Privacy organizations in 21 countries, including the Office of the Privacy Commissioner of Canada (OPC), will be looking at whether apps and sites gather personal information on kids.
Sometimes it can seem that kids are more digitally savvy than the adults around them. Children are playing games on mobile devices, watching videos online, and exploring various websites. But are those apps and websites taking enough precautions to protect children's privacy?
That's the question at the heart of a global investigation taking place this week involving privacy organizations in 21 countries, including the Office of the Privacy Commissioner of Canada (OPC).
These organizations will be examining the apps and websites that are most popular among children in each country. (In Canada, "children" means those under age 12, though this may differ in some places.)
Investigators will be looking at whether apps and sites gather personal information on kids, and if they do, whether that information is limited to what's necessary (to create an account, for example). They will also examine whether the apps and sites prompt users to involve a parent or guardian in any registration process; and whether they take measures to make privacy policies understandable to kids. That means not just using simple language, but also using graphics or even animated characters to guide them through the information and to encourage parental involvement.
The sweep, which began Monday and runs through Friday, was initiated by the members of the Global Privacy Enforcement Network, and includes countries such as the United States, the United Kingdom, China, Germany, France and Mexico.
"Every year, when we consider the potential candidates for a sweep, we discuss what's top of mind with some of our counterpart agencies. Children's privacy kept on coming up as a focus, and something that we're all concerned about on a global level," said Brent Homan, director general of PIPEDA investigations at the OPC. (PIPEDA is the Personal Information Protection and Electronic Documents Act, which governs the use of personal data in commercial activities.)
"Children are more connected than ever before," Privacy Commissioner Daniel Therrien said in a statement, "and these platforms must bear that in mind when seeking potentially sensitive data such as name, location or e-mail address."
The OPC recently warned that websites aimed at children must tread carefully: In March, the office announced an investigation into Ontario-based company Ganz that found its website was not clear enough in telling children that their parents had to agree to the terms and conditions when registering.
Ganz operates the popular Webkinz.com site, which advertises plush toys, and allows users to play games and chat with others.
The investigation found that the company collected information that included users' location, birth date, and parents' e-mail addresses. Combined with the fact that some kids used their full names as their user names on the site, this prompted concern about personally identifying children who registered. The investigation also found that some advertisers were tracking that information, although it did not appear that this had led to targeted ads aimed at kids.
The OPC said that Ganz agreed to all of its recommendations, which included introducing a policy for the retention and destruction of inactive user account information.
The office also published tips for companies collecting information from children. These included limiting the collection of personal information, deleting that information upon request or after a period of the account's disuse, and ensuring that children actually understand what they are agreeing to when using a service.
"What we're looking at are the websites and apps that are most popular with Canadian children at this time," Mr. Homan said. "Clearly, it can be challenging. There are some sites that are popular among adults that are also popular among youth, so we want to consider those as well."
The results of the sweep are expected some time in the fall.
The last global sweep in which the OPC participated examined mobile applications. It found that privacy information and controls were inadequate in many apps.
On Monday, the OPC provided an update on that sweep, saying that it has led some app developers to improve their privacy measures.