Annex B: Age and developmental stages

There is relatively little evidence on the understanding of the digital environment of children in this age range, particularly for 0-3 years old. However anecdotal evidence suggests that significant numbers of children are online from the earliest of ages and that any understanding and awareness of online risks that have children within this age range is very limited.

At age 3-5 children start to develop the ability to ‘put themselves in others shoes’, but are easily fooled by appearances. They are developing friendships, although peer pressure is relatively low and parental or family guidance or influence is key. They are learning to follow clear and simple rules but are unlikely to have the cognitive ability to understand or follow more nuanced rules or instructions, or to make anything but the simplest of decisions. They have limited capacity for self-control or ability to manage their own time online. They are pre-dominantly engaged in adult-guided activities, playing within ‘walled’ environments, or watching video streams.

Children in this age range are less likely than older children to have their own device, although significant numbers do, and often play on their parents’ devices which may or may not be set up with child specific profiles. They may use connected toys (such as talking teddies or dolls) and may also mimic parents’ use of voice activated devices such as ’home hubs’.

Children within this age range are pre-literate or in the earliest stages of literacy, so text based information is of very limited use in communicating with them.

UK children in this age range cannot provide their own consent to the processing of their personal data in the context of an online service offered directly to a child (by virtue of Article 8(1) of the GDPR and s9 of the DPA 2018). So if you wish to rely on consent as your lawful basis for processing their personal data you need parental consent.

Children in this age range are more likely than younger children to have their own device (such as a tablet), although use of parents’ devices is still common. They are increasingly using devices independently, with or without the benefit of child specific profiles. Connected toys are popular and they may engage enthusiastically with voice activated devices such as home hubs.

Children in this age range often prefer online gaming and creative based activities, and video streaming services remain popular. Children may be experimenting with social media use, either through social aspects of online games, through their parents’ social media accounts or by setting up their own social media accounts. They may relate to and be influenced by online vloggers, particularly those within a similar age range.

They are likely to be absorbing messages from school about online safety and the digital environment, and be developing a basic understanding of privacy concepts and some of the more obvious online risks. They are unlikely however to have a clear understanding of the many ways in which their personal data may be used or of any less direct or obvious risks that their online behaviour may expose them to.

The need to fit in with their peer group becomes more important so they may be more susceptible to peer pressure. However home and family still tends to be the strongest influencer. They still tend to comply with clear messages or rules from home and school, but if risks aren’t explained clearly then they may fill the gap with their own explanations or come up with protective strategies that aren’t as effective as they think they are.

Literacy levels can vary considerably and ability or willingness to engage with written materials cannot be assumed.

UK children in this age range cannot provide their own consent to the processing of their personal data in the context of an online service offered directly to a child (by virtue of Article 8(1) of the GDPR and s9 of the DPA 2018). So if you wish to rely on consent as your lawful basis for processing their personal data you need parental consent.

This is a key age range in which children’s online activity is likely to change significantly. The transition, or anticipated transition, from primary school to high school means that children are much more likely to have their own personal device (pre-dominantly smartphones).

There is also likely to be a shift towards use of the online environment to explore and develop self-identity and relationships, expand and stay in contact with their peer group, and ‘fit in’ socially. This may lead to an increased use of social networking functions or services by children within this age range, an increased susceptibility to peer pressure, branding and online ‘influencers’, and an increase in risk taking behaviours. Self-esteem may fall as children compare themselves to others and strive to present an acceptable version of themselves online and the ‘fear of missing out’ may become a concern.

Online gaming and video and music streaming services are also popular. Children may feel pressurised into playing online games when their friends are playing, again for fear of missing out.

Attitudes towards parental rules, authority and involvement in their online activity may vary considerably, with some children relatively accepting of this and others seeking higher levels of autonomy. However parents and family still tend to be the main source of influence for children in this age range.

Children in this age range are moving towards more adult ways of thinking but may have limited capacity to think beyond immediate consequences, be particularly susceptible to reward based systems, and tend towards impulsive behaviours. Parental or other support therefore still tends to be needed, if not always desired. It may however need to be offered or encouraged in a less directive way than for younger children.

Children in this age range are developing a better understanding of how the online environment operates, but are still unlikely to be aware of less obvious uses of their personal data.

Although children in this age range are likely to have more developed literacy skills they may still prefer media such as video content instead.

12 is the age at which, under s208 of the DPA 2018, children in Scotland are presumed (unless the contrary is shown) to be of sufficient age and maturity to have a general understanding of what it means to exercise their data protection rights. There is no such provision for children in the rest of the UK, although this may be considered a useful reference point.

UK children in this age range cannot provide their own consent to the processing of their personal data in the context of an online service offered directly to a child (by virtue of Article 8(1) of the GDPR and s9 of the DPA 2018). So if you wish to rely on consent as your lawful basis for processing their personal data you need parental consent.

In this age range the need for identification with their own peer group, and exploration of identity and relationships increases further and children are likely to seek greater levels of independence and autonomy. They may reject or distance themselves from the values of their parents or seek to actively flaunt parental or online rules. The use of new services that parents aren’t aware of or don’t use is popular as is the use of language that parents may not easily understand. However, despite this, family remains a key influence on children within this age range.

The use of social media functions and applications is widespread although gaming and video and music streaming services are also popular. Again children may seek to emulate online ‘influencers’ or vloggers at this stage in their development.

Children of this age may still look to parents to assist if they encounter problems online, but some may be reluctant to do so due to concerns about their parents’ reaction to their online activity.

Developmentally they may tend toward idealised or polarised thinking and be susceptible to negative comparison of themselves with others. They may overestimate their own ability to cope with risks and challenges arising from online behaviour and relationships and may benefit from signposting towards sources of support, including but not limited to parental support.

Literacy skills are likely to be more developed but they may still benefit from a choice of media.

13 is the age at which children in the UK are able to provide their own consent to processing, if you relying on consent as your lawful basis for processing in the context of offering an online service directly to a child (by virtue of Article 8(1) of the GDPR and s9 of the DPA 2018).

By this age many children have developed reasonably robust online skills, coping strategies and resilience. However they are still developing cognitively and emotionally and should not be expected to have the same resilience, experience or appreciation of the long term consequences of their online actions as adults may have.

Technical knowledge and capabilities may be better developed than their emotional literacy or their ability to handle complex personal relationships. Their capacity to engage in long term thinking is still developing and they may still tend towards risk taking or impulsive behaviours and be susceptible to reward based systems.

Parental support is more likely to be viewed as one option that they may or may not wish to use, rather than as the preferred or only option, and they expect a reasonable level of autonomy. Signposting to other sources of support in addition to parental support is important.

By virtue of Article 8(1) of the GDPR and s9 of the DPA 2018, if you are relying on consent as your lawful basis for processing in the context of offering an online service directly to a child, UK children in this age range can provide their own consent to the processing of their personal data.