5 things APAC advertisers and publishers in the kids industry should know about GDPR

Quan Nguyen, CEO of TotallyAwesome, the kid-safe digital media company, explains the impact of GDPR and the specifics of GDPR-K for child-focused content in Asia Pacific.

With the Cambridge Analytica scandal fresh in our minds and the recent action enforced by the Federal Trade Commission against YouTube for collecting personal data on users aged under 13 years old, online data privacy is more than ever a hot topic.  

Children’s online privacy protection has dramatically increased in importance with several laws and regulations being implemented; starting with the Children’s Online Privacy Protection Act (COPPA) in the US, followed this year by China’s own Data Privacy Standard and of course, the General Data Protection Regulation (GDPR), enforced last month by the European Union (EU).

GDPR is a stringent new legislation to protect the privacy of residents in member countries. For websites, brands and companies whose primary target audiences are children, the GDPR-Kids (GDPR-K) conditions apply. It is crucial for APAC companies to note that GDPR-K doesn’t only affect companies in the EU, it has an impact on any brand targeting or collecting data from customers in Europe regardless of the server location or where the company is based out of.

There are a few things kids industry players in APAC should take note:

1. Define your audience – do they include “family” or under-16s explicitly or implicitly?

If they do, then you may fall under the GDPR-K compliance. Under COPPA, any service with child-friendly content may be classified by the regulator as ‘child-directed’. The GDPR-K definitions of services ‘offered to children’ is even broader, and will include many sites and apps today that aren’t considered targeted for kids! In short, if you have a mixed audience of both kids and adults, then your content falls under GDPR-K and will have to follow additional requirements.

2. Adopt a zero-data-collection policy

If you fall under GDPR-K, data collection without parental consent is simply not allowed. Anything that collects personal information needs to be turned off or removed. Get a clear picture of all the data that is collected from your users on your platforms whether by third parties or by your own tech. This includes explicit and hidden trackers on all embedded code, including ad tags, social media plugins (eg. like and share buttons), third party content embeds (eg. embedded YouTube videos), tag managers, analytics trackers.

3. Revise your privacy notice and policies

The EU is determined to make legal notices more transparent and GDPR-K requires you to post privacy notices that are concise and written in “clear and plain language, that is understandable especially if it is addressed to a child.”

4. What is the risk?

Companies in violation of GDPR-K may be fined up to €20 million or 4% of the company’s global revenue, whichever is higher. It is worth noting that GDPR allows non-governmental organisations (NGOs) to sue companies for damages on behalf of individuals if they are in breach. This is a game-changer. TotallyAwesome understands there are already requests for information in preparation for lawsuits. We expect the impact of GDPR-K regulations and fines to be imposed much quicker than other new regulatory laws.

Brands targeting or collecting data from kids in or from the EU need not be put off by the data protection act even though compliance is an immediate must. We strongly advise companies to take legal steps to GDPR-K as soon as possible so as to guarantee full safety for their brands.

5. A bright future for safe online advertising to kids

With the growing number of kids online (in APAC, kids spend over 21 hours online per week*), the emergence of global standards for digital kids’ privacy, coupled with the rapidly declining kids TV market, the good news is that digital budgets are growing at an impressive 25% annually. So, although GDPR-K and similar regulations will trigger major change across the kids digital media landscape globally, the reward for compliance is guaranteed years of growth.

*TotallyAwesome APAC Kids’ Digital Insights 2018 n= 2,700; markets: AU, ID, IN, MY, NZ, PH, SG, TH, VN – Copyright TotallyAwesome 2018