This revised report presents the key developments behind Parents Urged to Teach Online Privacy Like Road Safety as Children Share More Data in a clearer structure, without adding claims beyond the original article.
Parents are being urged to make online privacy as routine a childhood lesson as crossing the road safely or avoiding strangers. The UK Information Commissioner’s Office launched its “Switched on to privacy” campaign in April 2026 after research suggested many primary-age children are already sharing personal information online while a significant number of parents feel unsure how to guide them.
Update: The ICO launched “Switched on to privacy” on 7 April 2026 for parents and carers of children aged four to 11. Its survey found 75% of parents feared their child could not make safe online privacy choices.
What the ICO campaign says
The Information Commissioner’s Office, the UK regulator responsible for data protection, designed the campaign for parents and carers of children aged four to 11. Its central message is that privacy habits should begin early, before children are independently using a wide range of social platforms and online services.
The regulator is not asking families to deliver a formal legal lesson. Instead, it recommends short, repeated conversations that help children understand what personal information is, why websites and apps ask for it, and when they should pause and ask a trusted adult before sharing.
The research behind the warning
The ICO said three in four parents feared their child could not make safe choices about personal information online. Around 21% had never spoken with their child about online privacy, while 46% said they did not feel confident protecting their child’s privacy.
The research also found that 24% of primary-age children had shared a real name or address online and 22% had shared personal information such as health details with AI tools. The findings were based on research commissioned for the campaign and should be understood as survey results rather than a measure of every child’s behaviour.
Why road safety is a useful comparison
Road safety works as an analogy because parents do not usually give one lecture and assume the job is finished. They repeat simple rules, supervise children when they are young and gradually give them more independence as judgement improves.
Online privacy benefits from the same approach. A child may understand that a home address is private but not realise that a school uniform, live location, photograph, voice recording or list of friends can also reveal personal information. Repetition helps children learn to recognise new versions of the same risk.
What counts as personal information online
Personal information is broader than a name and address. It can include location data, photographs, school details, contact information, device identifiers, browsing patterns, health information, interests and information about family or friends.
Some of this data is visible because a child actively posts it. Other data is collected in the background by apps, games and websites. Parents therefore need to discuss both sharing choices and privacy settings. A child can be cautious in a chat but still use an app configured to collect more information than the family expects.
Why games and rewards can change behaviour
The ICO research found that some parents believed their children would trade personal information for game tokens or other rewards. That is a useful reminder that children do not evaluate privacy in the same way adults do. A small digital reward can feel immediate and valuable, while the consequences of data collection are abstract and distant.
Parents can turn that into a practical question: “Would you give this information to someone you do not know in exchange for a sticker or a sweet?” Translating digital requests into familiar situations can make the trade-off easier for younger children to understand.
AI tools create a new privacy challenge
Generative AI services have become another place where children may type personal questions or sensitive information. The survey finding that some children had entered health details into AI tools is especially important because users may assume a chatbot is private in the same way as a conversation with a parent or doctor.
Families should teach children not to enter identifying or sensitive details unless an adult has checked the service and its privacy information. A useful default is to remove names, addresses, school details, medical identifiers and any information about another person.
The ICO’s three-step approach
The campaign reduces the topic to three recurring actions: chat, choose and check. “Chat” means having regular conversations about what information is being requested. “Choose” means deciding deliberately what to share rather than clicking through automatically. “Check” means reviewing privacy settings when a child starts using a new device, game or app.
Those steps are intentionally simple. Parents do not need to understand every technical term before they can help. The goal is to build a habit in which a child pauses when a service asks for information and knows that asking an adult is normal rather than embarrassing.
Privacy settings are not a complete solution
Settings can reduce unnecessary data sharing, but they do not remove every risk. Defaults change, apps update their features and children may use new accounts or devices. Parents should revisit settings periodically and look at which apps have access to the camera, microphone, location, contacts and photos.
It is also worth checking whether a child’s profile is public, who can send messages, whether strangers can add them to groups and whether location sharing is enabled. These controls are often easier to understand when parent and child review them together.
How to talk without frightening children
Privacy education works best when it is practical rather than alarming. Telling a young child that the internet is dangerous can make them anxious without teaching them what to do. A better approach is to give clear actions: do not share an address, ask before uploading a school photo, and tell an adult if someone online requests private information.
Parents should also make it safe for children to admit mistakes. If a child expects punishment for clicking the wrong thing, they may hide a problem. Calm reporting helps families respond faster when personal information has already been shared.
The role of schools and technology companies
Families are only one part of the privacy system. The ICO’s Children’s code sets standards for online services likely to be accessed by children, and the regulator has used enforcement as well as guidance to push companies toward safer handling of young users’ data.
Schools can reinforce the same vocabulary so children hear consistent messages about personal data, scams, AI tools and online accounts. Technology companies still carry responsibility for designing services that minimise unnecessary collection and present choices in a way children can understand.
A practical family checklist
Parents can start by listing the devices and services a child uses most often. For each one, check profile visibility, location access, camera and microphone permissions, direct-message settings and whether the service collects data for advertising or personalisation.
Then agree on a few family rules that are easy to remember: ask before sharing a real name or location, do not send private images to strangers, never enter payment details without an adult, and pause when a game or AI service asks for information that seems unrelated to what the child is trying to do.
Bottom line
The ICO’s message is not that parents must become cybersecurity experts. It is that privacy should become a normal part of parenting, introduced early and revisited often. Children learn road safety through repeated practice; digital safety needs the same consistency.
The most valuable outcome is a child who recognises personal information, understands that online services may collect it and feels comfortable asking for help before sharing. That habit can protect them long after specific apps and games have disappeared.
What parents should do after information has already been shared
If a child has posted a phone number, address, school detail or other sensitive information, the first step is to stay calm and remove the content where possible. Parents can use the platform’s privacy and reporting tools, change account visibility and block anyone who is behaving suspiciously.
If the information involves financial details, threats, grooming, blackmail or an immediate safety risk, families may need help from the relevant platform, bank, school, police or specialist safeguarding service. The important lesson for the child is that telling a trusted adult quickly is more useful than hiding the mistake.
Why children’s data can have long-term value
Children’s information can be useful to companies and criminals because it may remain accurate for years. A date of birth, family relationship, school history or reused password can later help with profiling, scams or account recovery attacks.
That does not mean every data point will cause harm, but it explains why privacy habits are worth teaching before a child has a large digital footprint. Prevention is often easier than trying to remove information after it has been copied or shared across multiple services.
A simple monthly privacy routine
Families can make privacy less overwhelming by choosing one short check each month. They might review app permissions one month, public profiles the next, then saved passwords, location sharing or AI use. Ten minutes of regular maintenance is easier to sustain than an occasional attempt to audit everything.
Parents can also ask children which new games, apps or chat features they are using. That conversation often reveals privacy changes earlier than a device-level audit because children may start using features inside an existing app that were not enabled when the account was first created.
About The Author
