How Parents and Educators Can Protect Children’s Online Privacy

For many children, the line between the physical and virtual worlds was already blurry. Then the coronavirus pandemic began, shifting even more of their daily activities online. Social distancing guidelines meant that education, entertainment and socialization all had to transition to virtual formats.

These changes helped protect the health of children and their families—but they may have also introduced unexpected online privacy risks.

“When a child is studying, visiting everything from Wikipedia to running searches and all this other stuff, they’re getting information and getting data, but they’re also giving information and giving data,” said Matt Mitchell, tech fellow at the Ford Foundation and founder of CryptoHarlem, an organization that offers free, community-based privacy training.

Kids may not be prepared to safely manage this added security risk or protect their online privacy—especially if they were not online regularly before. Because their capacity for long-term reasoning and risk perception is still developing, they may even pose a threat to their own online safety.

Parents and educators can help protect children’s digital privacy and empower them to practice online safety. Learn more about online privacy laws and internet safety for kids below. 

End Violence Against Children’s report, COVID-19 and Its Implications for Protecting Children Online (PDF, 160 KB), outlines several potential threats to internet safety for kids, including:

Children in marginalized communities might experience unique concerns based on their race, religious beliefs and customs, or documentation status. They may accidentally trip filters and keyword-based technologies designed to prevent radicalization, said Mitchell. Predictive algorithms used to prevent gang activity can also make mistakes.

“It can bring a negative focus and attention to the family, which could lead to collision and contact with law enforcement,” said Mitchell.

A child’s sexual orientation or gender expression may also put them at greater risk for cyberbullying. For example, LGBTQ youth are over four times more likely than non-LGBTQ youth to report online sexual harassment, according to a report from the Gay, Lesbian & Straight Education Network (GLSEN) (PDF, 4.3 MB).

“Kids are super smart, and you’re not going to pull one over on them,” said Mitchell. “If you’re trying to out-spy a kid, well, they know a hundred other kids who have figured out all the ways around these things.”

Mitchell recommends directly engaging children in conversations about how to have privacy online.

YOUNGER CHILDREN (AGES 4 TO 11)
Make comparisons between the virtual world and the physical world to help younger kids understand these abstract concepts.

OLDER CHILDREN (AGES 12 TO 18)
Make adolescents aware of the real-world consequences of online behaviors. Mitchell advises parents to ensure older kids understand the risk of sharing intimate images. If they possess a picture of a minor, even by consent, it could legally be considered child pornography and lead to charges.

CHILDREN WITH MARGINALIZED IDENTITIES
Mitchell encourages parents of children who are marginalized to explain that the othering and criminalizing they experience in person happens online, too—and that you are available with support.

Privacy refers to protecting one’s identity and movements from tracking or surveillance. (NPR)

Online (or Digital) Privacy covers users’ online activity, such as which sites they visit, and their offline activity, including their location and contacts. (NPR)

Privacy Policy is an internal document that informs employees how employers will use and protect their personal information. (CSO)

Personally Identifiable Information (or Personal Data) refers to “information about an individual maintained by an agency,” such as a social media company or workplace, that can be used to trace or distinguish an individual’s identity (e.g., social security number, birthday or biometric records) or that can be linked to an individual (e.g., employment information). (National Institute of Standards and Technology, PDF, 819 KB)

Security means protection from having one’s data stolen, including account passwords and credit card numbers. (U.S. Department of Health and Human Services’ site, HIV.gov)

Malware is a broad term for malicious software used by cybercriminals to harm computing devices, services or networks and to steal data for financial gain. (McAfee)

Opt In/Opt Out refers to two different approaches taken by email marketers in contacting users; “opt in” means companies can only email users who consent to communication whereas “opt out” allows companies to email anyone who has not explicitly told them not to. (Computerworld)

Spyware is a type of malware that infiltrates a computing device in order to steal a user’s sensitive information and internet usage data. (Norton)  

Two-Factor Authentication (2FA) is a security measure that requires users to enter two types of information (e.g., a password and a code sent to their smartphones) in order to access secured data or accounts. (Investopedia)

Active Data Collection refers to users intentionally providing information, such as entering a birthdate. (IAPP)

Passive Data Collection is data collection that happens automatically, of which the user may be unaware. (IAPP)

Caching is the “saving of local copies of downloaded content,” so that future downloads can happen faster. (IAPP)

The Fourth Amendment protects U.S. citizens from warrantless searches and seizures of persons or objects in places that, by society’s standards, they have a reasonable expectation of privacy, such as in their own home. (Legal Information Institute)

The Expectation of Privacy Test, which originated from the Supreme Court case Katz v United States, helps determine which situations meet the “reasonable” standard. How the expectation of privacy applies online remains unclear and undecided. (EFF)

Online Privacy Laws to Know: A COPPA Summary and More

Children’s Online Privacy Protection Act (COPPA) of 1998: Allows parents to control what information websites and online services can collect from children under 13.

California Consumer Privacy Act (CCPA) of 2018: Gives users the right to know how businesses use their personal information, to have it deleted and to opt out of its sale. Under the CCPA, children under 16 and/or their parents must opt in to having their data sold. This act applies only to California residents and for-profit businesses that do business in California. 

CAN-SPAM Rule: Requires commercial emails to have accurate header and subject lines, include a valid physical address, identify itself as an advertisement and provide a way to opt out.

General Data Protection Regulation (GDPR): Requires businesses to protect the personal data and privacy of European Union citizens or residents and levies heavy fines (up to 20 million euros or 4% of global revenue) for violations.

Privacy Laws in California: Are among the most stringent in the United States. The Attorney General of California’s website summarizes state and federal laws protecting citizens’ privacy, including online privacy.

Please note that this article is for informational purposes only. Individuals should consult an authorized professional before following any of the information provided.