Privacy for children and teenagers is built through everyday decisions that can be understood, reviewed and improved. A realistic plan does not try to control every screen: it reduces unnecessary data, creates conversation habits and prepares a calm response when a problem appears.

Start with a clear purpose#

Before changing a setting, ask why each piece of data is needed. Name, image, location, voice, email and family contact do not carry the same risk or usefulness. The AEPD explains that data minimisation supports sharing only what is necessary. When a purpose cannot be explained in plain language, it is reasonable to pause and ask for clarification.

Before changing a setting, ask why each piece of data is needed. Name, image, location, voice, email and family contact do not carry the same risk or usefulness.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

A small inventory of data#

A useful inventory fits on one page: important accounts, apps using camera or location, public profiles and trusted adults. It does not require collecting passwords or private conversations. The aim is to know what exists, who has access and what will be reviewed later. INCIBE recommends updating devices and checking permissions because many exposures begin with forgotten settings.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Settings to review first#

Prioritise post audience, location permission and account recovery. Also check whether an app requests contacts, microphone or camera without a clear reason. Disabling what is not used is not punishment or distrust; it preserves future choices. UNESCO notes that understanding digital environments supports autonomous, responsible participation.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Case 1: the activity form#

An organisation asks for birth date, photo and phone number for an activity. The family asks which data are essential, how long they will be kept and who can see them. The form is improved with alternatives and a short explanation. A respectful question can improve a process for every family.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Case 2: the team photograph#

On a sports team, someone posts a photograph with names and live location. A teenager suggests waiting until the event ends, removing tags and asking first. The group accepts a simple rule. UNICEF supports young people taking part in digital decisions affecting them; listening is meaningful protection.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Case 3: an app with excessive permissions#

A study app requests permanent location and every contact. The family reviews settings, limits permission and finds the official privacy policy. If the feature is no longer useful, they uninstall it. Comparing what an app promises with what it actually needs is a basic digital skill.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Passwords, recovery and support#

Every important account needs a unique password and a recovery method understood by its owner and, when appropriate, a trusted adult. Enable two-step verification and store recovery codes safely, not in a chat. No one should request codes in an unexpected message. Support means explaining the reason for each step and practising together.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Consent is not getting a quick yes. It means explaining what will be shared, with whom, for how long and what alternative exists. Ask before tagging, recording or forwarding. When someone changes their mind, removing content is reasonable. The World Health Organization links wellbeing with respectful relationships.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

When to ask for help and what to keep#

Ask for help when impersonation, threats, intimate-image sharing, pressure to send data, unknown access or unresolved doubts occur. Keep a brief timeline and relevant evidence without forwarding sensitive material. Contact official support, INCIBE, the AEPD or protection services as appropriate. Early, discreet action often reduces harm and distress.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

A thirty-day plan that fits real life#

In week one, list accounts and permissions; in week two, improve recovery and audience settings; in week three, agree posting rules; and in week four, discuss a hypothetical situation. Record one improvement, one question and a review date. Privacy is maintained through small, understandable, reviewable steps.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.

Review the decision with the affected person and check institutional sources. Do not share extra data to solve a problem, and record only what is needed for the next review.