MNHQ here: AMA with Emily Keaney, Deputy Commissioner at the Information Commissioner's Office, talking children's privacy and keeping kids safe online, Tuesday 15th September, 7-9pm

[RhiannonEMumsnet]

Hi there,

We're delighted to announce an AMA with Emily Keaney, Deputy Commissioner at the Information Commissioner's Office (ICO), on Tuesday 15th September at 7pm.

The ICO is the UK's independent data protection regulator. It works to protect people's personal information and privacy rights, including helping to make sure children can explore, learn and play online safely while organisations use their data responsibly.

Emily will be answering your questions about children's privacy online, including how parents and carers can help keep children safe online and what families can do to make informed choices about the apps, games and online services their children use.

Emily will also be discussing the ICO's Switched on to Privacy campaign, which helps families understand children's data protection rights and make informed choices about the digital products and services they use every day.

The campaign is aimed at parents and carers of children aged 4 to 11 and provides practical advice on navigating issues such as privacy settings, targeted advertising, location sharing and the collection of children's personal information online. It's designed to make online privacy feel like an everyday life skill for children, similar to road safety, brushing their teeth and knowing not to talk to strangers. Through simple, regular conversations, the campaign helps families build children's confidence and awareness online.

Please post your questions below and join Emily on the thread on Tuesday to hear the answers.

As always, please remember our guidelines: one question per user, follow-ups only if there's time and most questions have been answered, and please keep it civil.

Hey Emily. Hope you're well. My question is are free games something we should be particularly wary of when it comes to children’s privacy? My kids play quite a few games that are free to download, and I’m never entirely sure what the trade-off is. If we’re not paying for the game, are our children basically paying with their data instead? Is there any simple way for parents to tell what information a game is collecting and what it’s being used for? It's all very unclear tbh.

Hi Emily. What are the things kids do online that many of us probably think are completely harmless, but are actually a bit of a privacy nightmare? Things like using filters, playing games, sharing photos, chatting to friends etc etc. Is there anything in particular that parents tend not to worry about or think is okay, but you really wish they would?

My child's school require them to use a couple of different educational apps for homework etc. Who is responsible for checking that those companies use their information safely?

Hello Emily - I talk to my children about online safety, but not really online privacy. Can you help me to understand what they key differences and/or similarities are? Are they the same thing? My main concerns are strangers being able to talk to my children online but I am also worried about what someone could do with all of their personal info if it fell into the wrong hands. Thank you!

I have primary-aged DC - something I find hard is that I because I didn’t grow up with the online world, I don’t really feel very confident talking about this with them, and know what I should be saying, or what I should be looking for in the app settings. Where do I start?

Hi Emily! My DS has just got a smartphone and it feels like I’ve opened Pandora’s box. I’ve set up parental controls and check his phone regularly but it feels impossible to keep completely on top of it. We thought about waiting until he’s older (he’s 12 now) but I’d rather he learns how to use a phone sensibly under my guidance and while he’s still at an age where my advice has some sway! How can I help him make sensible choices about online privacy/online safety when I’m not there to guide him?

Hi Emily, if my child deletes an app or account, does that mean the company deletes the information it holds about them? And if not, how do I get them to do that? Thank you!

Hi Emily, how do pictures come into the data protection picture? I'm really conscious of not sharing pics of my kids too widely online and my social media is locked down, but in the past my in laws have shared pictures and I'm astounded by the amount of influencers who share pics of their kids online. Do pictures count as 'data'? Should we be more conscious about sharing them?

Hi Emily, thanks for doing an AMA! As a parent, can I ask a tech company to show them all the information it holds about my child? Is there an age limit? And what is the simplest way to do that?

Lots of the apps kids use are run by companies based overseas. Do UK privacy laws still apply to them, and what can the ICO actually do if they don’t follow the rules?

Hello everyone, I'm Emily Keaney, Deputy Commissioner at the Information Commissioner's Office (ICO). Thanks so much for joining me this evening, and for all of your questions. I'm looking forward to talking to you about children's online privacy, the ICO's Switched on to Privacy campaign, and how parents and carers can help their children make safe choices online. I’m a mum too and I know how important this topic is to so many of us - and how hard it can be! I'll be answering as many of your questions as I can over the next two hours, so let's get started.

Hi @BrendaTheFriendlyHen great question. My kids play loads of those games too. In most cases, if a game is free, it is because the company are making their money through advertising. And often, it is our – or our kids’ – data that is being used to drive those ad revenues. That doesn’t necessarily mean they know everything about your child – but they will probably be collecting data on the type of game or games your child likes to play, how long they play for, whether they are spending money in the game and possibly also things like information from linked social media accounts or approximate location.

If you are concerned about this then it is worth having a look at the settings for advertising and personalisation. There should be options that let you control how much of this information is collected and how it is used to tailor content or adverts. You can also check location sharing - does the game collect or share location data and, if so, can it be switched off? And have a look at the information sharing. What details is the game asking for? Does it really need access to things like contacts, photos or the microphone?

Some mobile games may also involve your child creating a profile and possibly interacting with others in the game. For those games it is important to consider:

• Whether the profile is public or private. Can other players see your child's profile, username or activity, or is that limited to approved friends?
• Who can contact them. Can anyone send messages, friend requests or invitations, or can this be restricted?

At the ICO, a lot of the work we are doing is aiming to ensure that online services likely to be accessed by children, including apps, games and websites, comply with data protection law and our Children's Code. The Code requires organisations to put children's best interests first and provide strong privacy protections by default. We are currently looking at how well mobile games are doing this and working to make sure they have the right defaults in place.

We expect companies developing games for children to think carefully about the information they collect, whether they really need it, how they explain this to children and parents, and whether features such as profiling, advertising or location tracking are being used in a way that protects children's interests. The Children's Code also expects privacy settings to be high by default for children.

But we as parents also have an important role to play. That's one of the reasons we launched our Switched on to Privacy campaign. We can help by having conversations with our kids about about privacy, encourage them to think about what information they're sharing, and check privacy settings when children start using a new game or app.

Some of these games can be really fun, but we want children to be able to enjoy them without having to sacrifice their privacy.

Hi @NotABaddie

Lots of the apps, games and services we use online collect data about us, and it is really easy not to be aware of quite how much we are sharing. This becomes particularly tricky as kids get older and want to use and share more independently. I think one way of thinking about this is to talk to children so that they really are aware what they are sharing – and quite how many people they are likely to be sharing it with. If you are sharing that photo on social media to create a funny meme would they mind if people they didn’t know saw it? And are they ok with it potentially living on the internet forever?

The specific thing that comes to my mind though when we think about unexpected or unintended privacy consequences of things we might think of as harmless is location sharing apps. Lots of parents use these so they know where their kids are – including me! It can help keep our kids safe and maybe allow them more freedom because we feel we know where they are. But we have seen in our research that this can also influence children’s attitudes towards privacy as they get older – with it becoming the expectation that your boyfriend or girlfriend will always know where you are at all times through you sharing your location with them, in ways that could tip over into being unhealthy.

Starting conversations about online privacy early – which is a big part of our Switched on to privacy campaign – means that we can help kids think about when, and how, they share information and hopefully makes it easier when they are older to have conversations about what healthy boundaries around sharing information look like.

@PhillyPots both schools and the companies providing the ed tech have a shared responsibility but they each play different roles. The schools need to be making sure they are procuring apps and tools that keep our children's data safe, and the services need to make sure they are designing those protections into their products.

Children cannot choose or opt out of the digital tools their schools adopt, so it is essential that parents, caregivers and pupils can trust that this technology meets the highest standards of data protection.

Under UK law, children's personal information deserves special protection, and online services that children are likely to access should take their best interests into account.

As the data protection regulator, we at the ICO also have our part to play – we've just completed a series of audits and we are talking to the Government and the Dept of Education on this issue - including about how to provide schools with the support to make good choices about what they use.

As a parent, it's perfectly reasonable to ask questions too. If you're unsure why a particular app is needed, what information it collects, or how that information is used, your child's school should be able to explain this and point you towards the relevant privacy information.

@ScottishMummy37 it’s a great question and one I think many people will have a similar view on. It's easy to think online safety and online privacy are the same thing, but they're slightly different. Online safety is about protecting children from harmful experiences online, such as bullying, scams, inappropriate content or contact from strangers. Online safety is primarily regulated by Ofcom under the Online Safety Act, although other regulators also have roles.

Online privacy is about protecting children's personal information and helping them understand what they share online, who can see it, and how it might be used. That could be anything from their name, age and location through to photos, browsing habits, gaming activity or even information collected about them behind the scenes by apps and websites.

The two are closely linked. If a child shares more information than they realise, or uses services with weak privacy protections, it can increase risks to their safety. For example, public profiles, location sharing and oversharing personal information can sometimes make it easier for strangers to contact children or learn more about them than they should.

That's why we think it's important to treat online privacy as a life skill, just like teaching children how to cross the road safely or brush their teeth. We can't be with them every time they go online, but we can help them build the confidence to think before they share, understand privacy settings, and make informed choices about their personal information.

@Parrotfish123 I think lots of parents feel exactly the same. My kids are older but I am often bemused by both what they are up to online and the language they use to talk about it. However, it is really important to know that you absolutely don't need to be a tech expert to help your child build good privacy habits.

One of the reasons we launched our Switched on to Privacy campaign was because we found that many parents wanted to have these conversations but weren't always sure where to start. The good news is that you don't need to know every app, game or platform your child uses.

We encourage parents to focus on three simple things:

Chat: Have regular, informal conversations about what your child is doing online. Ask questions like "Who can see that?", "Do you know why the game is asking for that information?" or "Would you share that with a stranger?" You don't need to make it a big talk, just an ongoing conversation.

Choose: Help your child think carefully about what personal information they share. Many children understand not giving out their home address, but they may not realise that photos, voice notes, location data, gaming activity or even their real name can also be personal information.

Check: Whenever your child downloads a new app, game or device, spend a few minutes looking at the settings together. As a starting point, I'd look for things like whether their profile is public or private, whether location sharing is switched on, who can contact them, and whether the app is asking for information that doesn't seem necessary. Then check again from time to time, as settings can change.

I often compare it to teaching children to cross the road. Most of us don't wait until they're about to walk to school by themselves and then have one big conversation about road safety. We teach them little by little as they grow up. Online privacy can be approached in exactly the same way. Small, regular conversations can help children develop the confidence to make good decisions for themselves as they get older.

Children are growing up in a digital world that many of us didn't experience ourselves. Nobody gets it right all the time. The important thing is creating an environment where your child feels comfortable coming to you with questions and talking about their online experiences.

Hi @CakeforBreakfast45 I agree that there are definitely benefits to having these conversations while your child is still prepared to listen to what you have to say!

Giving your child their first smartphone can feel less like buying a device and more like handing over the keys to a whole new world. It can be overwhelming trying to work out how to help them safely navigate it. But the fact that you're already thinking about how to help your son build good habits is really positive. In reality it isnt realistic to think that as parents we can monitor every single online interaction but the goal is to help your child develop the judgment to make good decisions when you're not there.

It sounds as though you're already doing some of the practical things, like using parental controls and checking settings. But I'd encourage parents to think about online privacy and safety in the same way we think about other life skills - lots of small conversations over time that gradually give them more independence and make those messages the default rather than one big conversation that doesn't get returned to. That's at the heart of the “Chat, Choose, Check” approach from our Switched on to privacy.

I'd also reassure you that it's perfectly normal not to know everything. As you say, we didn't experience the digital world our kids are growing up in, and we won't have all the answers. But you don't need to. Sometimes simply saying, "I don't know, let's look at that together," is one of the best things we can do.

Ultimately, I'd see this less as trying to stay one step ahead of technology and more as helping your son become a thoughtful digital citizen. If you can help him pause and think before sharing information, understand who might see it, and feel comfortable talking to you about his online life, you're already giving him some of the most important tools he'll need.

Hi @verityvesuvius thank you for your question. It is easy to assume that deleting an app or account means all of the information disappears too, but that's not always the case.

Deleting an app from a device usually just removes it from the phone or tablet. The company may still hold information associated with the account. Even when an account is deleted, organisations may need to retain some information for a period of time, for example to meet legal obligations, keep systems secure or prevent fraud. However, they shouldn't keep personal information for longer than they need it.

If you want a company to delete your child's information, the first thing I'd suggest is looking at the privacy settings or account settings within the app. Many services now have options to delete an account or remove personal information directly.

If that doesn't do what you want, you can contact the company and ask them to erase your child's personal information. Under data protection law, children have the same rights as adults, including the right to have their personal information erased in certain circumstances. In fact, the law places particular importance on erasing information that was collected from children online.

More broadly, I'd encourage parents to make checking deletion and privacy options part of their routine whenever a child downloads a new app or creates an account. In the same way we encourage families to Chat, Choose and Check through our Switched on to Privacy campaign, it's worth taking a few minutes to check what information an app collects, what privacy controls are available, and how easy it is to delete an account if your child stops using the service.

The important thing for parents to know is that deleting an app and deleting personal information are not always the same thing. If you're unsure, don't be afraid to ask the company what information they hold and what options are available for removing it.

Hi @Penelope571 this is a really timely question, particularly as lots of children have just gone back to school and the temptation for parents or doting relatives to share back to school photos of kids in their (soon to be trashed!) school uniform can be hard to resist. It’s an issue I know many families have debated and will have differing views on.

In data protection terms, a photograph can be personal data if a child can be identified from it. But I think the wider point for parents (and relatives) to consider is that photos can reveal much more information than we sometimes realise. A picture might show a child's face, but it could also reveal where they go to school, where they spend their free time, who their friends are, or even where they live.

Whether and how much families choose to share is ultimately a personal decision. What I'd encourage parents to do is think about whether they are comfortable with the audience that can see those images now, and potentially in the future. Children's digital footprints can start very young and information shared online can sometimes stay around for a long time.

One thing I think is helpful is involving children in the conversation as they get older. Asking questions like: "Are you happy for me to post this?" or "Who do you think will be able to see this photo?" can help them start developing their own understanding of privacy and sharing online. It may also carry more weight if you need to reinforce those messages with relatives too.

If you do decide to share photos, it's worth checking who can see them. As you've done, reviewing privacy settings and keeping accounts restricted to people you know can help you stay in control of who has access to your family's information.

Ultimately, there isn't a single right answer for every family. The important thing is being thoughtful about what you're sharing, who can see it, and helping children build an understanding of privacy as they grow up. That's exactly what our Switched on to Privacy campaign is trying to encourage: regular conversations that help children make informed choices about their personal information online.

Thanks for the response Emily! It strikes me from this (and some of the other responses) that so much onus is on the child/parent with regards their data - do you think we've got the balance right in how this is regulated? Should we be forcing the companies to be more proactive?

Thanks @hasselbackpotatoes

Data protection law gives you the right to ask an organisation for copies of your personal information – or to do this on behalf of your child. This applies to everyone so there isn't an age limit on being able to request information. This is called a subject access request or SAR. There are sometimes exemptions, but in most cases an organisation should provide this, and if they do use an exemption they should normally:

• tell you why they are not completing your request for information;
• explain their decision; and
• tell you how you can challenge their decision (eg by submitting a complaint).

It is worth bearing in mind that this can be a lot of information, so if you want something specific it can help if you are clear exactly what you want as this may speed things up. Although lots of tech companies will also provide a way for you to request all of the information they hold about you through your account settings which can be a quick way of getting this information.

We have guidance on making a SAR here: Make a subject access request | ICO

Thanks @lemonjellymould really good question. The UK GDPR - which is the law that protects our personal information - doesn't only apply to UK companies. It also covers to companies outside the UK but which offer goods or services to people in the UK. It can sometimes be harder to make sure these companies stick to the law and do what they need to to protect our, and our children's, information, but we have successfully taken action against companies based outside the UK in the past and can do so in the future if needed.

That's Emily - that's really useful. I'd love to hear more about the audits and how they work/what you found, and what you've been talking to DfE about - although I appreciate you may not be able to share all the conversations!

@verityvesuvius I agree this definitely can’t all be on parents - it is hard enough keeping on top of day to day life most of the time! We know from talking to parents that many would like more help to navigate this – which is why we are focused in today’s session on our Switched On to Privacy campaign. However, companies that collect and use children’s personal information have legal responsibilities when they use children's personal information.

At the ICO we have been clear that companies should build privacy into their products and services from the outset, rather than expecting children to navigate complex choices or risks on their own.

We've taken a range of actions to hold organisations to account and drive improvements across the sector. For example, we've issued fines of £14.47 million to Reddit and £247,590 to MediaLab, the owner of Imgur, for using children's personal information unlawfully. We've also secured commitments from Snapchat to strengthen its age assurance measures to help prevent underage users accessing its service.

Beyond individual cases, we've written to social media and video-sharing platforms setting out our expectations on age assurance, required high-risk services to demonstrate how they're complying with the law, and made improvements to features such as Snapchat and Instagram's interactive maps so children have clearer information about when they're sharing their location. And we're continuing to make this a top priority for the ICO, which means we will continue to focus on making sure organisations are building in the right protections.

Parents and children have an important role to play, but organisations are often best placed to prevent harm before it happens. That's why data protection law places obligations on the companies collecting and using personal information, not just on the people using their services.

@PhillyPots we have published the results of our audits so you can read all about them. We found lots of positives - particularly around how the companies we were looking at were keeping the information they collect safe and secure. But there were also areas where improvements were needed - including around how detailed the contracts they had with schools were - that is important because it makes sure everyone is clear on their roles and responsibilities - whether they were keeping the personal information for longer than they needed to and whether they were providing up to date information to users on what happened to their information. We made a total of 596 recommendations to the organisations we audited and almost all of them have been accepted and have either been or are being implemented. We have shared all of those findings with DfE and are talking to them about what providers of educational technology need to do to make sure they are using children's personal information responsibly, and how schools can have confidence that they are choosing a provider who does a good job at that.

The UK Government is also working on secondary legislation that will require the ICO to produce a new statutory code of practice on education technology. These codes of practice set out clear expectations for how data protection law applies in particular sectors or to particular types of people. Details on the scope of the code are still being developed by the Department for Digital, Culture, Media and Sport. The government committed to laying the secondary legislation before Parliament before the end of 2026. Once that is done we will be able to start work on the code, which will help make sure organisations working in this area are really clear on what is required.

We know many parents are also teachers and will be interested in the use of edtech - if you'd like to read the report in full it can be found on our website here: ICO statement on ‘Edtech examined’ report | ICO