A global investigation involving Hong Kong authorities has found that more websites and mobile apps designed for children are collecting sensitive, personal data – from phone numbers to addresses – than they did about a decade ago.
The 2025 Global Privacy Enforcement Network Sweep, which included the participation of Hong Kong’s Office of the Privacy Commissioner for Personal Data, examined 876 websites and mobile apps designed for children in early November, including educational, gaming, social media and video streaming platforms.
“As the cognitive abilities of children are still developing, they may not fully understand their personal data privacy rights and are therefore more vulnerable to privacy risks arising from less privacy protective settings and design features of websites and mobile apps,” Privacy Commissioner for Personal Data Ada Chung Lai-ling said on Wednesday.
The investigation found that while some platforms have adopted good practices to protect children and their personal data, more online services now require users to provide their personal data to access the full functionality of the platform compared with 2015, raising concerns about children’s privacy.
Last year, 41 per cent of platforms required users to provide their names, up from 29 per cent in 2015. About 20 per cent needed to give their phone numbers, up from 12 per cent a decade ago. More platforms also asked for users’ addresses and photos or videos.
As many as 85 per cent of the platforms indicated in their privacy policies that they may share children’s personal data with third parties, a substantial jump from 51 per cent in 2015.
Nearly half of the platforms deployed some form of age assurance, representing a 30-percentage-point increase from 2015. However, more than 70 per cent could have their age assurance measures circumvented because they only required self-declaration.
More than one-third did not provide an accessible way to delete accounts, although the figure represented a substantial improvement on 71 per cent in 2015.
Meanwhile, nearly 60 per cent required users to provide an email address to access all functions, with 46 per cent requiring geolocation.
More than 90 per cent had privacy policies in place, but only 56 per cent had the personal data collected set to private by default.
Notably, bullying, abusive or hateful content was found in 15 per cent of the platforms, while sexual content appeared in 11 per cent of them.
Only 35 per cent of the platforms found to have high-risk data processing and design features for children had privacy communications, such as pop-up messages, directing children to seek permission from their parents to continue using the services.
Authorities taking part in the investigation suggested operators of websites and apps designed for or popular with children adopt child-friendly and privacy-protective measures.
Chung said organisations should ensure that the best interests of youngsters were the primary consideration in the collection, processing and use of children’s data.
They should “adopt privacy by design and by default to ensure that privacy protection measures are embedded from the very beginning of the design and development stages of products and services, with a view to enabling children to use online services safely”, she said.
