What do parents and teenagers understand about personal information in the online digital world? What are their thoughts about commercial data practices? Initial insights from the 'Children's Rights to Data Privacy' project research raises some unexpected issues for policymakers, educators, parents and teenagers.

​The privacy of individuals has become a global issue in the wake of events such as Cambridge Analytica and whistle blower Edward Snowden, but even more so as reports of data breaches, hidden data collection practices, and unethical practices by companies, institutions and governments come to light in the media.

​Privacy advocates and researchers have expressed concerns about the surveillance by governments, institutions and companies becoming the norm, and that our personal data is used by these organisations in ways that determine our opportunities and choices, affecting our life outcomes. Data about us is increasingly collected through surveillance by public institutions and companies using biometrics, cameras, social media communications and interactions, our web browsing, purchases, downloads, participation in online surveys, competitions, and communications, our personal networks, and smart - often wearable or in home devices. Rapid integration of smart technologies, storage and processing capacities, algorithms and data analytics has meant that enormous amounts of personal data are collected, aggregated, analysed and used to generate personal dossiers of which we are unaware. Most of this without our knowledge or our 'informed' consent. It is clear that commercial data processing generates inequalities through denying people access to the same opportunities, offers and information.

​Regulatory advances such as the EU Global Data Protection Act (GDPR) (May 2018), COPPA, or California Consumer Privacy Act (January 2020) have made some headway into addressing the issue of the privacy and individual control of personal data in the digital era. Although privacy advocates express concern over such events, individuals are less likely to understand how their personal information and privacy is at risk in the digital environment. However, we all have a role in protecting our personal data as well.

​Researchers have determined that "vast amounts of data are being collected from children, with or without consent, with or without knowledge that children are even using the services and, further, with or without adequate security provision, and without parental awareness of many of these issues (Livingstone and Yoo, 2018, January 18)." One study by SuperAwesome in December 2018 discovered that children under 13 are exposed to anywhere between 1 and 2 million trackers per year, and that these are collecting some 5 million data points: such as their "location, websites visited, device identifiers etc." and that this increases to around 12 million per year for 12 year olds as they spend more time online. Online advertisers don't discriminate between adults and children and parents are often unaware of how advertisers reach children.

​Through qualitative interviews with 30 parents and teenagers in Auckland, New Zealand, Social Research NZ explored: how teenagers and parents conceptualise privacy online; how they define personal information in the digital context; what risks they associate with sharing data with others, institutions and companies; what privacy-protection strategies, if any, do teenagers and parents use to minimise the collection of their personal data. It sought to how understand parents and children conceptualise and value privacy in the digital context, and test the assumption that parents and teenagers (12-16) manage personal data privacy in relation to current commercial data practices online.

​Key research findings:

​Parents and teenagers had similar concepts of privacy and personal data, although they differed in the value they placed on these.

​Both parents and teenagers conceptualised privacy most strongly in interpersonal terms, seeing privacy online as about protecting personal information that could cause relationship conflicts, victimisation and reputation harm. They frequently discouraged children from sharing information that could lead to victimisation (online and offline) by strangers and people from their communities. Teenagers echoed their parents' concerns about protecting information that could lead to their being identified offline, or victims of identity theft and fraud. These issues have reached parents and teenagers through media and education, and so remain top of mind.

​In addition to these spatial and physical concepts of privacy, parents were also concerned about personal intimacies being a source of discrimination later in life. They worried that teenagers shared too much about their intimate lives online, and discouraged them from uploading content that might impact their opportunities later in life, such as when applying for a job. Teenagers were, however, actively engaging with privacy settings to control who could access information that they or others uploaded about them. They sought platforms that provided the ability for them to control access.

However, these privacy concerns were based largely around information that parents and teenagers knowingly shared online. They had much less awareness of data that might be obtained through other means such as data traces or inferred data commonly collected by companies and institutions.

On the whole, parents and teenagers expected that when they shared information with institutions this would be kept secure and confidential and so remained out of the public domain. They did not expect information may be collected other than that which they volunteered, or which related to their transactions with them. They did not perceive institutional data practices to be threatening personal privacy as such data, although potentially sensitive, was expected to remain secure, not be shared, and so could not affect their personal relationships or status.

​However, neither parents nor teenagers conceptualised privacy in relation to corporate collection of personal data. They believed data collected by corporations was largely utilitarian and benign, and therefore nonthreatening should it ever be made public. Although aware of targeted advertising based on their web searches, they did not believe companies were interested in personal information beyond their consumer interests, and often saw targeted advertising as convenient. Some parents believed companies did not collect information about their children.

​While there was a general lack of awareness of what and how much data is collected, parents and teenagers regularly questioned how corporates having knowledge about them could harm them. This is because they primarily conceptualised privacy in interpersonal terms, where personal information, in the wrong hands, could result in physical and mental harms, and being discredited online. They could not see how corporate data practices could be harmful, and least of all how this might impact their personal relationships with others.

​When confronted with case studies about what apps can collect about you, parents and teenagers were concerned about location tracking, and the potential for unwanted communication and physical contact by others. These responses confirmed that they valued spatial privacy, keeping their personal location and family space protected. While they were shocked at how much companies could glean about their daily activities, they were not necessarily motivated to take action to address corporate surveillance.

​Both parents and teenagers did exercise privacy strategies in relation to their personal communications and data uploads online, data which they themselves shared online. They did not, however, currently engage with data protection strategies directed at preventing commercial organisations from tracking them online.