Global app/website sweep raises concerns about collection of personal information from kids

GATINEAU, QC, Sept. 2, 2015 /CNW/ - A majority of websites and mobile applications assessed as part of a global privacy sweep are collecting personal information from children – some of which can be particularly sensitive – and sharing it with third parties.

The results of the third annual Global Privacy Enforcement Network (GPEN) Privacy Sweep show that many are also failing to provide adequate protective controls to effectively limit the collection of personal information from children and are redirecting children to other sites with different privacy protection practices and sometimes questionable content.

The Privacy Sweep considered apps and websites both targeted specifically at children, as well as those popular among them.

"Children represent a vulnerable segment of the population and companies should make every attempt to avoid collecting their personal information," Commissioner Daniel Therrien says. "We were pleased to see that a smaller, albeit significant, number of mostly targeted websites and apps swept did not collect any personal information at all, demonstrating it is possible to have a successful, appealing and dynamic product that is also child friendly and worry-free for parents."

The Sweep also shed light on whether websites and apps are seeking parental involvement and whether users could easily delete their personal account information.

A number of specific examples illustrating the observations can be found in a blog post on the Office of the Privacy Commissioner of Canada's website.

"We saw some innovative examples of protective controls such as the use of pre-set usernames and avatars to prevent children from using their real names or photos," says Commissioner Therrien. "Still, too many developers are collecting particularly sensitive personal information such as photos, videos and the location of children, and often allowing it to be posted publicly, when there are clearly ways to avoid it.

"Given the large number of apps and websites that say they may disclose the information to third parties, it raises questions about the appropriateness of tracking children for the purposes of, for example, advertising," Commissioner Therrien adds.  "It also raises all sorts of questions about the potential for harm to both reputation and well-being."

The Sweep took place between May 11^th and 15^th 2015. In total, 1,494 apps and websites were assessed by sweepers from 29 privacy enforcement authorities in 21 different countries. The Office of the Privacy Commissioner of Canada's sweep team, which included several children, looked at 172 of them. The young sweepers, who were accompanied by parents, shared their observations which have been compiled in a separate blog post.

The GPEN initiative is aimed at encouraging organizations to comply with privacy legislation and to enhance co-operation between privacy enforcement authorities. It is not in itself an investigation, nor is it intended to conclusively identify compliance issues or legislative breaches. Concerns identified during the Sweep, however, will result in follow-up work such as targeted education, outreach to organizations and/or enforcement action.

In fact, the Office of the Privacy Commissioner of Canada has already prepared a classroom activity for  teachers to help familiarize students with privacy policies and issues related to the collection of personal information online. It includes Pro Tips for Kids: Protecting Your Privacy Online, a tip sheet for privacy safe surfing for children and their parents.

This year's Sweep is the latest in a series of initiatives focused on the important issue of youth privacy. In March, the Office of the Privacy Commissioner of Canada issued a 10 tips guide for organizations that collect information from young people in the wake of an investigation of a website aimed at children.

In June, Commissioner Therrien unveiled his privacy priorities and strategies for the next five years. The plan includes enhancing privacy protection for vulnerable groups such as youth who, as early adopters of new technologies, may be at greater risk of reputational harm from sharing personal information online.

Canada's federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), requires meaningful consent for the collection, use and disclosure of personal information. As a result of recent amendments to PIPEDA, the Act clarifies that consent is considered valid only if it is reasonable to expect that an individual understands the nature, purpose and consequences of the collection, use or disclosure. Organizations must therefore pay close attention to privacy issues when it comes to the personal information of children.

"Not only do we need to inform this vulnerable group about online privacy and the perils of oversharing, we need to limit the ways and reasons for which children's personal information is collected," Commissioner Therrien says.

"Children, parents and teachers, as well as website and app developers all have a role to play. Children need to learn about and understand digital privacy issues; parents and teachers need to be aware of it themselves and impart that knowledge to youngsters; and developers must recognize that children are among their users and deploy effective privacy controls to protect them."

Global Sweep highlights

• Two-thirds (67%) of websites/apps swept collect personal information from children, including particularly sensitive data such as photo/video/audio (23%), phone number (22%) and address (19%).
• Nearly three-quarters (71%) of websites/apps swept had no simple means for deleting account information.
• Barely a quarter of websites/apps swept sought parental involvement and a mere 14% offered a parental dashboard where guardians could adjust security and/or privacy settings.

Office of the Privacy Commissioner of Canada Sweep highlights

• Nearly two-thirds of websites/apps swept (62%) included links redirecting children to other sites with varied privacy protection practices, often via an ad or contest icon that sometimes appeared to be part of the original site.
• Nearly two-thirds (62%) of websites/apps also mentioned that they may disclose personal information to third parties.
• Sweepers said they felt comfortable allowing a child to use more than three-quarters (77%) of apps and websites swept that were specifically targeted at children. Just 46 percent of apps and websites that were popular with children, however, left sweepers with the same level of comfort.

About the Office of the Privacy Commissioner of Canada

The Privacy Commissioner of Canada is mandated by Parliament to act as an ombudsman and guardian of privacy in Canada. The Commissioner enforces two laws for the protection of personal information: the Privacy Act, which applies to the federal public sector; and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal private sector privacy law.

NOTE: To help us to respond more quickly, journalists are asked to please send requests for interviews or further information via e-mail.

See also:

Backgrounder 
Trends Blog 
Children's Blog 
Classroom activity for Grade 7 and 8 teachers and Pro Tips for Kids: Protecting Your Privacy Online 
Ganz investigation 
Collecting from kids? Ten tips for services aimed at children and youth 
Additional youth privacy resources from the OPC

SOURCE Office of the Privacy Commissioner of Canada

Tobi Cohen, Office of the Privacy Commissioner of Canada, E-mail: [email protected]