Last week, the Global Privacy Enforcement Network (“GPEN”)—a global network of over 30 national data protection authorities—announced the launch of its annual privacy sweep. The purpose of the sweep is to examine how websites and mobile applications commonly used by children handle minors’ personal information. Members of GPEN include regulators who have long prioritized protections for children and teens, such as the Federal Trade Commission (“FTC”), the California Attorney General, the California Privacy Protection Agency, the UK Information Commissioner’s Office, the French Commission Nationale de l’Informatique et des Libertés (“CNIL”), and the Irish Data Protection Commission.
The focus of this year’s enforcement sweep is to examine whether digital services “that are known to be used by children or cater to them” collect data from those children, are transparent about their privacy practices, and have systems in place for age verification. GPEN regulators will also investigate whether those digital services employ controls designed to minimize the collection of children’s personal data.
This enforcement sweep comes amid heightened U.S. legislative and regulatory efforts to bolster online protections for children by safeguarding their personal data and limiting their access to certain content. For example, several states have enacted new laws this year that require social media providers to strengthen their data privacy and safety protections for children.
The FTC also has continued its focus on children’s privacy protections through multiple enforcement actions this year including multi-million settlements for alleged violations of the Children’s Online Privacy Protection Act (“COPPA”).
This year’s effort also marks the tenth anniversary of a similar GPEN enforcement sweep conducted in 2015, allowing regulators to compare developments over the past decade. The Office of the Privacy Commissioner of Canada, the United Kingdom’s Information Commissioner’s Office and the Office of the Data Protection Authority of Guernsey are leading this year’s sweep, and results will be compiled and published in a report in the coming months.
Companies offering services likely to be used or accessed by children should review their data collection practices and transparency measures to ensure they comply with applicable laws and regulations.