The Toilet Paper

Understanding children’s perception of privacy risks online

The Internet can be a dangerous place. Do children understand this?

Suspicious van that promises free candy to children
Getting children’s attention is child’s play

Our children grow up in a digitally connected world that’s eager to gather as much information as possible about its users. Children understand some of the more explicit privacy risks that come with the use of online apps and games, but appear to struggle with more complicated concepts.

Why it matters


Like adults, children spend a lot of their time online; they consume content, use apps, and play games with their friends. These activities all come with privacy risks that may be hard to understand – even for adults.

Parents and teachers must educate children about privacy risks so that they can protect themselves. This means that we have to understand how children perceive privacy and how online services may violate that privacy.

How the study was conducted


You can’t just ask a child how they feel about privacy and expect a reliable answer. The researchers therefore choose to discuss privacy with children aged 6–10 in focus groups instead. Focus groups offer a number of advantages over interviews with individual children:

  • Groups facilitate discussion among participants, which gives you insight into thoughts and perspectives that participants might not have voiced otherwise;
  • There are multiple children in each focus group. This makes them feel more at ease and encourages quality feedback.

All focus group studies started with a brief warm-up session, followed by a presentation of three scenarios. Each scenario was designed to elicit responses about a particular type of privacy risk. The studies were concluded with an open-ended discussion about privacy-related issues.

What discoveries were made


The findings show how children describe, perceive, and cope with privacy risks.

Describing privacy risks


The words that children use to describe a privacy risk seem to be a good indication of how well they recognise and understand the risk.

Children understand simple concepts like private information (“everything about me”) and inappropriate content (“not my age”).

Other concepts are only understood partially, e.g. automatic video recommendations. Children describe these concepts inconsistently and struggle to explain what’s bad about them.

Sometimes children aren’t able to describe risks at all, but they do report that the situations felt “scary” or “annoying”. They interpret these as signs that they should stop whatever they’re doing.

Recognising privacy risks


Discussions about the three scenarios revealed which risk types the children often missed:

  • Video platforms typically try to make you spend as much time on the platform as possible by autoplaying videos that you might like.

    Most children believe that this is done simply to “save your time” and don’t believe that there is any risk: all but one group would choose to play the video instead of seeking advice from their parents.

  • Many games and online services show pop-ups that ask the user to perform some action, e.g. start a chat. Almost all children agreed that such pop-ups are potentially dangerous, and that they should notify a parent.

    The pop-ups are interpreted in different ways. Some believe that they’re made to “trick them to buy things”, while others think it might be (stealing information).

  • Apps generally collect a lot of user data. Children don’t really understand who might access the data, but are aware that it’s a privacy risk.

    All children agreed that they should talk to their parents about such apps, and stop using the apps if it seems too risky to continue.

Responding to privacy risks


The children demonstrated a strong consciousness of their online identity: they obfuscate their name or use pseudonyms to protect their identity. They also make sure to always verify the identity of those who try to contact them online.

Implicit privacy risks on the other hand are rarely recognised. Children don’t really understand how online promotions and automated recommendations work, and don’t associate them with the loss of personal information. Instead, they believe that this is simply how the Internet works.

In cases where children feel that there might be some risk – but can’t articulate why or how it’s risky – they fortunately do understand that the safest thing to do is to stop using the app.

Finally, it seems that children are likely to overlook privacy risks when:

  • They’re familiar with a platform or a content creator;
  • Their friends also use the app, as it implies that the app is safe.


  1. Children understand explicit privacy risks well. They take measures to protect their identify and verify the identity of others

  2. Children struggle to understand the danger of implicit data collection, but often do feel that it might be risky

  3. Children have a lot of faith in platforms, apps, or creators that they or their friends already know