# Standards and Regulatory References — Children's Privacy Notice

## Primary Legislation

### GDPR Article 12 — Transparent Information, Communication and Modalities

- **Art. 12(1)**: "The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 [...] in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child."
- **Art. 12(7)**: "The information to be provided to data subjects pursuant to Articles 13 and 14 may be provided in combination with standardised icons in order to give in an easily visible, intelligible and clearly legible manner a meaningful overview of the intended processing."
- **Art. 12(8)**: The Commission shall be empowered to adopt delegated acts for the purpose of determining the information to be presented by icons and the procedures for providing standardised icons.

### GDPR Article 13 — Information to Be Provided Where Personal Data Are Collected

Mandatory content elements:
- **Art. 13(1)(a)**: Identity and contact details of the controller and DPO
- **Art. 13(1)(b)**: Contact details of the data protection officer
- **Art. 13(1)(c)**: Purposes of processing and lawful basis
- **Art. 13(1)(d)**: Legitimate interests pursued (if applicable)
- **Art. 13(1)(e)**: Recipients or categories of recipients
- **Art. 13(1)(f)**: Intention to transfer to third countries and safeguards
- **Art. 13(2)(a)**: Period of storage or criteria for determining that period
- **Art. 13(2)(b)**: Rights of access, rectification, erasure, restriction, portability, objection
- **Art. 13(2)(c)**: Right to withdraw consent at any time
- **Art. 13(2)(d)**: Right to lodge a complaint with a supervisory authority
- **Art. 13(2)(e)**: Whether provision of data is statutory or contractual requirement
- **Art. 13(2)(f)**: Existence of automated decision-making including profiling

### GDPR Recital 58 — Transparency for Children

"The principle of transparency requires that any information addressed to the public or to the data subject be concise, easily accessible and easy to understand, and that clear and plain language and, additionally, where appropriate, visualisation be used. [...] This is of particular relevance in situations where the proliferation of actors and the technological complexity of practice make it difficult for the data subject to know and understand whether, by whom and for what purpose personal data relating to him or her are being collected, such as in the case of online advertising. Given that children merit specific protection, any information and communication, where processing is addressed to a child, should be in such a clear and plain language that the child can easily understand."

### COPPA Section 312.4 — Notice Requirements

- **312.4(b)**: Online notice on the website/service must include: operator identification, description of information collected, how information is used, disclosure practices, parental rights, and procedures.
- **312.4(c)**: Direct notice to parent before collection, including: purpose of collecting parent contact, operator's information practices, deletion if no response, link to online notice, and means of consent.
- **312.4(d)**: Updated notice to parent when changing material information practices.

### UK AADC Standard 4 — Transparency

"Provide privacy information in a clear, prominent, and age-appropriate manner that is suitable for the audience, including for children who are not the primary users but may still access the service."

ICO guidance specifies:
- Privacy information must be tested with children of the target age group for comprehension
- Just-in-time notices are preferred over reliance on a single privacy policy page
- Visual aids, illustrations, and interactive elements should be used for younger children
- The "so what?" question must be answered: children must understand how processing affects them

## Regulatory Guidance

### EDPB Guidelines on Transparency (WP260rev.01, Adopted 11 April 2018)

- **Paragraph 12**: Information must be in "clear and plain language." For children, this means language adapted to the specific age of the target audience.
- **Paragraph 14**: "Concise" means controllers should consider efficient use of space, use layered notices, and avoid excessive or unnecessary information.
- **Paragraph 15**: "Easily accessible" means the data subject should not have to seek out the information; it should be immediately evident.
- **Paragraph 17**: Recommends using standardised icons per Art. 12(7), visual aids, infographics, flowcharts, and videos.
- **Paragraph 25**: Specifically addresses children: "Where services are addressed to children or it is known that the service is used by children, controllers should ensure that the vocabulary, tone and style of the language used is appropriate to children."
- **Paragraph 26**: Recommends consulting with representative groups of children to test comprehension.
- **Annex**: Provides a transparency checklist including child-specific considerations.

### ICO Privacy Notices Code of Practice (2016, Updated 2018)

- Recommends layered privacy notices: short summary at the top, detailed information expandable below.
- For children's notices: "use clear, age-appropriate language. Use visuals where possible."
- Provides examples of child-friendly notice language.
- Recommends user testing to ensure comprehension.

### Article 29 Working Party Opinion 2/2009 on Children's Personal Data

- Pre-GDPR guidance recommending that privacy information for children should be "written in child-friendly language" and "should include visual elements such as cartoons, graphics and icons."
- Recommended that notices be presented at the point of collection, not buried in legal documents.

## Readability Standards

### Flesch-Kincaid Grade Level

- Widely used readability metric: estimates the US school grade level required to understand the text.
- Recommended targets: under 12: grade 4 or below; 12-15: grade 8 or below; 16-17: grade 10 or below.
- Calculated from average sentence length and average number of syllables per word.

### Flesch Reading Ease Score

- Scale 0-100: higher scores = easier to read.
- Targets: under 12: 80+ (Easy); 12-15: 60-80 (Standard); 16-17: 50-60 (Fairly Difficult).

### Gunning Fog Index

- Estimates years of formal education needed to understand text on first reading.
- Targets: under 12: 6 or below; 12-15: 10 or below; 16-17: 12 or below.

### Plain Language Guidelines (UK Government, Gov.uk Style Guide)

- Write at a reading age of 9 for public-facing content.
- Use short sentences (average 15-20 words for adults; shorter for children).
- Use common words: "use" not "utilise"; "help" not "facilitate"; "about" not "regarding."
- Use active voice.
- Address the reader directly ("you" and "we").

## Enforcement Decisions

- **TikTok (DPC Ireland, 2023)**: EUR 345 million fine. DPC found that TikTok failed to provide transparent, concise, and intelligible privacy information to child users, violating Articles 5(1)(a), 12, and 13. The notices were "not provided in age-appropriate language."
- **Instagram/Meta (DPC Ireland, 2022)**: EUR 405 million fine. DPC found insufficient transparency regarding children's data processing, particularly about public-by-default business account settings.
- **Google/YouTube (FTC, 2019)**: USD 170 million. Required YouTube to provide clear notice on child-directed channels about data collection and use.
- **CNIL v. Google (2019)**: EUR 50 million fine. While not child-specific, CNIL found that Google's privacy information was "not easily accessible" and "not always clear and comprehensive" — standards that are even more demanding for children.

## Research

### Ofcom Children's Media Use and Attitudes Report (2023)

- Only 15% of 12-15 year olds read privacy policies before signing up for a service.
- 58% of 8-11 year olds said they did not understand what companies do with their data.
- Children who saw visual/interactive privacy notices reported higher understanding and confidence.

### 5Rights Foundation — "Digital Childhood" (2017)

- Research with 1,000 UK children found that children want to understand their privacy but find existing notices incomprehensible.
- Children preferred short, visual explanations with practical examples.
- Recommended privacy notices be co-designed with children.