Kids' online privacy: what parents can actually control and what they can't

Your child's online life generates data constantly. Apps track their location. Schools log their browsing. Platforms profile their behavior. The surveillance runs whether you've thought about it or not.

You can't stop all of it. But you can understand the mechanism, know where your control ends, and use what leverage you actually have.

The data collection starts younger than you think

Apps aimed at toddlers collect device identifiers, location, and usage patterns. Games for elementary schoolers harvest contacts, photos, and behavioral data. By the time kids hit middle school, their digital profiles rival those of adults.

The FTC requires parental consent before apps collect data from children under 13, but the law, COPPA, the Children's Online Privacy Protection Act, contains exceptions big enough to drive a data broker through. Educational apps claim exemptions. Schools operate under different rules. Nonprofits aren't covered. And enforcement depends on companies accurately determining a user's age, which most don't bother to verify beyond a self-reported birthdate.

The result: kids under 13 use dozens of apps that collect detailed behavioral data without meaningful parental oversight.

What schools collect and what you can see

School-issued devices run monitoring software that tracks every website visited, every app opened, every keystroke typed. Districts justify this as necessary for safety and compliance, and in some cases it is. But the scope of collection often exceeds what's disclosed to parents.

FERPA, the Family Educational Rights and Privacy Act, gives you the right to review your child's educational records. But schools define "educational records" narrowly. Grades, attendance, disciplinary actions: yes. Browsing history, app usage logs, real-time location tracking: often no.

Some districts share data with third-party vendors for analytics, curriculum development, or administrative efficiency. Those vendors operate under contracts that may or may not prohibit selling the data to other parties. You can ask to see those contracts. Schools are required to make them available. Most parents never ask.

What you can control: request a copy of your child's educational records annually. Ask what monitoring software runs on school devices and what data it collects. Review the district's privacy policy and vendor agreements. If the answers are vague, press for specifics. Districts that can't explain their own data practices are districts that haven't thought them through.

Educational apps blur the line between learning and surveillance

Apps marketed as educational tools collect data that goes far beyond what's needed to teach multiplication or spelling. Time spent on each question. Number of attempts before success. Patterns of hesitation. Behavioral indicators that feed predictive models about learning styles, attention spans, and academic potential.

Some of this data improves the product. Adaptive learning platforms adjust difficulty based on performance, which requires tracking performance. But the same data also builds profiles that follow kids across platforms, influence algorithmic recommendations, and sometimes get sold to data brokers or shared with advertisers.

COPPA requires consent, but schools can provide that consent on behalf of parents when the app serves an educational purpose. Once the school consents, your individual objection doesn't matter. The app runs, the data flows, and you find out only if you ask.

What you can control: ask your child's teacher which apps the class uses. Look up each app's privacy policy. Most are vague, but some disclose third-party data sharing or advertising practices. If an app shares data with advertisers or analytics firms, ask the school why that app was chosen over alternatives with stronger privacy protections.

You can also limit what happens outside school. Apps your child uses at home require your consent if they're under 13. Read the privacy policy. Check permissions. If the app requests access to contacts, location, or camera beyond what the functionality requires, deny it or find a different app.

Social media platforms and the age 13 problem

Most social platforms prohibit accounts for users under 13 because COPPA makes it expensive and legally risky to collect data from young children. The platforms solve this by asking users to self-report their age during signup. No verification. No ID check. Just a dropdown menu.

Kids lie. Parents know this. Platforms know this. The law treats the lie as the user's problem, not the platform's.

If your child is under 13 and has a social media account, they're using it in violation of the platform's terms of service, which means the platform has no legal obligation to protect their data under COPPA. The account can be deleted without notice. The data can be used in ways that wouldn't be permissible for verified children's accounts. And you have no recourse.

Some parents create accounts on behalf of their kids, entering their own birthdate to bypass the restriction. This shifts legal responsibility to you, but it doesn't change the data collection. The platform still tracks behavior, builds profiles, and serves ads. It just does so under the assumption that the user is an adult.

What you can control: decide whether your child uses social media before 13, and if so, understand that you're opting out of legal protections. If you allow it, set the account to private, disable location sharing, and review privacy settings regularly. Platforms change defaults. What was private last year might not be private now.

The tracking you can't see: cross-platform identifiers and data brokers

Your child's data doesn't stay siloed in individual apps. Advertising networks, analytics firms, and data brokers link activity across platforms using device identifiers, email addresses, and behavioral patterns. A game on their tablet shares data with an ad network. That network matches the device ID to profiles built from other apps. The profile grows.

By the time your child is a teenager, data brokers hold dossiers that include demographic information, purchasing behavior, location history, and inferred interests. Some of this data came from apps. Some came from websites. Some came from schools. It aggregates silently.

COPPA limits collection from children under 13, but it doesn't limit what happens to data after it's collected, and it doesn't prevent brokers from building profiles on teenagers. At 13, kids age out of COPPA protections entirely. The tracking that was restricted becomes legal overnight.

What you can control: limit app permissions. Disable ad tracking in your child's device settings. On iOS, go to Settings > Privacy & Security > Tracking and toggle off "Allow Apps to Request to Track." On Android, go to Settings > Privacy > Ads and enable "Opt out of Ads Personalization."

This doesn't stop all tracking, but it reduces cross-app profiling. Apps can still collect data within their own boundaries; they just can't share device identifiers with third-party ad networks as freely.

You can also submit opt-out requests to data brokers directly, though this is time-consuming and incomplete. Brokers like Spokeo, BeenVerified, and Whitepages allow manual opt-outs, but new brokers appear constantly, and old ones reacquire data from public records and other sources. Automated services like Incogni handle ongoing opt-outs, but they cost money and don't cover every broker.

Parental control software: what it does and what it costs

Parental control tools promise visibility and oversight. They monitor screen time, block websites, track location, and report activity. Some work well. Some create more problems than they solve.

The best tools are transparent about what they collect and how they use it. Apple's Screen Time and Google's Family Link are built into the operating systems, which means they don't introduce third-party data sharing. They track usage locally and sync across your family's devices, but the data stays within your Apple or Google account.

Third-party tools like Bark, Qustodio, and Net Nanny offer more features, social media monitoring, keyword alerts, detailed activity logs, but they also introduce new privacy risks. These apps route your child's internet traffic through their servers to analyze content, which means the company sees everything your child does online. Their privacy policies determine what happens to that data. Some store it. Some analyze it for product improvement. Some share it with partners.

Before installing parental control software, read the privacy policy. Look for answers to these questions: Does the company store browsing history? Does it share data with third parties? Does it sell data to advertisers? If the policy doesn't answer these questions clearly, the tool isn't worth the risk.

What you can control: use built-in platform tools first. Screen Time and Family Link cover most use cases without introducing third-party data collection. If you need more advanced monitoring, choose tools with clear privacy policies and minimal data retention. And remember that monitoring software is visible to kids who know where to look. The conversation about why you're monitoring matters more than the tool itself.

The conversation you need to have (and keep having)

Technical controls help, but they're not enough. Kids who understand why privacy matters make better decisions when you're not watching. And most of the time, you're not watching.

Start early. Explain that apps collect information. Show them how to check permissions. Walk through privacy settings together. Make it a routine, not a lecture.

As they get older, the conversation shifts. Teenagers understand abstract concepts like data brokers, algorithmic profiling, and long-term consequences. They can grasp that a photo shared at 14 might surface in a college admissions search at 18, or that location history shared with a game might end up in a data broker's file.

The goal isn't to scare them. It's to build judgment. They'll encounter privacy decisions you can't anticipate: a new app their friends use, a website that asks for more information than it needs, a platform that promises privacy but delivers surveillance. If they understand the tradeoffs, they'll make better calls.

What you can control: keep the conversation ongoing. Privacy isn't one talk. It's dozens of small conversations over years. Check in when they download a new app. Ask what permissions it requested. Talk through why location access might matter for a map app but not for a game.

And model the behavior you want to see. If you overshare on social media, they'll learn that privacy doesn't matter. If you read privacy policies and make deliberate choices, they'll learn that data has value.

What the law actually protects (and what it doesn't)

COPPA is the primary federal law protecting children's online privacy. It requires websites and apps to obtain verifiable parental consent before collecting personal information from children under 13. Personal information includes name, address, email, phone number, Social Security number, geolocation, photos, videos, and persistent identifiers like device IDs.

The law sounds strong. The enforcement is weak.

The FTC has limited resources and thousands of potential violations. Most enforcement actions target egregious cases: apps that collected data from millions of children, platforms that ignored consent requirements entirely, companies that sold children's data to advertisers. Routine violations, apps that collect more data than disclosed, platforms that use dark patterns to obtain consent, rarely result in penalties.

COPPA also contains exceptions that undermine its protections. Schools can consent on behalf of parents for educational purposes. Nonprofits aren't covered. Websites that don't knowingly collect data from children under 13 aren't required to verify age, which means they can ignore the law as long as they claim ignorance.

At 13, COPPA protections disappear entirely. Teenagers can consent to data collection themselves. Platforms can track, profile, and target them without parental involvement. The legal framework treats 13-year-olds as adults for privacy purposes, even though their judgment and understanding of long-term consequences are still developing.

State laws add some protections. California's CCPA and its successor, the CPRA, give residents the right to know what data companies collect, request deletion, and opt out of sales. Other states, Virginia, Colorado, Connecticut, have passed similar laws. But these laws apply to residents of specific states, and enforcement varies.

What you can control: know your rights under state law. If you live in a state with privacy legislation, use it. Submit data access requests to platforms your child uses. Request deletion of data that's no longer needed. Opt out of data sales where the law allows.

But don't rely on the law to do the work for you. Legal protections are a floor, not a ceiling. The law sets minimum standards. Your decisions determine what happens above that baseline.

The limits of your control and what to do about them

You can't see everything. You can't control everything. Schools make decisions about technology without consulting you. Apps update their privacy policies without notice. Platforms change defaults. Your child's friends share photos that include your child without asking permission.

The goal isn't total control. It's informed oversight.

You can audit the apps on your child's device. You can review school technology policies. You can set device-level privacy controls. You can have ongoing conversations about what data means and why it matters. You can model careful behavior. You can teach your child to read privacy policies, check permissions, and think critically about what they share.

That's not nothing. It's the foundation of privacy literacy, which matters more at 16 than it does at 6, and more at 26 than at 16.

In Gilmore Girls, Lorelai Gilmore navigates her daughter Rory's adolescence by maintaining trust through transparency and ongoing dialogue. She doesn't surveil. She doesn't control. She talks. She listens. She explains her reasoning. She adjusts as Rory matures. The relationship works because both parties understand the boundaries and the reasons behind them.

The same principle applies to digital privacy. You can't monitor every click. You can build a relationship where your child understands why privacy matters, knows how to protect it, and trusts you enough to ask for help when they're unsure.

The surveillance economy wants you to believe that privacy is dead, that tracking is inevitable, that you have no control. That's marketing. The truth is messier. You have some control. You have legal rights. You have tools. You have the ability to teach your child how to navigate a world that treats their data as a commodity.

It's not enough. But it's what you have. Use it.