What we assessed, and what we changed.
We are completing a data protection impact assessment for Family and child accounts — the formal exercise UK law requires when processing might carry a high risk to people, which it does whenever children are involved.
This is a draft summary, not a completed assessment or approval. The full assessment contains our internal risk register and security measures, and publishing that in detail would help the wrong people more than the right ones. What matters to you is below: what we looked at, what we found, and what the product does differently as a result.
Why we had to do one.
Three of the regulator’s own triggers apply: we process children’s data, we restrict behaviour on a device, and children are treated in law as needing extra protection. That makes an assessment mandatory from the moment a child account can exist — not when a school gets involved.
What the assessment covers.
| Area | What we looked at |
|---|---|
| What we collect | Every field held for a child account, where it comes from, and whether it is stored on the phone or on our servers. |
| Whether we need it | Each field tested against whether the feature works without it. Several did not survive that test and were removed. |
| What a parent can see | The boundary between a parent’s controls and a child’s private use of the same app. |
| How a child gets out | Whether original timers, permitted completion methods, emergency access and privacy requests remain available when the network or a parent is unreachable. |
| Coercive use | How a parent could misuse the product, and what the design refuses to allow. |
| Where data can leak to | Reporting, partners, schools, analytics. Whether a child could appear in any of them. |
| What happens at 18 | What is deleted, what a young adult keeps, and what cannot be passed to a sibling. |
What it changed.
The assessment is only worth doing if it alters the product. These are the specified protections. Their verification and the final assessment must be completed before Family is released:
| Children are excluded in the database | Not by a rule someone has to remember. A child’s record cannot reach reporting because the schema will not carry it there. |
| A parent cannot extend a running restriction | They can end one early. They cannot make it longer while a child is waiting. |
| A time-based end is on by default | So a child is never dependent on a parent answering their phone. |
| Active restrictions continue safely offline | The original timer, permitted completion methods and emergency access remain. Requests needing a parent’s reply stay pending while unreachable; an outage does not automatically release the restriction. |
| The sharper tones are unavailable to children | And a parent cannot switch them on. A harsh voice aimed at a twelve-year-old is the misuse the rules exist to prevent. |
| Step counts never leave the phone | Only a yes or no does. We never see the number. |
| A child’s location is never stored | In any form, for anyone, including their parent. |
| Nicknames are given, not typed | Chosen by the app from a fixed list, so no child can be named or targeted through one. |
Where we landed.
The final risk assessment and sign-off are still pending. This draft does not claim that residual risks have been accepted, that an independent review has been completed, or that the product has regulatory approval. Any required consultation or further action must be resolved before release.
Two things we have chosen not to do, stated plainly. We have not consulted children directly — our reasoning is on the Children’s Code page. And our data protection officer is a director of the company rather than an independent appointment, which is normal at our size and something we will revisit as we grow.
When we do it again.
Annually, and before anything material changes — new data, a new feature touching children, or working with a school. A school route will need its own assessment; this one does not cover it.
If you want to challenge any of this.
Contact us and ask. If you are unhappy with our answer you can complain to the Information Commissioner’s Office, and you do not need to raise it with us first.