Children and Young People Online, Interacting with
Part 2: Risk, Privacy and Consent
In this article
We should be very careful about how much personal information we collect from children and we should be particularly careful about how much we reveal about them on any BBC site. When we publish personal information about children online, we should select information which is editorially necessary. We should be very sensitive to concerns that publication of too much information could put a child, particularly a younger one, at risk. Combinations of written and visual information are a particularly sensitive area. Editorial Policy can advise about what information it might be suitable to reveal.
- where we invite children to send us information about themselves, for example a name and email address to enter a competition, we should explain why we need it in language which children can understand.
- it is particularly important that younger children should not get into the habit of easily revealing personal details about themselves or their family on the Internet.
- any information children send to us should only be used for the purpose for which it was sent.
- it should be retained securely and only for as long as we need it.
- it should not be revealed to a third party, unless they are a contractor or independent production company working for the BBC to deliver the programme or service. If they are, we should explain their involvement in language a child can understand
- it should not be sent outside the European Economic Area without the specific agreement of Information Policy and Compliance. This includes any hosting agreements.
When we ask children for personal information or user contributions online, we also need to consider what degree of parental consent is appropriate. A child's level of understanding and the proposed use of the child's data (ie the potential risk), rather than exclusively age, are key to ensuring that personal data about children is collected and used fairly. These factors are also central to deciding what level of consent is required. This may vary from no consent being necessary through to requiring direct contact with the parents and a signed release form.
Here are some examples:
- simple wording asking a child to ask their parent for consent
- requiring the use of a clickable box to confirm that consent has been obtained before the child can proceed
- requiring parental consent via email (e.g. a parent confirms in an email with an address different from their child that they are happy for their child to upload a picture of themselves to the BBC site)
- requiring verifiable parental consent eg a signed letter or logged personal telephone call from a parent or guardian.
Factors to consider when deciding what form of consent may be appropriate:
- the amount and sensitivity of the information
- the age and maturity of the child. Will they understand what is going to happen to the information or the contribution we want them to send?
- their expectations. Our use must be in line with what they expect to happen
- the sensitivity of the information
- the risks associated with sending the information or publishing the content. What is the likelihood of any adverse effects for the child?
- the editorial context
Information Policy and Compliance can provide specific advice depending on the proposition and Editorial Policy may also be consulted. As a guide, here are four examples covering a range of consent methods
Example 1 - Blue Peter Newsletter
If a child wants to sign up to a routine Blue Peter email newsletter, we can be confident that all the content, suggestions and links in each edition will be suitable for children and we can be confident that Blue Peter will only use that email address for that purpose. The only information we are collecting from the child is their email address. So a prompt to the child to ask their parent for permission, with a requirement to complete the tick box before they can proceed, may be appropriate in these circumstances. It reminds the child that they should ask, but without requiring verifiable parental consent.
Example 2 - Doctor Who Comic Maker
Children were invited to make and publish their own Doctor Who comic strip online out of a kit of parts provided online by the BBC. This was personalised by the child sending in a picture of their own face, to create an avatar which was added to their comic strip.
Parents with a separate email address to their children were able to consent to their children sending us their picture, by email, and they did so in very large numbers. Random phone checks confirmed the validity of the consent. Other parents signed and posted a consent form downloaded from the site.
Example 3 - Child as online video producer
If we invite a child to make and send us a video for publication online in which they and their friends appear, we are likely to need verifiable parental consent. We will want to be confident that the parent of the filmmaker has agreed to the child sending us the video and at the very least that the parent has confirmed that they have the consent of the parents of the other children who are clearly identifiable in the video as well.
By the same token, if we ask for a child to send us their mobile phone number, we are likely to need some form of verifiable parental consent. This is sensitive personal information in part because if you have the number, you can get in touch directly with that child.
Example 4 - Bugbears
Where the editorial proposition is such that children may be reluctant to register if they have to obtain their parent's consent and the risks of publication are minimal, we may exceptionally decide not to collect parental consent.
For example, CBBC's Bugbears animations used the voices of children, who recorded themselves. The animations were designed to allow children to express their fears and anxieties (which could have included problems with their parents) and how they dealt with them. The site did not identify the children who took part and it gave them the option of disguising their voices. Crucially, every Bugbear was carefully checked before publication so that if there was a risk of a child being identified through the detail of what they said or they were too distressed, we did not publish that contribution.
On occasion, with careful planning and a high level of transparency about the scope, it may be appropriate to ask a parent to give us ongoing verifiable parental consent to their child supplying personal information or user generated content up to a certain level or category over a period of time. We might then only have to go back to the parent again for additional consent about new information or user generated content at a more sensitive level or category, within that period of time. It should be easy for a parent to revoke an ongoing level or category of such consent at any time. Such an arrangement would require the specific approval of Information Policy and Compliance and Editorial Policy,
Different consent arrangements may be suitable for school based activities like BBC School Report.