When shaping online privacy laws, our leaders must prioritise children’s right to safety and protection.
Every child deserves to grow up free from online harm, and that must come before the vested interests of any industry. We know that safe digital environments can help children grow, learn, and understand their place in the world as well as connect with others their age.
But right now, Australia’s privacy laws don’t adequately protect children’s health, safety, and rights in the digital world.
Companies that profit from harmful products like alcohol use increasingly sophisticated technology and tools to scrape a person’s data – including children – about behaviours, habits, and times when they are most susceptible to buying their products.
This feeds relentless online marketing that is targeted towards them.
That’s why FARE made a submission to the Children’s Online Privacy Code Consultation, calling for better regulation to prevent harms to children and strengthen children’s digital rights.
View this post on Instagram
What is the Children’s Online Privacy Code?
The Children’s Online Privacy Code is a new document being developed by the Office of the Australian Information Commission (OAIC), in response to a review of Australia’s Privacy Act last year.
The Code aims to prioritise the wellbeing and safety of children online by placing them at the centre of Australia’s privacy protections.
To achieve that, Australia’s Privacy Principles, or APPs, must be strengthened. The APPs inform Australia’s privacy framework, which applies to any company covered by the Privacy Act.
But you’re probably wondering: Where does the alcohol industry fit in?
Right now, companies harvest children’s data on an industrial scale.
By the time the average child turns 13 years old, advertisers have collected more than 72 million data points. This means advertisers may know more about a child’s interests and behaviours than their closest friends and family.
Harmful industries like alcohol and gambling collect this data for hyper-targeted advertising. In the alcohol industry’s case, companies have been found to upload data about minors to Meta’s ad targeting platforms before they turn 18.
This occurs without genuine consent or understanding, which can have serious implications for their health.
Research has shown the earlier a child is exposed to alcohol marketing, the more likely they are to drink alcohol earlier in life and at higher risk levels later in life.
Changing how companies use and disclose children’s data
Remember the APPs? Our submission directly addressed two of them – APP6 and APP7.
APP6 centres on how a person’s data is used and disclosed.
Under Australia’s Privacy Act, companies that collect data must only use it for the primary purpose it was collected, unless an exception applies.
One of those exceptions is if a person would reasonably expect a company to use their data for another purpose.
We made the argument that in the case of children, there is no reasonable expectation for their data to be used for a secondary purpose like targeted online marketing of harmful products like alcohol.
That’s why we recommended the Code:
- Prohibit the use and sale of children’s personal information for profiling, targeting and direct marketing by or on behalf of profit-driven companies
- Include a mandate on all digital services that may be accessed by children to:
- Keep data collection to the absolute minimum;
- Integrate privacy into their design; and
- Embed child safety as a default
Children cannot consent to intrusive data-driven marketing
APP7 stops companies from using someone’s personal data without their consent for direct marketing.
To obtain this consent, a company may ask a user a direct question in a pop-up or assume consent, if a person reasonably expects their data will be used for online marketing.
We argued that direct, targeted marketing to children is inherently unfair and unreasonable.
Expecting a child to have a ‘reasonable expectation’ when they visit their favourite websites that companies collect their data for online marketing purposes not only ignores their real-world experience, it ignores that their brains are still developing, and may not have capacity to give consent.
Companies may try to justify the collection of children’s data because they use things like opt-in systems, parental permissions or privacy settings. But these are often hard to understand and created in the interests of profit-driven companies.
Even if these mechanisms were improved, this does not diminish the fact that, right now, a power imbalance exists because harmful industries are using children’s data to inform their online marketing practices.
There’s no possibility that these direct online marketing practices can ever be ‘fair and reasonable’ in relation to children – and APP7 must reflect this.
So, we recommended that the Code include:
- A presumption that secondary data use and direct marketing are not in the best interests of children – and cannot be legitimised by forms of consent
- An affirmation that direct marketing towards children is inherently unfair and unreasonable – and there is no ‘reasonable expectation’ for children to be targeted by intrusive data-driven practices
Establishing a Children’s Online Privacy Code is a vital step forward.
But it must be designed to restore the balance in favour of children’s rights to safety, privacy, and protection online. This can lead to better health outcomes, and communities where everyone’s safety and wellbeing come before industry profits.
