When a difficulty involving a minor's data appears, speed matters, but improvisation usually makes it worse. A five-step plan can protect the person, keep only the information that is needed and turn the incident into shared learning.

1. Pause and protect#

The first move is to stop distribution. Do not forward a screenshot through several groups or demand explanations in front of other people. Check whether the post is still visible, limit its audience and alert the responsible adult when the risk warrants it. Calm does not mean minimizing the issue: it prevents an impulsive response from multiplying copies, ridicule or exposure.

The first move is to stop distribution. Do not forward a screenshot through several groups or demand explanations in front of other people.

Before acting, listen to the child or teenager. Ask what they saw, what they understand and what they need now. There may be embarrassment, fear of punishment or concern about friends, so the conversation must separate the event from identity. Saying that a post needs repair is different from defining someone by a mistake. The Spanish Data Protection Agency notes that data processing needs a purpose and proportionate measures.

2. Describe the event precisely#

A useful record answers four questions: which data was shared, in which service, who could access it and since when. It may be a photograph, full name, location, voice, message history or a combination that identifies a person. Avoid broad labels such as “the internet is dangerous”; describing the event makes it possible to choose a fitting response.

Keep evidence only when it will help request removal, inform a school or report serious conduct. One dated screenshot and URL may be enough. INCIBE advises using secure channels and not widening the distribution of content while documenting it. If several families are involved, agree on one contact person so the minor does not have to recount the event again and again.

3. Assess the level of risk#

The assessment changes with age, data sensitivity, reach and the possibility of unwanted contact. A photo from a school activity may need a simple removal; an address, intimate image, threat or impersonation requires immediate support. It also matters whether the content can reveal routines, identify other people or remain indexed by search engines.

The plan does not replace specialist services. In cases of bullying, coercion, sexual content, blackmail or physical danger, contact emergency services or the applicable protection channel. UNICEF stresses that children's digital safety combines listening, support and protective measures, not indiscriminate surveillance. Explaining the reason for each decision helps preserve trust.

4. Repair without increasing harm#

Repair starts with available tools: delete or edit the post, revoke permissions, change passwords when access was improper and request removal from the platform. Check shared albums, public links and devices with an open session. If someone else posted the content, make a clear request: what should be removed, why it affects the minor and when they will confirm that it is done.

Not every repair is technical. Sometimes it means apologizing, informing the school or setting a temporary agreement about camera and group use. The aim is not to impose an exemplary punishment but to regain control and prevent repetition. UNESCO recommends integrating digital citizenship and coexistence so rules are understood as mutual care.

5. Agree on the next step#

Close the incident with a specific and reviewable decision. For example: review account privacy on Sunday, ask the school for its image protocol, practise blocking a contact or talk again in one week. A small agreement is more valuable than a vague promise to “be careful.” Write down who will do each task and what sign will show that it is resolved.

The conversation should also include consent. Before sharing a photo, ask whether everyone is comfortable, check who will see it and consider whether it would still be appropriate outside its present context. Data protection is not only a setting; it is a practice of respect learned by observing how adults act.

Three situations to practise#

In the first case, a family finds that location data appears in public photos. The careful step is to turn off geolocation, remove sensitive images and check older albums. In the second, a class group forwards a screenshot of a profile. Members are asked to stop forwarding it, one piece of evidence is retained and the school protocol is activated if there is harassment.

In the third, a minor accepts permissions from an editing app that asks for contacts and microphone without needing them. The family reviews permissions, removes the app if it provides no safeguards and finds an alternative. These cases show that acting early does not mean acting alone: tutors, platforms, data-protection officers and support services can all help.

Sources and follow-up#

The Spanish Data Protection Agency provides material on privacy and rights; INCIBE offers guidance and helplines for incidents; UNICEF and UNESCO provide criteria for wellbeing and digital citizenship; the World Health Organization reminds us that wellbeing also depends on family and school context. Consulting these sources avoids relying on viral advice or miracle solutions.

One week later, check whether content was removed, accounts remain protected and the affected person feels safe. If the problem continues, escalate it through the right channel. The plan works because it combines care, minimal evidence, repair and learning: five simple steps so that minors' privacy does not depend on luck.

Prepare a coordinated response#

Before writing to a platform or school, assign simple responsibilities. One adult can retain minimal evidence and make the request; another can support the minor and check how they feel. If a group is involved, no one should post the name, screenshot or explanation in a general chat to “clear things up.” Coordination protects privacy and prevents the affected person from being exposed again while the issue is being solved.

It also helps to set a realistic deadline. Recording the time of a removal request, the reply received and the next review makes it possible to tell whether the measure works. If a platform offers privacy or child-protection forms, use them with a brief factual description. Extra personal data is not needed to prove concern. If a service asks for verification, confirm that the channel is official before sending documents.

Review accounts, permissions and copies#

After visible material is removed, a second task remains: reduce the chance of repetition. Reviewing account privacy, active sessions, password recovery and camera, location, contacts and microphone permissions often reveals settings granted in a hurry. Changing a password is not enough when a shared tablet still has an open session or a link retains public access.

This review should happen with the minor, not behind their back whenever possible. Showing them where a post's audience appears, how to block an account and what a permission means strengthens autonomy. The AEPD and INCIBE recommend proportionate measures: support and explanation create more safety than removing all access without a conversation. A short written agreement can list what to check before installing a new app.

Cases for proportionate decisions#

Lucia discovers that a sports registration displays her name, age and photograph on an indexed page. Her family saves the URL, asks the club to remove or restrict the data and asks for the data-protection contact. They do not circulate the link for opinions. When the club confirms the change, they check the search engine a few days later and agree always to ask about the purpose of images.

In another case, Dani receives messages from someone claiming to know his school after seeing a public story. The priority is not to question him for using the network, but to block, retain one piece of evidence and seek guidance if contact continues. Featured stories and followers are reviewed. The case helps practise recognizing intrusive requests and asking for help without fearing that the phone will automatically be taken away.

A third case concerns classwork shared with open editing permissions. Several people can see comments containing family information. The group changes the link to restricted access, removes unnecessary comments and tells the teacher. The lesson is not to blame the person who created the document, but to distinguish collaboration from making a folder public. That difference is useful for assignments, photos and calendars.

Everyday consent is a specific question, not a generic sentence at the end of an activity. Before uploading a photo, ask what will be shared, with whom and for how long. An affirmative answer can change if the image is reused for another purpose. Adults model this practice when they ask permission before posting minors' content and accept a refusal without ridicule.

Context matters too. An innocent image in a private activity can reveal location, uniform or relationships when combined with other data. A thirty-second pause is therefore useful: check framing, file name, geolocation, audience and the real need to publish. This routine does not turn a family into technical experts; it turns care into a repeatable habit.

When to seek specialist help#

Some situations go beyond a household agreement: threats, impersonation, distribution of intimate content, blackmail, discrimination or signs of physical risk. In such cases, prioritize immediate safety and use emergency resources, the platform, the school and applicable specialist services. Do not promise absolute secrecy if protection must be activated, but explain clearly what information you will share and why.

UNICEF, UNESCO, WHO, the AEPD and INCIBE provide resources that put wellbeing at the centre. Consulting them makes it possible to adapt a response to age and context rather than following viral advice. A later review should ask whether content disappeared, unwanted contact was reduced and the minor feels heard again. If any answer is no, the plan continues: asking for help is part of repair.