ICO publishes research about children's online activity, updates strategy

The Information Commissioner's Office (ICO) has published three new pieces of research (here, here and here) revealing a significant disparity between parental perceptions and the reality of children's online experiences. Released alongside the regulator's children's strategy update, which estimates that regulatory action has protected nearly five million child users since April 2024, the research highlights the growing complexity of youth digital activity.

A survey of 4,132 children aged 8-17 and their parents revealed that 36% of children interact with individuals known only online or complete strangers. Furthermore, 52% of children admitted they would bypass age checks, a figure rising to 64% among those whose parents had previously helped them circumvent age restrictions, an action admitted by 31% of parents. Although 91% of parents implement monitoring tools, 41% of children attempt to circumvent them, with nearly half finding it easy.

The findings show parents often rely on location sharing for peace of mind while feeling overwhelmed, whereas children frequently consent to extensive data tracking without understanding what "consent" even means. The ICO stressed that technical controls cannot replace regular engagement and warned that delaying privacy discussions until secondary school is too late.

With regards to its children's strategy, the ICO has extended its current strategy for a further 6 months to continue assessing practices by social media platforms (SMPs) and video sharing platforms (VSPs) in priority areas and the mobile games sector. As such, the ICO will focus its interventions on areas where children face the biggest data protection risks, where its regulatory action can bring about change at scale and where its actions add value alongside other regulators. 

Training Announcement: Find out more about our range of independent accredited qualifications from BCS and IAPP. These include professional certifications for practitioners covering data protection and AI governance, information security and risk management, along with access to public information.