Understanding children’s perception of privacy risks online (2019)

Suspicious van that promises free candy to children
Getting children’s attention is child’s play

Our children grow up in a digitally connected world that’s eager to gather as much information as possible about its users. Children understand some of the more explicit privacy risks that come with the use of online apps and games, but appear to struggle with more complicated concepts.

Why it matters

Like adults, children spend a lot of their time online; they consume content, use apps, and play games with their friends. These activities all come with privacy risks that may be hard to understand – even for adults.

Parents and teachers must educate children about privacy risks so that they can protect themselves. This means that we have to understand how children perceive privacy and how online services may violate that privacy.

How the study was conducted

You can’t just ask a child how they feel about privacy and expect a reliable answer. The researchers therefore choose to discuss privacy with children aged 6–10 in focus groups instead. Focus groups offer a number of advantages over interviews with individual children:

All focus group studies started with a brief warm-up session, followed by a presentation of three scenarios. Each scenario was designed to elicit responses about a particular type of privacy risk. The studies were concluded with an open-ended discussion about privacy-related issues.

What discoveries were made

The findings show how children describe, perceive, and cope with privacy risks.

Describing privacy risks

The words that children use to describe a privacy risk seem to be a good indication of how well they recognise and understand the risk.

Children understand simple concepts like private information (everything about me) and inappropriate content (not my age).

Other concepts are only understood partially, e.g. automatic video recommendations. Children describe these concepts inconsistently and struggle to explain what’s bad about them.

Sometimes children aren’t able to describe risks at all, but they do report that the situations felt scary or annoying. They interpret these as signs that they should stop whatever they’re doing.

Recognising privacy risks

Discussions about the three scenarios revealed which risk types the children often missed:

Responding to privacy risks

The children demonstrated a strong consciousness of their online identity: they obfuscate their name or use pseudonyms to protect their identity. They also make sure to always verify the identity of those who try to contact them online.

Implicit privacy risks on the other hand are rarely recognised. Children don’t really understand how online promotions and automated recommendations work, and don’t associate them with the loss of personal information. Instead, they believe that this is simply how the Internet works.

In cases where children feel that there might be some risk – but can’t articulate why or how it’s risky – they fortunately do understand that the safest thing to do is to stop using the app.

Finally, it seems that children are likely to overlook privacy risks when:

The important bits

  1. Children understand explicit privacy risks well. They take measures to protect their identify and verify the identity of others
  2. Children struggle to understand the danger of implicit data collection, but often do feel that it might be risky
  3. Children have a lot of faith in platforms, apps, or creators that they or their friends already know