The Nordic Data Protection Authorities, led by Denmark’s Datatilsynet, released new guidelines to enhance the protection of children’s data in online gaming. This initiative was developed in response to the increasing prevalence of gaming among children and the corresponding privacy risks. The document emphasizes four key GDPR principles: fairness, transparency, data minimization, and accountability, along with guidance for game developers on how to comply with them.
Key Elements of the Guidelines
Fairness:
Emphasizes the importance of equitable data processing, ensuring that the rights and vulnerabilities of children are respected. Developers are urged to avoid manipulative practices and to consider the specific context and impact of their data usage on young players.
Transparency:
Stresses the need for clear and accessible communication about data collection and processing practices. The guidance advocates for age-appropriate explanations, ensuring that children understand how their data is being used and the implications of such usage.
Data Minimization:
Advises developers to limit data collection to what is strictly necessary for game functionality. The principle discourages excessive data gathering, promoting privacy-focused default settings to protect children from unnecessary exposure.
Accountability:
Calls for robust measures to demonstrate compliance with GDPR. This includes conducting Data Protection Impact Assessments (DPIAs) and maintaining thorough documentation of data processing activities. Developers must ensure that their practices align with regulatory requirements and effectively safeguard children’s data.
The document does not address conditions for consent by children (Art. 8 GDPR).
👉 The guidance was published in English, here.
♻️ Share this if you found it useful.
💥 Follow me on Linkedin for updates and discussions on privacy education.
📍 Subscribe to my newsletter for weekly updates and insights – subscribers get an integrated view of the week and more information than on the blog.
