Children’s understanding of personal data and privacy online – a systematic evidence mapping

Privacy is both a protective and an enabling right. This article identifies the available research on how children understand, value and negotiate their personal data and privacy online. The results are interpreted according to a framework that distinguishes different privacy contexts (interpersonal, institutional and commercial) and data types (given, traces and inferred). Our systematic evidence mapping of research published by multiple disciplines in the English language from 2007 to 2019 reveals substantial gaps in current knowledge. First, even though children now use the internet from infancy onwards, very few studies include younger children, impeding regulatory or educational policy and practice tailored to socio-developmental differences among children. Second, the majority of research concerns privacy in interpersonal contexts, with less attention paid to commercial or institutional contexts. Relatedly, most research conceives of data that is deliberately and knowingly provided, with fewer studies recognising that data traces and inferred (or metadata) also matter for children’s privacy. Finally, most empirical studies concern children’s behaviours and practices but much less common are studies of children’s media literacy, especially relating to their capacity to consent to data protection practices. Notwithstanding rising concern over the datafication of childhood, few researchers have investigated the possible harms associated with infringements of children’s privacy online, or the value of any social support children receive. We conclude by calling for a more comprehensive and policy-relevant approach to researching children’s practices and understanding of their online data and the privacy implications of engaging in today’s increasingly commercial digital environment.