Protecting young digital citizens

From social media to educational platforms, the internet is an essential part of daily life for young people around the world. It offers valuable opportunities for learning, connection and self-expression. At the same time, it exposes children to a range of risks, including cyber-harassment, online hate, inappropriate content and digital manipulation. Recognizing the unique vulnerabilities of children, the French data protection authority (DPA), the CNIL (Commission Nationale de l'Informatique et des Libertés), has taken a proactive role in defending and promoting their digital rights. To further these efforts, the CNIL has been cooperating with UNICEF Innocenti to help create a safer online environment for children. 

Why children’s data deserves special protection

As digital tools become more deeply embedded in children’s lives, many young users are unaware of the long-term consequences of sharing personal information online through apps, games, social media platforms and even educational tools. The large-scale collection of data related to their preferences, identity or lifestyle may be used for targeted advertising or profiling. This affects not only their immediate online experiences but can also have lasting consequences, including greater risks of discrimination and exclusion. These concerns underscore the urgent need for stronger safeguards, greater transparency and a child-centered approach to data governance.

CNIL’s initiatives to promote children’s privacy

In response to these challenges, the CNIL introduced eight recommendations in 2021 to provide practical guidance for children, parents and other stakeholders in the digital economy. These are built around several key pillars to promote and protect children’s privacy:

1. Providing specific safeguards

Children have distinct digital rights and must be able to exercise them fully. Under the European General Data Protection Regulation (GDPR), they benefit from special protections, including the right to be forgotten and, in some cases, the ability to consent to the processing of their data.In France, children can only register for social networks or online gaming platforms if they are over 15, or with parental consent if they are younger. CNIL helps hold platforms accountable by offering clear recommendations on how to present terms of service and collect consent in ways that are accessible and understandable to children.

2. Balancing autonomy and protection

The needs and capacities of a 6-year-old child differ greatly from those of a 16-year-old adolescent. It is essential to consider this diversity in online behaviour, maturity and the evolving ability to make informed decisions. The CNIL emphasizes  the importance of offering children a digital environment that strikes a balance between protection and autonomy. It also advocates for digital citizenship education to empower young people with the tools they need to manage their privacy responsibly.

3. Raising awareness and education

One of CNIL’s core strategies is to raise awareness among children, parents and educators about their right to privacy. By engaging directly with these groups and understanding their perspectives, the CNIL helps to build a strong culture of privacy from an early age. Key initiatives include:

• Educational kits tailored for children aged 8-10 and 11-15, titled “All Together for a Safe Internet”, which helps them understand the concepts of online safety and privacy.
• School workshops, where students learn how their personal data can is collected and how to protect it.
• Online guides for parents covering topics such as giving parental consent, managing social media privacy settings and addressing screen time.

4. Embedding privacy-by-design

To support children’s ability to make informed decisions and exercise their rights, digital services must be designed with age-appropriate, intuitive interfaces. The CNIL has hosted collaborative workshops with young people from various age groups to rethink digital design from their point of view. These sessions have resulted in new interface prototypes, covering activities such as creating accounts, adjusting geolocation settings and managing personal data, and are now available on the French DPA’s Data and Design platform. 

The CNIL also promotes “privacy-by-design” as a legal standard, advocating for privacy features to be integrated into digital services from the outset, especially when those services target children. It has published detailed guidance for services used by minors, aimed at enhancing transparency and supporting children’s rights through thoughtful design.

5.  Engaging in the global dialogue

To advance children’s privacy worldwide, the CNIL collaborates with international partners, including the European Data Protection Board, the Global Privacy Assembly (GPA), the Council of Europe, UNESCO, UNICEF and the OECD. As the lead of the GPA’s Digital Education Working Group (DEWG), the CNIL supports capacity building, shares resources and works to promote children’s rights on a global scale. The CNIL also plays an active role in efforts to harmonize international privacy standards, particularly to address the challenges posed by transnational digital platforms and services used by minors.

In partnership with UNICEF Innocenti, CNIL has contributed to a range of initiatives, including a case study on its regulatory sandbox, which supports companies in meeting data protection obligations while encouraging responsible innovation. The French DPA has also taken part in a series of global consultations aimed at strengthening data governance in the EdTech sector. Insights from these discussions have informed policy recommendations for a range of stakeholders in the EdTech ecosystem, which will be released this fall.

The road ahead

CNIL will continue its collaboration with UNICEF and other partners to ensure children are protected and empowered in the digital world. As emerging technologies such as artificial intelligence, virtual reality and biometric systems reshape the digital landscape, new questions will continue to arise about how best to safeguard children’s data and uphold their rights. Through a comprehensive approach that combines prevention, education, regulation, enforcement and innovation, CNIL remains firmly committed to creating a safer and more inclusive digital future for every child.

Written with support from Melanie Penagos, UNICEF Innocenti

For more, visit UNICEF Innocenti's page on good governance of children's data.