Global survey finds 7 out of 10 platforms' age verification methods easily bypassed

The Norwegian data protection authority (DPA), Datatilsynet, has published the findings from an international survey of children's privacy in online services led by the Global Privacy Enforcement Network (GPEN).

The report underscores the urgent need for child-friendly practices, noting significant failings in how websites and apps protect young users.

A primary concern is the ease with which age verification can be bypassed, after 72% of assessed platforms allowed users to circumvent restrictions, typically through simple self-declaration mechanisms. Data collection remains extensive, with 59% of services requiring an email address for full functionality, followed by 50% requesting usernames and 46% requiring geolocation. Compared to 2015, the collection of certain data types has increased.

The survey also found that 71% of services lacked age-appropriate privacy settings or information, while 36% provided no accessible way for children to delete their accounts. For platforms featuring inappropriate content or high-risk designs, only 35% clearly stated how they processed personal data. The findings highlight a persistent gap in online safeguards and the transparency required to protect children's privacy.

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.