Children’s right to privacy is recognized under the laws of various jurisdictions and under international treaties, most notably the United Nations Convention on the Rights of the Child (hereinafter: “CRC”). However, in today’s world, there is a growing concern for children’s privacy in digital contexts, and when closely examining how children’s right to privacy is implemented in practice in various legal systems, doubts arise as to whether legal recognition is indeed accorded to children’s interest in privacy.

This paper attempts to explain the gap between the recognition given to children’s privacy at the declaratory level and the failure to recognize and protect children’s privacy interest in practice. The focus rests on informational privacy, meaning on concerns regarding the collection, storage, processing, usage, and disclosure of information related to children in these different contexts.Footnote 1 Suggestions are then made about what can be done to remedy this situation and truly protect children’s interests in privacy.

1 Legal Failure to Protect Children’s Interest in Privacy

When critically examining different settings and contexts that involve children’s privacy, it is questionable whether children’s interest in privacy actually receives legal protection. As described in this section, children’s supposed right to privacy does not guarantee them a space of their own, not even a virtual one. Children are constantly under increasing surveillance and oversight, be it of parents, state agents, or a different group of adults, and this oversight is often buttressed by the law. This observation is true in a plethora of legal systems, whether in the United States, the United Kingdom, the European Union, or Israel.

1.1 Children’s Privacy in the Online World

Let us start with examining children’s privacy in the online world, since it has been the rise of the digital age, with the expansion of information technologies and digital networks, which made children’s privacy a frontline issue. Children’s online privacy arises within a wide range of online spaces and activities. It develops in the context of the relationship between children and public entities, children’s interaction with commercial entities, and children’s relationship with other individuals.Footnote 2

Public entities today collect and keep data on children from the very moment of birth. This practice raises concerns about the purposes for which such data is gathered, whether and how it is shared, and the uses and implications of its collection.Footnote 3 Children’s online data has also become a valuable commodity for commercial entities, which today gather more information on children than governments do, or are even able to, collect.Footnote 4 Children’s online activities often require that they provide a substantial amount of personal data, whether intentionally or unconsciously.Footnote 5 Commercial entities employ various tactics to obtain and collect such data, and the means they use to process it evolve and advance constantly.

1.2 Legislative Approach: COPPA and GDPR

In this complex set of relationships and interactions involving children, their privacy is considered not only as an interest worthy of protection in itself, but also as a necessary means to protect against harms like commercial exploitation,Footnote 6 harm to reputation, and identity theft.Footnote 7 Numerous jurisdictions have recognized these risks and enacted legislation with the purpose of safeguarding children’s privacy rights in the digital age. Two notable examples are the Children’s Online Privacy Protection Act (COPPA), passed by the United States Congress in 1998,Footnote 8 and the General Data Protection Regulation (2016/679) (GDPR), enacted by the European Union.Footnote 9 Both of these instruments regulate the collection and processing of personal information from children online.

The GDPR applies to children and adults alike, though it does contain special provisions that apply to children and explicitly states that children’s personal data merits specific protection.Footnote 10 Commercial entities and public authorities are also both subject to GDPR. Contrastingly, COPPA applies only to children’s data and concerns mainly commercial activity.

Nonetheless, both the COPPA and the GDPR are less concerned about the appropriate flow of information about children, or whether certain limits should be imposed on the collection or processing of their information. Rather, they similarly adopt a legal mechanism that largely relies on parental consent as the means to protect children’s privacy. Parents can consent on behalf of their child, thereby granting permission for the child’s data to be collected and processed (until the child reaches a certain age, for example 13 or older). Parents control the information gathered about their children by public entities; they give their consent to commercial entities that wish to process private information about their children online.

It is questionable that this mechanism of parental consent can protect children’s informational privacy since existing research suggests that parents seem to have a limited understanding of the effects of online advertising.Footnote 11 This reliance on parents also seems to overlook the most vulnerable groups of children, such as children whose legal parents cannot adequately care for them.Footnote 12 At the same time, reliance on children’s own consent beyond the age of 13, or even 16, to authorize the collection and processing of their data for commercial purposes is also problematic since research also indicates that “commercial privacy is the area where children are least able to comprehend and manage on their own”.Footnote 13

1.3 Parents as Gatekeepers

Parents are also often the legal gatekeepers of children’s privacy concerning their involvement with the media. Few jurisdictions legislatively address, regulate, or limit the relationship between the media and children when the children’s parents have given their consent to the media. Indeed, children increasingly appear at the center of media attention, and they take part in reality shows, documentaries, other television shows, and the like.Footnote 14 Absent special circumstances, such as care proceedings or a specific law that requires court approval or prohibits publicity altogether, a child’s parents have control over the child’s publicity.

This paper does not intend to challenge the law’s working premise about the unique role of parents. After all, parents act as proxies for the execution and maintenance of children’s rights in almost every other aspect. If the issue is who can consent on children’s behalf, or who should have control over children’s information (when children themselves cannot exercise such control), then there are strong arguments to be made in favor of parents. Nonetheless, this contribution challenges the assumption that privacy laws should mainly be about regulating consent (at least where children are concerned). Thus, one might consider whether there should be a general prohibition, or some non-waivable limitations, on the collection, processing, and certainly transfer of children’s personal information. Rather than relying merely on notions of control and consent, limitations should also be considered for reality shows and documentaries that involve children. Additionally, a parent-centered model for protecting children’s privacy interests fails to consider children’s informational privacy interest in their relationship with their parents, which will be discussed in greater details below.

1.4 Supervision by Other Adults

Nearly the only area in which parents are not given control over their children’s privacy and information is sexual and reproductive health. Here, children are sometimes permitted to withhold information from their parents and exclude them from their decision-making. Many jurisdictions recognize that medical advice and treatment may be given to minors who are sufficiently mature to understand the nature and implications of the treatment, without parental consent or knowledge. But even in this context, parental oversight is merely replaced by medical professionals’ and occasionally state agents’ supervision.

Indeed, when the law does not support parent’s control over children’s privacy, it supports supervision by other adults. Thus, schools have increasingly become a site of extensive surveillance, and they have begun to more heavily employ varied surveillance tactics, such as inspecting schoolbags, using sniffer dogs, and filming with surveillance cameras (CCTVs), which are one of the most commonly used school surveillance technologies. Children cannot find legal recourse in their jurisdiction’s privacy laws against this “rise of the surveillance school”,Footnote 15 and legal attempts to challenge these practices based on children’s right to privacy have mostly failed.Footnote 16

1.5 Parental Surveillance and Sharenting

To complete the legal picture, let us consider children’s right to privacy in the home, as well as their right to privacy vis-à-vis their parents. In these contexts, law plays a more tacit role, as it rarely regulates intra-familial relationships directly. However, no regulation or legal disregard in fact ratifies and endorses existing practices.

Parents today are under increasing pressure to monitor their children, especially online.Footnote 17 They are encouraged to safeguard their children using a plethora of apps and services that allow them to block certain websites; listen in to their children’s (offline) conversations by remotely activating their smartphone’s microphone; and track their online activity, interactions, and location. Monitoring has become associated with good, loving, and responsible parenting, and the surveillance of children has been framed in the language of safety, protection, and care.Footnote 18 Parental surveillance is increasing with children’s age. As children grow older and become more independent, parents resort more to monitoring and surveillance.Footnote 19 Thus, even when legal regulations seem to recognize older children’s independent interests by sanctioning their online activity without requiring parental consent, children remain under constant parental supervision. It is not surprising, therefore, that studies on children’s experience and conceptions of privacy reveal that many children (mostly teenagers) do not regard the home as a private place.Footnote 20

The phenomenon of “sharenting” (a portmanteau of “sharing” and “parenting”), which refers to the ways that parents use social media to distribute pictures, videos, and other updates about their children, further complicates the protection of children’s informational privacy.Footnote 21 Various researchers have shown the widespread popularity of parents’ posting stories about and photos of their children online.Footnote 22 Nonetheless, social science research on sharenting paints a complicated picture. When deciding what to share online, parents do consider the possible implications for their children and, in particular, their children’s privacy.Footnote 23 For example, parents take some responsibility when deciding what to publish, sometimes deciding against sharing photos that might later embarrass their children.Footnote 24 Still, the question of decision-making remains contested between parents and children. Children and parents disagree on the permission-seeking process with regards to posting information and photographs online, with children thinking parents need to ask their permission more often than parents think they should.Footnote 25 These findings suggest that parents seem to have internalized the message that they control their children’s privacy. They show responsibility and care when making decisions about posting information and photos of their children online; however, they often think the decision is (solely) theirs.

Disputes and disagreements between children and parents regarding the posting of information and pictures online almost never reach the courtroom, and the rare exceptions usually arise in the context of divorce. More importantly, current legal conceptions of privacy seem inadequate to address the complexity inherent to sharenting, since parental sharing is often not just about children; it is about the parents, too, and existing conceptions of the right to privacy provide neither the terminology nor a normative framework to address such complex dilemmas.

2 Possible Explanations for Failure of Existing Laws to Protect Children’s Privacy

As demonstrated in the previous section, existing legal policies and rules fail to adequately acknowledge and respect children’s privacy interests in the various contexts in which they arise. I argue that four main reasons underlie these failures of the law. First, there is insufficient research and knowledge about children’s needs and interests in privacy, and where research does exist, lawmakers fail to take notice of its findings. Second, privacy theories are mainly adult-centered and cannot adequately be applied to children. Third, family law conceptions still focus on parental authority, and lastly, the ideal of “the family” as a unit seems incompatible with children’s individual right to privacy. I briefly elaborate on each of these reasons below.

2.1 Limited Knowledge About children’s Interest in Privacy and Disconnect Between Research and Legal Policy

Current policies and laws about children’s privacy rest upon certain assumptions about children such as what need, if any, they have for privacy, as well as what risks privacy might have for them and how they can be protected. Thus, for example, common assumptions suggest that young children simply do not need privacy, that teenagers today neither care nor value privacy,Footnote 26 or that privacy is simply dangerous for children. Nonetheless, it is questionable whether there is evidence to support such assumptions. The research on children’s privacy is relatively new, and substantial gaps still exist in current knowledge about the various dimensions related to children’s interests in privacy.Footnote 27

More importantly, even when research exists, policymakers seem to pay little attention, if any, to its findings. As noted by Sonia Livingstone and her colleagues, even the GDPR, which allegedly makes children’s privacy a central issue, was drafted with limited input about and consideration of research regarding children’s privacy.Footnote 28

2.2 Privacy Theories and Conceptions are Adult-Centered

The meaning of the right to privacy is far from clear, even if we limit the discussion to informational privacy, which addresses concerns about the collection, storage, use, and disclosure of personal information. Indeed, for several decades, scholars from various disciplines have tried to define both privacy and the right to privacy. However, children have been excluded from the extensive scholarly engagement with theorizing privacy, which has been written almost entirely with adult right-bearers in mind.Footnote 29 As a result, prevailing conceptions of privacy apply only awkwardly, if at all, to children.

Predominant approaches to privacy include Warren and Brandeis’ famous formulation of the “right to be let alone”,Footnote 30 privacy as access,Footnote 31 and privacy as autonomy or control.Footnote 32 Children, however, are inherently dependent upon and connected to others, thereby rendering a privacy right aimed at drawing a boundary between the right holder and others unapplicable to them. Children likewise do not fit the autonomy basis for existing conceptions of privacy. Perceptions of privacy as access or control assume a possibility, whether cognitive or psychological, of individual control, which young children generally lack. These observations are not merely theoretical; they underlie and explain the aforementioned lack of protection given to children’s privacy under the law. If privacy is about drawing boundaries and setting individuals apart, then applying it to children might be no more than „abandoning children to their rights“.Footnote 33 If privacy is mainly about control, then finding the most adequate proxy for exercising children’s control should indeed be the legal goal (and, as such, parents would appear to be the most adequate candidates).

2.3 Prevalent Conceptions of the Parent–child Relationship

The legal approach, which resigns to a mechanism of parental control and consent as the means to protect children’s privacy, can be explained by well-established views about the role of parents. As Article 16 of the CRC, which incorporates children’s right to privacy, was being drafted concerns arose in the Working Group regarding the role of parents.Footnote 34 These concerns were ultimately resolved by including Article 5, which requires respect for “the responsibilities, rights and duties of parents … in the exercise by the child of the rights recognized in the present Convention”.Footnote 35 Thus, while trumpeting the rights of the child, the CRC, like other international documents on human rights, also acknowledges that the family is the most fundamental, basic, and important unit of society. It also emphasizes the importance of preserving families’ autonomy, harmony, and privacy wherever possible.

Nonetheless, various states have issued declarations or reservations about the relationship between parents and their children’s rights, mentioning specifically children’s right to privacy under Article 16.Footnote 36 In fact, in many legal systems, parental rights, particularly their rights to direct the upbringing of their children, are constitutionally protected while children’s rights are not.Footnote 37

2.4 Theories About “the Family” as a Relational Unit

Children’s right to privacy in the home and especially in their relationship with their parents, which arises in the context of parental surveillance and sharenting, also raises concerns regarding the ideal of the family as a relational entity. Recognizing children’s individual right to privacy in their relationship with their parents seems to threaten the intimacy and loving relationships that are (or should be) integral to every family.Footnote 38 It also seems to contradict the sense of collectivity family members are believed to share—a sense “that ‘we’ exist as something beyond ‘you’ and ‘me’”.Footnote 39 These concerns seem particularly relevant if the right to privacy is understood in a hyper-individualistic way, which emphasizes boundaries and depicts individuals as separated rather than connected.

While it is certainly true that the family is more than a mere collection of individuals, we should also remember that the treatment of the family as a unit has been heavily criticized for causing systematic harm to the most vulnerable family members, usually women and children.Footnote 40 In recent decades, much feminist research has been devoted to exposing how the family, as a “unit” or an “entity”, is no more than a social construction, a fiction that “has hidden a multitude of wrongs”.Footnote 41 This is particularly true of the concept of “the family’s privacy”, which has served as an ideological tool to shield the stronger members of the family (usually men, in their role as husbands and fathers) in cases of abuse of the weak (usually women and children).Footnote 42 It should also be remembered that the struggle to have children’s own interests, needs, and most of all personhood recognized and protected has been long and difficult.

3 How can we Better Protect Children’s Privacy Interests in Today’s World?

Achieving better recognition and protection of children’s right to privacy requires several steps. First, we need more child-focused privacy research to address the existing gaps in our knowledge regarding children’s interests, needs, perceptions, and value of privacy. Second, policy should be based on findings from research that does exist, which clearly indicates that children need privacy, and its availability is necessary for their welfare. Children’s privacy needs include a space of their own where they can be free from adult supervision, and surveillance is especially harmful for them. When it concerns the collection, processing, usage, and disclosure of information about them, children’s needs and interests cannot be adequately guaranteed through a mechanism of consent, even regarding older children, and reliance on parental control is also insufficient. Children need privacy at home and in their relationship with their parents as well. These findings must be taken into account by lawmakers, for the law is to adequately safeguard children’s privacy interests.

Third, children and their interests should be brought into the general theoretical engagement with privacy. Theorizing privacy cannot be an exclusively adult-centered project whose end results are merely applied to children. Thus, a new theoretical understanding of privacy, which doesn’t focus on boundaries and control, should be developed to incorporate and express children’s interest in privacy.

Last, we need to rethink our conceptions of the family and the parent–child relationship and move beyond the dichotomous perceptions of the family as either an “entity” or a mere collection of individuals. Individual rights shape and create relationships, including familial relationships.Footnote 43 The individual right to privacy, in particular, plays an important role in enabling, creating, and shaping intimate familial relationships. Understanding children’s privacy as a relational individual right (alongside the protection of privacy of the relationship) can assist in better defining and shaping the parent–child relationship.