Social media isn’t just watching your kids. It’s studying them.
Every like, scroll and share feeds an invisible machine designed to track their habits, predict their interests and keep them hooked for as long as possible. Platforms like TikTok, Instagram and YouTube collect massive amounts of data from young users, often without clear consent or understanding. That data isn’t just stored. It’s monetized, shaping what children see, buy and even how they think.
The problem goes deeper than targeted ads. Weak age verification makes it easy for children under 13 to sign up, slipping past regulations like COPPA, which are supposed to protect them. Meanwhile, privacy policies are so dense that even adults struggle to decode them. And when data leaks happen, children, who may not even realise how much personal information they’ve given away, become easy targets for identity theft and exploitation.
Collateral damage
Tech companies claim they prioritise safety, but fines for violations are often just a cost of doing business. While regulators scramble to catch up, children’s digital footprints continue to grow, fuelling an industry that profits from their attention. In the race for engagement, their privacy is often just seen as collateral damage.
On March 3, 2025, the Information Commissioner’s Office (ICO) revealed that it has launched an investigation into how social media and video sharing platforms use UK children’s personal information
The ICO is the UK’s independent authority charged with regulating and enforcing the data protection and freedom of information regimes in the UK.
Its investigation is looking into how TikTok, Reddit and Imgur protect the privacy of their child users in the UK.
Its study of TikTok is considering how the platform uses personal information of 13–17-year-olds in the UK to make recommendations to them and deliver suggested content to their feeds.
This is in light of growing concerns about social media and video sharing platforms using data generated by children’s online activity in their recommender systems, which could lead to young people being served inappropriate or harmful content.
The ICO’s investigations into Imgur and Reddit are considering how the platforms use UK children’s personal information and their use of age assurance measures. Age assurance plays an important role in keeping children, and their personal information, safe online. There are tools or approaches that can help estimate or verify a child’s age, which then allow services to be tailored to their needs or access to be restricted.
The investigations are part of the regulator’s efforts to ensure companies are designing digital services that protect children.
At this stage, the ICO is investigating whether there have been any infringements of data protection legislation. If it finds there is sufficient evidence that any of these companies have broken the law, it will put this to them and obtain their representations before reaching a final conclusion.
ICO research carried out in February 2025 by Savanta revealed almost half of British parents (42%) feel they have little or no control over the information social media and video sharing platforms are collecting about their children – and the same number again feel unable to explain it to their children.
A quarter of the public (23%) say they, or their children, have stopped using particular platforms and channels because they’re concerned about how this data is used or collected.
80% of the public agreed that platforms should be more transparent with people about how they use personal information to recommend content. While 52% of respondents feel they have little or no control over the information that social media and video sharing platforms collect about them.
John Edwards, UK Information Commissioner, says: “We welcome the technology and innovation that companies like social media bring to the UK and want them to thrive in our economy. But this cannot be at the expense of children’s privacy.
“My message is simple. If social media and video sharing platforms want to benefit from operating in the UK they must comply with data protection law.
“The responsibility to keep children safe online lies firmly at the door of the companies offering these services and my office is steadfast in its commitment to hold them to account.
“I also want to take this opportunity to assure children, parents and carers in the UK that we are working on their behalf to make the online world a safer place.
“In announcing these investigations, we are making it clear to the public what action we are currently taking to ensure children’s information rights are upheld. This is a priority area, and we will provide updates about any further action we decide to take.”
William Richmond-Coggan, partner and dispute management, at Freeths, a partner specialising in data protection and technology at Freeths LLP, isn’t surprised that the ICO has chosen to focus its investigatory efforts on Tiktok.
The platform is already appealing against an ICO fine of £12.7m in 2023 for misusing children’s data issued in 2023.
With limited resources, the ICO will want to ensure that any intervention is likely to benefit the highest number of users, and that any conclusions they reach will attract as much attention as possible.
He says: “But it would be a mistake for organisations that are not of the size of Tiktok or Meta to imagine that this means that they are able to operate with impunity. A range of very serious obligations are imposed in relation to the safety of young people, and the protection of their personal data, under statutory guidance like the ICO’s Children’s Code and under legislation like the Online Safety Act.”
Most of those obligations apply to any business that operates using significant quantities of children’s data, or which offers products and services that might be expected to be of interest to young people (whether or not targeted at them).
“It may be that smaller businesses will be able to escape direct regulatory scrutiny, at least unless they suffer a breach or other incident,” Richmond-Coggan adds. “But we have already seen some litigation in the UK and elsewhere targeted at the potentially harmful impact on young people of Tiktok’s algorithms.”
Harmful processing
But he warns that concerned parents and the young people directly affected by harmful or careless processing, are not likely to wait for regulatory processes to run their course before they take action against what they perceive to be the worst offenders.
Our free interactions on social media platforms can come with a trade-off, explains Emily Keaney, the ICO’s deputy commissioner for Regulatory Policy.
“From the moment a young person opens an app or plays a video, a large amount of data begins to be gathered to potentially shape the content they are served with,” she says.
“These are called recommender systems, and they can work well, for example to suggest a fun dance routine. But we have concerns where the profile formed based on a child’s personal information may recommend content that is not appropriate for children to see. And we’re not the only ones – 80% of the public told us they agree that platforms should be more transparent with people about how they use personal information to recommend content.”
Keaney notes that regulating how children’s data is used by digital services is one aspect of a complex international and national online safety ecosystem.
The ICO works closely with Ofcom, as the Online Safety Act regulator, and other international organisations to ensure children in the UK have a better digital experience.
“We’ll continue our work to drive changes and, where necessary, we will use the full force of our regulatory powers to ensure young people can both benefit from and be safe within the online world,” she says.
Photo by Gaelle Marcel on Unsplash
Interested in hearing leading global brands discuss subjects like this in person? Find out more about Digital Marketing World Forum (#DMWF) Europe, London, North America, and Singapore.
