Control measure: Children (and parents or guardians, where appropriate) are proactively provided with privacy information at the time their personal information is collected from them or obtained.
Risk: If privacy information is not proactively given at the point of collection, then the initial processing of that information is in breach of UK GDPR articles 12, 13 and 14 and 5 (1) (a), and the United Nations Convention on the Rights of the Child (UNCRC) article 17.
Ways to meet our expectations:
- Provide privacy information to children when you collect their information directly through your online service.
- Ensure children (and parents or guardians, where appropriate) have an easy way to access privacy information on an ongoing basis.
- Provide children (and parents or guardians, where appropriate) with privacy information for any personal information you obtain indirectly from another source.
- Provide privacy information to children (and parents or guardians, where appropriate) using a combination of appropriate techniques and in bite-sized chunks at the point you use their information.
- Only use personal information in the ways you’ve described in your privacy information.
- Ensure privacy information is concise, transparent, intelligible and uses clear and plain language suitable for and tailored to the various ages of your users.
- Present information in a way likely to appeal to the age of child who is accessing your online service.
- Prompt children to speak to an adult before they activate any new use of their information. Advise them not to proceed if they are uncertain, if the child falls within an appropriate age range.
Options to consider:
- Avoid detailed explanations embedded or hidden in lengthy terms and conditions.
- Provide information in alternative languages.
- Explain complex matters in basic terms, using everyday language.
- Use diagrams, cartoons, graphics, video and audio content, and gamified or interactive content that will attract and interest children, rather than relying solely on written communications.
- Do user testing on your privacy information to confirm it is clear and understandable for children.