On 2 August 2024 the ICO published a progress update on the Children’s Code Strategy (the Strategy) (published in April 2024). The Strategy set out the ICO’s priority for 2024-2025 which is “to drive further improvements in how social media platforms (SMPs) and video sharing platforms (VSPs) protect children’s personal information online”. The update covers the initial findings from a review of 34 SMPs and VSPs:
Children’s profiles set to private by default
The review found most children’s profiles are set to private by default but there were platforms that did not conform to this and instances where friend/follow requests and direct messages could be received from strangers.
Default geolocation settings
While the platforms typically switch geolocation off by default, there was evidence of nudging to turn these settings on or to post their location/share this with others. In some situations, it was not clear how to switch off geolocation if a user changed his/her mind.
Profiling children for targeted advertising
Whilst some platforms used limited personal data or none, there are others where it is not clear what information is being collected or how it is used for advertising. There was some potentially excessive data collection and a lack of controls for advertising preferences.
Use of children’s information in recommender systems
The ICO found that there are transparency issues in the use of these systems, that it is not clear how personal data is used to make the recommendations or what measures are used to protect children’s privacy when doing this.
Use of information of children under 13 years old
Most platforms reviewed specified a minimum age of 13 but most of those who had age assurance mechanisms relied on self-declaration of age, which the ICO identified as being unlikely to be appropriate. Many platforms appeared to rely on consent for at least some processing.
Read the full ICO update
The ICO has been engaging with the platforms reviewed to ensure they take prompt steps to become compliant/justify their positions, in absence of which, investigations and enforcement will take place where appropriate.
The ICO has called for evidence on the use of age assurance and of the use of children’s personal data in recommender systems. The call closes on 11 October 2024.
The full update can be found here.
