The UK DRCF take action over Recommender Systems and children’s privacy rights

Social media use by children presents challenges for regulators enforcing privacy rights, ensuring that enhanced protection is in place for minors. Public social media platforms (SMPs) and video sharing platforms (VSPs) (Platforms) support efficient distribution of content and connect all corners of society. Platforms and third-party organisations must however ensure that Recommender Systems are lawful and safeguard child users. Recent actions by Digital Regulation Cooperation Forum (DRCF) members have highlighted these requirements, with the ICO issuing a notice regarding adherence to its Children’s code and Ofcom fining TikTok £1.875 million for noncompliance with its statutory reporting obligations. This article outlines Recommender System considerations and regulatory compliance strategies, for Platforms and third-party organisations, regarding the distribution of online content to children.

Recommender Systems

The ONS estimate that there are 10.4 million people under the age of fifteen in the UK, representing 17.4% of the population and thus, at least in theory, a significant and impressionable market demographic.

To achieve commercial aims, the use of Recommender Systems for child users may thus seem an attractive option to Platforms and third-party advertisers, defined by the ICO as “algorithmic processes that use personal information and profiling to learn the preferences and interests of the user to suggest or deliver content to them.” The suggested security benefits are that Recommender Systems allow child users to navigate the influx of online information, to find relevant content – delivered to a user without a need for them to search for this. Preferences may be inferred from information provided by the user, either directly or to third parties, and finetuned from users’ interactions on Platforms.

A need for a sociotech approach for child safeguarding in such algorithmic processes is apparent. The ICO 10 step guide on data sharing for child safeguarding highlights the importance of transparency and individual rights. Recommender Systems offer upfront safeguarding benefits, through promoting positive content to users, and reducing the risk of false search results exposing child users to harmful content. However, standard 12 of the ICO Children’s code highlights that profiling should only be used if there are measures in place to protect the child from harmful effects, supporting the UK GDPR Article 22 data subject right not to be subjected to automated decision making or profiling.

Therefore, Platforms and organisations must proactively monitor their online architecture to ensure that their Recommender Systems remain for user benefit, and do not develop into dark patterns or nudges for commercial benefit.

DRCF actions

ICO

The ICO have accordingly put eleven Platforms on notice over poor children’s privacy practices, citing varying levels of adherence to its Children’s code. This statutory code of practice outlines how the UK GDPR applies in context, setting 15 standards of age-appropriate design for children’s digital service providers, but this is not legislation. Therefore, with the ICO citing its own standards to bring actions, organisations should closely monitor their adherence to its requirements.

The ICO Children’s Code Strategy Progress Update references default privacy settings, following UK GDPR Article 25 data protection by design and by default requirements, for child profiles and geolocation information. Furthermore, the Update reiterates that data about children, whether collected directly from the subject or provided by third parties, should not be combined to form a profile or used to target advertisements.

Such practices are also not in accordance with requirements outlined in the Privacy and Electronic Communications Regulation (PECR), including Section 22 direct marketing requirements and explicit consent requirements for soft opt-in, nor offer sufficient options for users to control their advertising preferences.

Ofcom

Ofcom are tasked with enforcing the Online Safety Act (OSA), as addressed in our previous article. Its Children and Parents: Media Use and Attitudes Report offers insight on these matters and guidance, for all audiences, on the benefits and potential risks of child social media usage. The Report highlights the importance of awareness-raising, whether through guidance in schools or directly from Platforms, in safe social media for children.

TikTok were accordingly fined £1.875 million, having failed to provide accurate and sufficiently detailed information about its parental controls under the OSA. Ofcom found that TikTok had several data governance failings, with insufficient checks leading to inaccurate data submissions, and reporting delays contravening the Communications Act 2003 and affecting Ofcom’s transparency report.

Compliance strategies

In Ofcom’s TikTok fine notice, significant weight was given to TikTok’s decision to self-report its error, with subsequent internal process improvements to comply with the OSA. However, the UK GDPR data protection by design approach requires compliance from the earliest stages of the AI lifecycle, with subsequent monitoring throughout usage. Therefore, Platforms and organisations with a social media presence should consider the areas outlined in the Children’s code, to ensure compliance with their statutory obligations under both data protection law and the OSA, which may be summarised as:

1. Clear user benefits

Social media design and use must meet the United Nations Convention on the Rights of the Child (UNCRC) Article 3 threshold, ensuring the best interests of the child are a primary consideration, supporting UNCRC Article 16 and UK GDPR Recital 38 protections for children’s privacy and personal data.

2. Age-appropriate design

Platform design should be tailored to child users, to ensure age-appropriate application, with default user profiles settings set to private. Platform design should furthermore ensure that dark patterns and nudges do not develop, and algorithm branching differentiates between child and adult users, where possible or relevant. Parental controls allow such restrictions on a child’s social media activity, and thus protect against potential exposure to harmful material.

The ICO Update highlights that some Platforms are relying on inadequate self-assurance mechanisms for user age verification, or invalid parental consent. Readers may consider the ICO call for evidence, and monitor joint-DRCF updates, in this area.

3. Transparency and policy suites

Organisations should ensure that their privacy policy suite includes procedures and protocols supporting the exercise of data subject rights, with Platform data integration. Information must be clear, concise, intelligible, and in an easily accessible form for the requesting audience. Platforms and organisations may therein note the ICO developmental stages and legal design guidance, considering alternative methods including videography and iconography. Furthermore, mechanisms must be in place to support the withdrawal of parental consent.

4. Assessments

Conducting an Assessment at the inception stage, with iterative updates throughout later stages of the AI life cycle, supports data protection by design approach and accountability for compliance with UK GDPR principles and OSA requirements. This may take the form of a Data Protection Impact Assessment (DPIA), or an AI Assurance review, as appropriate and relevant to the proposed social media activity.

Trilateral’s DCS team contains data protection and Responsible AI experts who advise on compliance with regulatory requirements and best practice, when assessing the impact of technologies and AI on users. If you would like to find out more, please get in touch.