For years, rules protecting children’s privacy online existed largely on paper. Platforms promised to limit data collection, parents were handed lengthy consent forms, and regulators issued guidance that companies could often interpret generously. That era is ending. Privacy and online safety laws aimed at children are now being enforced with investigations, substantial penalties and binding orders to change how services are designed, not merely how they are described.
The shift matters because the business model at stake is data. Children’s attention, behaviour and preferences have commercial value, and default settings have historically favoured collection. Reporting on technology and society from sources such as BBC technology coverage shows regulators converging on a simple principle: a service likely to be used by children must be safe for them by design. More coverage is available at our homepage.
What enforcement actually looks like
Regulators have moved through a familiar sequence: warnings, investigations, and then penalties large enough to reach board level. Orders increasingly require specific changes, such as switching off profiling for young users by default, deleting data collected without a proper legal basis, and proving, through independent audits, that age-appropriate design standards are being met. The threat is no longer a critical report; it is a deadline with a fine attached.
Age assurance sits at the centre of the hardest arguments. To treat children differently, platforms must know who is a child, yet checking ages can itself require collecting more data from everyone. Regulators and campaigners debate proportionate methods, from self-declaration backed by design duties to privacy-preserving estimation, and no method commands universal trust. What is clear is that claiming ignorance, once a convenient defence, is losing its force.
How platforms are redesigning
Under pressure, design is changing in visible ways. Accounts for younger teenagers increasingly default to private, location features are restricted, targeted advertising is limited, and recommendation systems are expected to avoid steering children towards harmful or compulsive content. Parental tools are improving too, though specialists warn they work best as a supplement to safe defaults, not a substitute, since many parents lack the time or technical confidence to configure every control.
Smaller services face a genuine dilemma. Compliance costs money, and some may withdraw features or exit markets rather than risk penalties. Regulators say proportionality matters and that duties scale with risk, but the fixed cost of legal advice and auditing still falls heaviest on the smallest firms. The Guardian’s technology coverage has charted this tension between protection and competition as enforcement has intensified.
What families should expect next
For parents, the practical effect should be less homework. If rules work as intended, safety arrives as the default rather than as homework buried in settings menus. Families can still help by talking about data in concrete terms: what an app asks for, why it wants it, and what saying no costs. Schools, too, are being drawn in, since educational technology collects children’s data at scale and has not always faced the same scrutiny as social media.
Enforcement will be tested by appeals, by evasive design and by the sheer number of services children use. But the direction, across several jurisdictions at once, is unmistakable. Children’s privacy is being reclassified from a corporate promise to a legal obligation with consequences, and platforms are redesigning accordingly, some willingly, some under order.
Rules acquire meaning when someone is prepared to enforce them. For children’s privacy online, that moment has arrived, and its effects will be felt less in courtrooms than in quieter defaults: the setting that starts off, the data that is never collected, and the childhood that is slightly less thoroughly recorded.
