International sweep shows: children’s online privacy is under pressure

Privacy regulators from 27 countries, including the Netherlands, conducted an international sweep of 876 websites and apps used by children. When organizations fail to comply with privacy legislation, children are exposed to risks such as online tracking, profiling, targeting, and age‑inappropriate content. A similar sweep was carried out in 2015. The new results are cause for concern:

• More apps and websites require children to share personal data in order to use the service.

• Children’s data is shared more frequently with third parties.

• Many services still do not adequately protect children’s privacy.

The sweep further found that:

• In 72% of the apps and websites, age verification was easy to bypass.

• Privacy information is often not tailored to children, for example because simple language or child‑friendly explanations are missing.

• Children often struggle to delete their accounts.

Organizations must therefore critically assess whether collecting children’s personal data is necessary and proportionate. They must also apply privacy by design and by default, and encourage parental involvement so that children can make informed decisions about their privacy. Regulators also identified design features that encourage prolonged or repeated use, as well as monetization practices that may put pressure on children. Examples include advertising banners that can lead children to inappropriate content. This finding is not isolated: the European Commission recently preliminary stated that the addictive design of TikTok, widely used by children, may violate the Digital Services Act. Features such as infinite scroll, autoplay, and personalized recommendations may contribute to compulsive use, while risks for young and vulnerable users have not been sufficiently assessed or mitigated.

The sweep aims to raise awareness of privacy rights and obligations, strengthen international cooperation between privacy authorities, and highlight issues that may lead to targeted guidance or enforcement actions. The full English report of the Global Privacy Enforcement Network is available here. The findings reinforce Take Back Your Privacy’s commitment to holding organizations that fail to adequately protect children’s privacy - such as TikTok - accountable.