Children Privacy Notice

Children's Privacy Notice Design

Overview

Privacy notices directed at children must meet heightened transparency standards under GDPR Articles 12-14, UK AADC Standard 4 (Transparency), and COPPA Section 312.4. Article 12(1) GDPR requires that information be provided "in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child." Recital 58 reinforces this by stating that given children's specific protection needs, any information and communication should be in such clear and plain language that the child can easily understand. This skill provides a comprehensive framework for creating privacy notices that children of different ages can genuinely comprehend and act upon.

Legal Requirements

GDPR Article 12(1) — Transparent Communication

"The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child."

GDPR Article 12(7) — Standardised Icons

"The information to be provided to data subjects pursuant to Articles 13 and 14 may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner a meaningful overview of the intended processing."

GDPR Article 13 — Information at Point of Collection

Requires provision of: controller identity and contact details, DPO contact details, purposes and lawful basis, legitimate interests (if applicable), recipients, international transfer details, retention period, data subject rights, right to withdraw consent, right to lodge a complaint, whether provision is statutory/contractual/obligatory, and automated decision-making details.

UK AADC Standard 4 — Transparency

"Provide privacy information in a way that is suitable for the audience. The clarity, prominence, and language of information should be tailored so that a child is able to understand: what data is being collected, what it is being used for, and by whom."

COPPA Section 312.4 — Notice Requirements

Requires operators to post a clear, complete, and understandable online notice of information practices with respect to children, and provide direct notice to parents before collecting personal information from a child.

Age-Segmented Communication Framework

Segment 1: Pre-Literate and Early Readers (Under 8)

Cognitive Characteristics: Cannot read lengthy text. Understanding through images, simple icons, and verbal explanation. Concrete thinking — cannot grasp abstract concepts like "data processing" or "third parties."

Notice Design Principles:

• Primarily visual: use illustrations, animations, or short video clips (under 60 seconds)
• Use a character or mascot to guide the child through privacy concepts
• Maximum 5-7 words per visual frame
• Use concrete metaphors: "your picture" instead of "image data"; "your toys" instead of "your account information"
• Present privacy choices as simple physical analogies: "lock your diary" for private mode; "tell your friend" for sharing

Vocabulary Level: Maximum Year 2 reading level (UK) / Grade 1 (US). Short sentences (4-6 words). Common monosyllabic words.

Format: Animated walkthrough during onboarding; no separate document. Parent receives the full Art. 13 notice.

Example Content:

[Illustration: Character with a backpack]
"When you play here, we remember your name and your favourite games."

[Illustration: Character with a padlock]
"We keep your things safe. Only you and your grown-up can see them."

[Illustration: Character waving goodbye]
"Your grown-up can ask us to forget everything about you."

Segment 2: Primary School Children (8-11)

Cognitive Characteristics: Can read simple text. Beginning to understand cause and effect. Limited understanding of commercial motivations or institutional relationships. Concrete operational thinking — can understand rules but not abstract policies.

Notice Design Principles:

• Illustrated text with icons for each concept
• Short paragraphs (2-3 sentences maximum)
• Use "you" and "we" language consistently
• Explain "why" in practical terms: "We ask your age so we can show you the right games"
• Use interactive elements: expandable sections, hover-over definitions, quizzes
• Provide a summary version with option to "learn more" for each section

Vocabulary Level: Maximum Year 5 reading level (UK) / Grade 4 (US). Sentences of 8-12 words. Avoid passive voice.

Required Content Blocks:

Segment 3: Secondary School Children (12-15)

Cognitive Characteristics: Can read and understand structured text. Beginning to think abstractly. Understands commercial relationships at a basic level. Peer influence is significant — privacy framing should include social context.

Notice Design Principles:

• Layered approach: headline summary, then expandable detail for each topic
• Use real-world examples and scenarios relevant to their experience
• Include a "so what does this mean for me?" section for each data practice
• Use infographics and flow diagrams for data sharing
• Address common questions directly: "Can my friends see my profile?" "Will I get ads based on what I do?"
• Include interactive privacy settings directly within the notice

Vocabulary Level: Maximum GCSE reading level (UK) / Grade 8 (US). Sentences up to 15 words. Technical terms permitted if defined immediately.

Structure:

1. One-Paragraph Summary (30 words): The essential message
2. Key Facts Table: Who, what, why, who else, how long — one row each
3. Detailed Sections: Expandable sections for each Art. 13 element
4. Your Privacy Controls: Direct links to privacy settings
5. Questions?: Contact details and complaint mechanism

Segment 4: Young Adults (16-17)

Cognitive Characteristics: Near-adult reading comprehension. Can understand abstract and legal concepts with appropriate framing. Developing autonomy — expects to be treated as a competent decision-maker.

Notice Design Principles:

• Standard privacy notice structure with plain language adaptations
• Use the adult privacy notice as the base but replace legal jargon with plain equivalents
• Include a glossary for any retained technical terms
• Address topics relevant to this age group: employment data, university applications, social media presence, financial data
• Respect their developing autonomy while noting parental involvement where required

Vocabulary Level: A-Level reading level (UK) / Grade 10 (US). Full sentences. Legal terms permitted with inline definitions.

Layered Notice Architecture

The ICO and EDPB recommend a layered approach to privacy information for all audiences, but this is particularly important for children.

Layer 1: Just-in-Time Notice (At Point of Collection)

Displayed at the exact moment data is collected. Must be:

• Visible without scrolling
• Maximum 2 sentences
• Includes the specific purpose for this collection
• Links to Layer 2 for more detail

Example (BrightPath Learning — game progress collection):

"We're saving your game score so you can see how you're doing over time.
Your parent can see your scores too. [Learn more]"

Layer 2: Summary Dashboard (Privacy Centre)

A visual summary of all data practices, accessible from a permanent link in the app navigation.

• Organised by topic (not by legal article)
• Uses icons and colour coding
• Each section expandable to Layer 3

Layer 3: Full Privacy Notice

Complete Art. 13 information in plain language. Available as a scrollable web page and downloadable PDF. Includes:

• All mandatory Art. 13 elements
• Version number and date
• Change history summary
• Contact details and complaint mechanism

Layer 4: Parent/Guardian Notice

Full legal privacy notice with all technical and legal detail. Sent directly to the parent via email at the point of parental consent. Includes:

• Full Art. 13 notice
• Art. 8 parental consent details
• Parental rights under COPPA (if applicable)
• Parental dashboard access instructions

Readability Testing

Automated Readability Metrics