The class: living and learning in the digital age (2016, with Julian Sefton-Green). Sonia has advised the UK government, European Commission, European Parliament, Council of Europe and other national and international organisations on children’s rights, risks and safety in the digital age. She was awarded the title of Officer of the Order of the British Empire (OBE) in 2014 'for services to children and child internet safety.' Sonia Livingstone is a fellow of the Academy of Social Sciences, the British Psychological Society, the Royal Society for the Arts and fellow and past President of the International Communication Association (ICA). She has been visiting professor at the Universities of Bergen, Copenhagen, Harvard, Illinois, Milan, Oslo, Paris II, Pennsylvania, and Stockholm, and is on the editorial board of several leading journals. She is on the Executive Board of the UK Council for Child Internet Safety, is a member of the Internet Watch Foundation’s Ethics Committee, is an Expert Advisor to the Council of Europe, and was recently Special Advisor to the House of Lords’ Select Committee on Communications, among other roles. Sonia has received many awards and honours, including honorary doctorates from the University of Montreal, Université Panthéon Assas, the Erasmus University of Rotterdam, the University of the Basque Country, and the University of Copenhagen. She is currently leading the project Global Kids Online (with UNICEF Office of Research-Innocenti and EU Kids Online), researching children’s understanding of digital privacy (funded by the Information Commissioner’s Office) and writing a book with Alicia Blum-Ross called ‘Parenting for a Digital Future (Oxford University Press), among other research, impact and writing projects. Sonia is chairing LSE’s Truth, Trust and Technology Commission in 2017-2018, and participates in the European Commission-funded research networks, DigiLitEY and MakEY. She runs a blog called and contributes to the LSE’s Media Policy Project blog. Follow her on Twitter @Livingstone_S

Posted In: Children and the Media | LSE Media Policy Project