6 / 8
Collection and Use of Personal Data through the Internet – Points to Note for Data Users Targeting at Children / December 2015
Best Practice Tips
• Data users should seek consent from children on whether they wish to receive direct marketing messages
(for example: students at an extracurricular painting centre should not be sent direct marketing messages
related to dancing, drama or language studies classes, etc. unless their prior consent is obtained);
• Instead of using direct marketing as a means to promote their goods and services, data users should
consider displaying advertisements on their online platforms that are not based on the profiling of
children; and
• If it is necessary for data users to engage in online direct marketing activities with children, they should
offer children an easily accessible online means to opt out of the direct marketing messages.
Security of personal data
Personal data protection is no child’s play
Even though some online platforms targeting at children may be of a social or leisure nature, data users still need to
be serious about the protection of personal data collected. Any wrongful disclosure or misuse of personal data may
have dire and long-term consequences as children may not be able to protect themselves from fraudulent activities.
Tip
• Data users should not consider its online platform to be of trivial nature and thus be lax about data
security. Data users must conduct risk assessment to determine the risk of security breach and the harm
that it may cause.
Transparency in privacy policy and practice
Age-appropriate language and presentation
The ability of children to understand the privacy implications of the often legalistic and lengthy privacy policies
depends also on their age and cognitive development. Hence, data users should always keep the target audience in
mind in their choice of language and presentation.
Best Practice Tips
• A privacy policy that is legalistic is unlikely to be understood by children;
• If data users offer services over an online platform that targets different age groups, a single version of the
privacy policy is not likely to ensure that it will be easily understood by children of various age groups.
Data users should develop different age-appropriate versions of the privacy policy targeting at different
age groups; and
• Data users may deploy user-friendly means to present the written privacy policy, for example by utilising
graphics and animation. Consents or opt-in obtained through age-appropriate communication means
would be encouraged.
6