Step 6: Identify measures to reduce risk
Identify additional measures you could take to reduce or eliminate risks identified as medium or high risk in step 5
| Risk | Options to reduce or eliminate risk | Effect on risk | Residual | Measure approved |
| Eliminated/ reduced/ accepted | Low/ medium/ high | Yes/no | ||
| Personalised advertising that is set to on-by-default, done without adequate transparency and safeguards, or is against the best interests of the child (for example against the CAP code or Advertising Standards Agency standards) risking children’s right to protection from economic exploitation. | Profiling activities limited to email recommendations of similar products to users based on user order history and browsing activities on our site only. Marketing newsletters only accessible to children over 13. No links to external marketing. |
reduced | low | yes |
| Personalised advertising of age-inappropriate products that risks children’s right to protection from economic exploitation. Likely to be higher risk for younger children. | Ensure all marketing is of age-appropriate products, allow products to be searched by age range. Website only sells products from reputable and vetted suppliers. | reduced | low | yes |
| On-by-default data sharing with other service users that exposes children to risk of physical or emotional harm (for example through stalking, bullying or harassment) that risks children’s right to life, survival and development. |
Cookies set to off by default for under 13s, no geolocation data collected, privacy high be default. e-commerce site regularly updates security. |
reduced | low | yes |
| Sharing of children's data with third parties for commercial gain, against the best interests of the child or without adequate transparency and due diligence risking children’s right to protection from economic exploitation. | We only collected the minimum amount of data needed for process and fulfill orders, and for limited internal contextual marketing only. Data shared with trusted and vetted third parties for payments, shipping orders, analytics, and with our e-commerce site processor. A cookie consent tool if offered to users. |
reduced | low | yes |
| Online tools for children (and parents, for younger children) to exercise their data rights that are not transparent, not specific to the rights they support, or not provided, and that risk the children’s right to respect for their views. | There is an unsubscribe button on all newsletters. "I’m not happy“ link is available at the bottom of each web page that links to a video with information on what users, including children, should do if they encounter problems on the site, including a prompt to get help from trusted adult. | reduced | low | yes |