Adtech and Children’s Data Rights

Abstract

The advertising technology industry, known as ‘adtech’, is a complicated network of organisations and individuals that collect, aggregate and deal with large amounts of personal data. As children engage with digital networks for many aspects of their lives, they are increasingly exposed to adtech practices. Depending on their age, children may have less knowledge of the commercial digital environment and less maturity in their decision-making processes than adults have. Their limited resilience in the face of adtech’s onslaught offers a particularly stark illustration of why it is problematic to look to ‘consent’ as the exclusive or predominant mechanism to control the use of consumer data in the digital ecosystem. This article examines the problems arising from adtech’s data practices and makes recommendations on how to strengthen the agency and control exercised by children and protect their best interests in the context of adtech.

The collecting of consent to the processing of children’s personal data, between volatility and disobedience

“…As pointed out by recent specialised scholarly analyses [1], in the perimeter of the obligations incumbent on professionals / data controllers to transparently inform data subjects, three cardinal rules can be distinguished: (I) the resecting of the exigencies derived from principle of informational amplitude, which requires that the information provided to the data subjects is expected to be complete, without omitting essential information; (ii) the principle of intelligibility of information, which refers to resorting to a comprehensible form of providing informative details; (iii) the principle of loyalty, from which the condition of correctness of the provided information follows, as an element of contractual loyalty [2], [3]. This 'tripod' on which the obligation to inform the data subjects is placed remains in the centre of the discussions on the legitimacy of the children's data collecting and processing, as an essential pillar which can be found, with prominent outlines also in the matter of data collecting and processing [4], [5]. On the other versant of the discussions, the inferior capacity of younger children in terms of deciding on their personal data exposure generated privacy concerns, which have led the European legislator to establish a limited timeframe of a minimum of 13 years-old for the child's expressing consent to personal data processing [2], [5].…”