Children’s Privacy in Lockdown: Intersections between Privacy, Participation and Protection Rights in a Pandemic

Children and young people throughout the world have felt the effects of Coronavirus Disease 2019 and the decisions made in response to the public health crisis, acutely. Questions have been raised about adequately protecting children’s privacy, as schooling, play and socialising went almost exclusively online. However, due to the historical lack of children’s rights being embedded throughout decision-making processes (including important participation rights), the effects of the increased surveillance as a result of the pandemic have not been thoroughly considered. This article pursues three objectives. First, it seeks to develop the literature on the enabling aspects of privacy for children in relation to education and play. Second, it seeks to expand the discussion on the exploitative risks endemic in not protecting children’s privacy, including not only violent harms, but commercial exploitation. Third, it suggests some policy responses that will more effectively embed a children’s rights framework beyond the ‘parental control’ provisions that dominate child-specific data protection frameworks.

obligations. Notably, para 2 stipulates that states are required to protect children's privacy from such interferences through law. Thus, as Tobin and Field note, the obligation includes 'positive measures … to secure a child's enjoyment of the right to privacy'. 14 This gives states significant leeway in relation to how to best implement the positive obligations with respect to protecting privacy, which has led to great variation in terms of how children's right to privacy is safeguarded, especially given the uncertainties surrounding the scope of this right.
In some jurisdictions, such as the European Union (EU) 15 and the United States (US), 16 there are specific legal provisions that protect children's personal data; however, in Australia, the key piece of federal legislation, the Privacy Act 1988 (Cth) (Privacy Act), contains no provisions dealing specifically with children. These differences are compounded by the fact that the right to privacy is not enshrined in Australian law, despite the Privacy Act referring to the right to privacy in art 17 of the International Covenant on Civil and Political Rights (ICCPR) as a key motivation for its adoption.
The wording of art 16 of the CRC reflects art 17 of the ICCPR. However, the scope of art 16 (and the scope of the definition of privacy) has not been clarified by the drafters or the CRC Committee. Despite this, children's privacy clearly expands beyond a limited concept of privacy as seclusion or a right 'to be let alone'; however, the wider ordering principle of being free from intrusion into seclusion may capture these concerns. 17 The understanding of the right is thus similar to the one attributed to the right to privacy provided in art 8 under the European Convention on Human Rights (ECHR) as elucidated by the jurisprudence of the European Court of Human Rights (ECtHR). In conceptualising the right to privacy under art 8 as linked to a person's development with reference to the case law, Ziegler suggests there are two strands to the right: (1) privacy as seclusion or intimacy; and (2) privacy as freedom of action, self-determination and autonomy. 18 The first of these is often defined spatially or alternatively in terms of substance as to what is 'private', while the second focuses on self-development. Both are necessary for the development of one's personality through self-realisation and autonomy. 19 Such an understanding aligns well with the ECHR case law and the ECtHR's repeated confirmations that the protection of autonomy falls within the scope of art 8. 20 However, while ECtHR's jurisprudence on the right to privacy provides some guidance, neither the interpretation of the right within one regional human rights framework nor the experience of an adult's right to privacy is determinative of how that right should be considered for children. 21 European courts in particular have tended to assess the privacy rights of children by reference to the previous conduct of the parents rather than by using the guiding principles of the CRC, and little consideration has been given to the best interests of the child. 22 Under the CRC, while the actions and views of parents should be taken into account with reference to the evolving capacities of the child, children's privacy should not be subject solely to the actions 23 or control of others (including parents). 24 Such an approach fails to give sufficient consideration to children's agency or recognise that children often may want or need privacy from their parents. 25 However, in saying that, we agree with Hargeaves's proposition that 'children do not achieve autonomy by shedding familial bonds'; rather, social context can support autonomy. 26 To this end, a rights-based approach together with the 'capabilities approach' requires policy makers to take account of what human beings (including children) need for a flourishing life. 27 The capabilities approach can be used to 'impos[e] limits on parental rights and freedoms, in order to protect the future rights or capabilities of children '. 28 In this sense, policy makers should start by considering the best interests of the child and the conditions necessary for a flourishing life. Responses to promote the best interests of the child and human flourishing may include direction and guidance from parents in relation to privacy, but this guidance should not necessarily be determinative. A rights-based theory aims to move past the simple 14 Tobin, "Article 16," 596. 15 General Data Protection Regulation (GDPR). 16 Children's Online Privacy Protection Act 1998 (COPPA). 17 Tobin, "Article 16," 560; Richardson, Advanced Introduction to Privacy Law, 3, 32. 18 Ziegler, "Introduction," 1. 19 For a discussion on 'intellectual privacy', see Richards,Intellectual Privacy and Barendt,"Privacy and Freedom of Speech." 20 For example, the ECtHR found that art 8 ECHR included the ability to refuse medical treatment and that the imposition of treatment on a patient who has not consented 'would quite clearly interfere with a person's physical integrity in a manner capable of engaging the rights protected under art 8 (1) 23 Gligorijević, "Children's Privacy," 202. 24 Tobin, "Article 16," 557. 25 Boyd, "Social Privacy in Networked Publics." 26 Hargreaves,"'Relational Privacy' and Tort," 457. 27 Nussbaum,Creating Capabilities,125. 28 Dixon, "Children's Rights and a Capabilities Approach," 554. dichotomy of adults and children. It posits that children should not be seen only as 'becomings' but should be seen as 'beings' or humans in themselves. 29 Under this view, children not only require protection and provision, but also have their own agency and should participate in society. Measures aimed at increasing agency and supporting rights, such as participation, identity and information, should also be prioritised. Indeed, as mentioned in the introduction, in the CRC, rights are commonly classified into one of three categories; that is, 'protectionist', 'participatory' or 'provision' rights. 30 All rights are considered important; however, in practice, often, more attention is paid to the protection rights than the participatory rights of children. 31 However, the CRC clearly emphasises participation and thus children's capacities and strengths as rights-holders and social actors and not merely as vulnerable victims. 32 Lundy further provides a framework for realising children's right to be heard under art 12 that involves four elements (i.e., space, voice, audience and influence). 33 Using this framework, children need an opportunity to express their views and this opportunity must be facilitated. Thus, their views must be listened to and acted upon as appropriate. 34 Privacy is ostensibly a 'protection' right; however, in examining children's privacy in the pandemic, privacy should not only be conceptualised as protectionist under the CRC but must also be understood with reference to its enabling functions and thus its effect on children's participation. 35 The right to privacy is essential for individual autonomy and self-determination and is thus a significant precondition of (child) participation in the digital environment. It relates not only to having control over the aspects of the identity a child wants to project to the outside world, 36 but also to safeguarding the human capacity for reflexive self-determination. 37 Thus, it is also linked inter alia to the child's rights to development, freedom of expression and freedom of thought. 38 This reflects the 'empowerment versus protection' dilemma that is prevalent throughout children's rights discussions, particularly when considering the use of technologies. 39

Privacy, Participation and Self-Determination in Education and Play
Public health responses during the pandemic have included a vast range of measures that have directly affected children and young people, including the delivery of schooling online, the closure of playgrounds, restrictions in relation to face-to-face socialising and fines and sanctions for breaching new rules in public spaces, such as the mandatory mask-wearing law for those aged 12 and above. 40 Further, as movement has been restricted, reliance on digital forms of communication and maintaining social connections via social media, video conferencing applications (apps) and online messaging have been the primary methods of communication for children and adults alike. Accordingly, there has been increased and pervasive digital and physical surveillance of children in various aspects of their lives, including in their education and play, which are two rights unique to children in international human rights instruments.

Education
During the pandemic, the restriction of movement has been a primary method of public health control, which has led to school closures around the world and affected hundreds of millions of students. 41 In the CRC, the right to education is found within arts 28 and 29. Education not only encompasses formal institutional schooling but other aspects of children's development. However, formal learning environments are of key importance, and school closures can have devastating effects on students. 42 These closures during the pandemic were subject to significant public debate given the widely accepted importance of school 29 Archard, The Moral and Political Status of Children, 2. 30 Freeman, The Future of Children's Rights. 31 Nishiyama, "Between Protection and Participation," 502. 32 Ruxton, "Children's Rights in the European Union: What about Us?" 105. 33 Lundy, "'Voice' Is Not Enough," 933. 34 Lundy, "'Voice' Is Not Enough," 933. 35 Verdoodt,Children's Rights. 36 According to Rouvroy and Poullet, 'the capacity of the human subject to keep and develop his personality in a manner that allows him to fully participate in society without however, being induced to conform his thoughts, beliefs, behaviours and preferences to those thoughts, beliefs, behaviours and preferences held by the majority,' see Rouvroy, "The Right to Informational Self-Determination," 59. 37 For a discussion of 'intellectual privacy', see Richards, Intellectual Privacy. 38 Roessler argues that 'the right to privacy lies at the very heart of a human right to freedom and autonomy' and is central to people being able to flourish and develop, see: Roessler, "X-Privacy as a Human Right," 187. 39 Macenaite, "From Universal towards Child-Specific Protection," 766-767; Rosani, "We're All in This Together." 40 Mills, "Police Urged to Hand Out Masks." 41 UNESCO, "Education: From Disruption to Recovery." 42 For example, the effects of school closures due to the Ebola breakout in 2014-2015 were long lasting and particularly gendered; see Posso, "From WW2 to Ebola;" United Nations Development Programme, Confronting the Gender Impact of Ebola. education. 43 The benefits of school extend far beyond formal education to the social opportunities schooling affords. Indeed, 71% of children from a range of countries who responded to a World Vision survey 'said that they feel isolated and lonely since their schools were closed' due to the COVID-19 pandemic. 44 Schools and teachers have had to transition quickly to provide online and remote learning experiences. 45 However, the digital divide has meant that students experiencing social and economic disadvantages have suffered the negative effects of school closures more acutely than their peers. 46 A rights-based approach requires that we not only need to keep children learning, but 'expand internet access for families and children, and provide the support and technological capacity to do so '. 47 Digital access and support measures are important not only to ensuring access to education but also to maintaining privacy for students. The push for educational technologies and the switch to online learning caused by the pandemic has also led to a significant increase in data collection by the businesses that provide the software used in educational settings. 48 This in turn has the potential to significantly interfere with children's right to privacy, as 'education technologies collect, process, and create much more information about students in much greater detail'. 49 Schools and education departments may be required to comply with various privacy and data protection regimes; however, the involvement of public and private entities contributes to the confusion of how different legal frameworks intersect and who has responsibility and accountability.
The Australian context provides a good example of this tension, as while federal legislation may apply to educational technology companies and some private schools, state legislation covers the public sector, including schools. 50 Similar issues have arisen in the US, as the Family Educational Rights and Privacy Act (FERPA), only applies to public educational settings. 51 Accordingly, while privacy impact assessments and resources were made available by education departments, time constraints and a lack of access to these resources has meant that privacy impact assessments have not always been undertaken. 52 For example, a report from the Office of the Victorian Information Commission found that schools noted 'privacy was not the top priority when selecting software, and other considerations such as costs were a greater priority '. 53 Thus, it appears that schools implemented digital learning tools during the pandemic without considering privacy risks or engaging with children, leaving the privacy of children and young people exposed. 54 The outcome of this has been that 'free' applications have been adopted in schools that often collect vast amounts of user or behavioural data. 55 As a result of the shift to online teaching, teachers and schools within the formal schooling environment may also have an increased amount of data about students' home and personal information. Additionally, privacy concerns are amplified when family members are required to share devices, which increases not only security risks but also makes it more difficult to maintain interfamily privacy, especially privacy from parents. 56 This highlights how the dynamics of different relations have been changed by moving schooling online and the shifting privacy risks in this environment. To clarify, to participate in schooling, students navigate complex relationships with many, including schools, teachers and other students; however, the reliance on technology places commercial service providers at the centre of students' schooling environment. 43 Boddy, "Benefits of Return to School." 44 Cuevas-Parra, Children's Voices, 17. 45 However, educational technology was already increasingly used; see Rennie, "Privacy and App Use." 46 Mitchell Institute, Brief Assessment, 1. 47 Raman, "Where Do We Go from Here?" 3. 48 Even before the pandemic, the extent of tracking from Google's G-Suite had been subject to various legal challenges. The claim in State of New Mexico v Google LLC (D.N.M., No. 1:20-cv-00143-NF-KHR) states, '[t]he consequences of Google's tracking cannot be overstated: children are being monitored by one of the largest data mining companies in the world, at school, at home, on mobile devices, without their knowledge and without the permission of their parents ... While purporting to offer only educational services, Google instead has stripped children and parents of autonomy and control of their most sensitive personal information, forcing children to acquiesce to constant monitoring, in perpetuity, in exchange for their education'. For a review of educational technologies adopted during the pandemic, see Vargo, "Digital Technology Use," 19. 49 Zeide, "The Limits of Education Purpose Limitations," 505. 50 A contact memorandum between the Australian Office of the Information Commissioner and the Australian Competition and Consumer Commissioner highlighted the complexity in the Australian context; see Office of the Australian Information Commissioner, "Contact Report." Each Australian state and territory has its own legislation that deals with how state and territory government bodies handle personal information, and no jurisdictions have specific protections for children, see:  51 Li, "Privacy in Pandemic," 74; The Family Educational Rights and Privacy Act (FERPA). 52 Office of the Victorian Information Commissioner (OVIC), "Examination into the Use of Apps," 19. 53 OVIC, "Examination into the Use of Apps," 5-6. 54 See, for example, OVIC, "Examination into the Use of Apps," 5, 19. 55 Teräs, "Post-Covid-19 Education," 870; Krien, "The Screens that Ate School." 56 Young people claim that privacy from parents is important; see, for example, Boyd, "Social Privacy in Networked Publics." Further consideration needs to be given to how this loss of privacy affects students' ability to engage in the formal schooling environment, and children should be given the opportunity to be heard on this issue. This is significant given that the potential long-term effects of this are not limited to the formal schooling environment, as this information is being used to build profiles on children, which in turn could affect their other social and extracurricular environments. 57 As Rosani notes, in this hyperconnected reality, children's education in a holistic sense is affected, as 'receiving unbalanced data and information may exacerbate the child's initial preferences, adversely impacting on their autonomy and their right to development'. 58 The CRC Committee interprets the right to development broadly as being 'a holistic concept'. 59 Further, according to Peleg, this right encompasses the child's 'physical, mental, spiritual, moral, psychological, and social development'. 60 The right to development encompasses both the right to enjoy the process and the right to the outcome of the developmental process. 61 The right to development requires that children's basic needs are fulfilled, so that they can optimally develop into independent adults. However, the effects of data collection, profiling and automated decision making may be long lasting and impede children's free development, especially if their personal data are later reused in further education and higher education or for employment purposes.
Profiling and automated decision making in an educational context have the capacity not only to categorise children, but also to shape their preferences and interests accordingly. 62 This may undermine children's rights to experiment freely with and critically reflect upon their interactions, as the digital environment they are exploring and are communicating in is now subject to supervising and tracking. 63 In other words, this form of supervision could have important and chilling effects on children; for example, in the form of an unwillingness to search for certain information. 64 Automated decisions should not disregard the value of a child's emotional space, which should not be subject to the inside-the-box thinking that constitutes profiling-based decisions. 65 Moreover, despite the existing market push to adopt technology to provide personalised learning, which has become a 'seller's market' during the pandemic, 66 there is still little pedagogical evidence that personalised education improves students' learning outcomes. 67

Play
Another fundamental and vital dimension of childhood development that has been significantly affected by the pandemic is child's play and leisure. Article 31 of the CRC explicitly recognises the importance of play and recreation in children's lives, due to its positive effects on the social, cognitive and personal development of the child. 68 According to the CRC Committee, art 31 should be understood holistically, as it is structured around three clusters of rights that are mutually linked, reinforcing and enriching children's lives; that is: the right to rest and leisure; the right to engage in play and recreational activities; and the right to participate freely in cultural life and the arts. 69 The pandemic has restricted opportunities for children to realise their rights under art 31 in multiple contexts, as day-care centres, schools, public playgrounds and various arenas at which children spend their leisure time, such as football fields and arts centres, have closed down and time allocations for outdoor exercise have been imposed. Children have been barred from meeting up in groups and forced to play with only a few friends at a time, preferably the same friends each time and to do so while respecting social distancing rules. The lockdown measures have particularly affected the children who are growing up in poverty and difficult circumstances. 70 For example, the hard lockdowns and home restrictions in Melbourne's public tower blocks, which saw children and young people confined to very small rooms, without access to fresh air and outdoor space and often without any private space for themselves, have caused significant distress and could potentially have lasting effects on the families affected. 71 Children and young people often find their private space outside the home, 72 and the 'streets' are an essential space for children to 'gather, engage in cultural activities, and interact with each other'. 73 Such examples underline the importance of states addressing structural inequalities that constrain children's rights to play and leisure in their responses to COVID-19. 74 The potential effects of lockdowns and other measures restricting children's opportunities for exercising their rights under art 31 of the CRC demands specific attention, particularly in relation to how such restrictions may affect children's privacy in their home environment and vis-à-vis their own family.
The CRC Committee encourages states to develop the policies and adopt the measures needed to enable all children to take full advantage of the opportunities of the digital environment. 75 Such measures include inter alia ensuring that children have equal access to the internet and new media technologies and are educated and provided with the necessary skills to use and reap the benefits of such technologies for exercising their right to play. Even before the COVID-19 outbreak, playing online games had become one of the most popular indoor activities; for example, research showed that two in three children reported playing online games at least once a week in most EU countries. 76 As the CRC Committee highlighted, 'children in all regions of the world are spending increasing periods of time engaged in play, recreational, cultural and artistic activities, both as consumers and creators, via various digital platforms and media '. 77 Due to the restricted opportunities for play and leisure, children have turned even more to the digital world for entertainment. 78 Online platforms and apps have filled a genuine social need for children under 18 years to watch, make and share videos and images or create new art forms and have filled this need even more so during the pandemic. TikTok dance challenges present fun new ways to pass the time and sometimes even turn into global awareness campaigns; for example, the #DistanceDance by Charli D'Amelio (who has 47 million followers) encouraged youngsters to practise social distancing in a creative and entertaining way. 79 Popular online games offer a richly social and creative experience and form interesting talking points and cultural moments that children can share with their peers. 80 Conversely, parents and guardians are struggling to strike the right balance between maintaining a sense of normalcy by providing children with access to the digital world to play and communicate with friends and the issues arising from children's increased reliance on screens. Emerging reports have indicated that video-game usage during peak hours has gone up 75 per cent in countries such as the US since the outset of the pandemic. 81 In 2019, the World Health Organisation (WHO) voted to include video-game addiction or 'gaming disorder' in its International Classification of Diseases. 82 In recent years, there has also been a rapid increase in the popularity of 'esports' or competitive video-game contests. 83 This phenomenon raises significant public health concerns related to associated excessive gaming consumption and the potential exposure of children to harms, such as bullying and grooming, similar to those in traditional sporting contexts due to team environments and professional coaching. 84 Children's playful experiences in the digital world are also becoming increasingly monetised, which exposes them to significant commercial and privacy risks. 85 A growing amount of easily accessible games online rely on monetisation techniques, such as in-game advertisements or purchases. The blurred lines between commercial messages and the gaming content itself makes it more difficult for children to exercise their advertising literacy skills 86 and significantly affects their purchasing behaviour. 87 Video games have also started to incorporate gambling-like features, such as loot boxes, 88 73 Nishiyama, "Between Protection and Participation," 504. 74 Bakrania, Impacts of Pandemics and Epidemics; Children and Young People's Commissioner Scotland, Independent Children's Rights Impact Assessment. 75 CRC Committee, General Comment No. 17. 76 Smahel, EU Kids Online 2020. For example, in the UK, the estimated weekly hours spent gaming increase with age, ranging from 6 hours 12 minutes for 3-4-year-olds to 13 hours 48 minutes for 12-15-year-olds; see Ofcom, "Children and Parents: Media Use and Attitudes Report 2018." 77 CRC Committee, General Comment No. 17. 78 For example, Twitch, the major live-streaming platform for games, which can serve as a barometer for video-game content engagement, showed a 110% increase in the monthly global hours year on year in April 2020. (Data sourced from: Esports Charts. "Twitch Stats.") 79 Lustig, "TikTok star Charli D'Amelio." 80 Carter, "Situating the Appeal of Fortnite." 81 Gregory, "Don't Feel Bad." 82 World Health Organisation (WHO), "Sharpening the Focus on Gaming Disorder." 83 Gibbs, "Esports Spectatorship in Australia." 84 Esports Integrity Coalition, "The Importance of Child Protection in Esports." 85 van der Hof, "The Child's Right to Protection." 86 Advertising literacy skills entails both recognising the commercial nature and persuasive intent of commercial communication and being able to critically reflect on it. De Pauw, "Children's Advertising Literacy." 87 For example, a study by the European Commission found that embedded advertisements have a subliminal effect on children and that exposure to prompts to make in-app purchases has a significant effect on children's purchasing behaviour. Lupiáñez-Villanueva et al. "Study on the impact of marketing through social media, online games and mobile applications on children's behaviour". 88 Research by scholars at the University of York shows that loot boxes are increasingly prevalent, featuring in about 71% of the most popular titles on the gaming portal Steam, compared with 4% a decade ago. Zendle, "Adolescents and Loot Boxes." which are intensifying societal concern that children are being progressively exposed to gambling. 89 Such commercial risks are exacerbated when famous gaming YouTubers tell their young audiences to make donations and gamble during gaming livestreams. 90 Further, as they play these supposedly 'free' games, children's information, such as their preferences and behaviours, are collected and stored in corporate platforms and later reused for commercial purposes. 91 The commercial appropriation of children's personal data through online forms of play raises concerns about how this may further compromise children's privacy. 92 Montgomery et al. have expressed concern that the digital dossiers that are created by internet companies could 'follow young people into adulthood, affecting their access to education, employment, health care, and financial services '. 93 Before the pandemic, Leonard asserted that outdoor play by children has 'almost disappeared' and 'play has become much less spontaneous' and 'highly organised' and observed that children and young people are experiencing increased levels of surveillance in the private domain of their home. 94 Within the sociology of childhood literature, this change has also been noted. Adults are increasingly becoming positioned and portrayed as both 'the natural protectors of childhood' and also 'as one of the biggest threats to the innocence of childhood'. 95 Closely related to children's right to play, 96 their use of public and private spaces and their freedom of association 97 is their increased use of online spaces during the pandemic.

Emerging Forms of Exploitation and the Participation-Protection Dilemma
Children's autonomy is limited by restricting their choices and the information to which they are exposed, as well as the active manipulation and persuasion techniques used by many digital platforms in both education and play environments. 98 The Organisation for Economic Co-operation and Development (OECD) has stressed that children are exposed to significant consumer risks in the digital environment. They may face inter alia 'embedded ads, privacy-invasive practices, ageinappropriate content, as well as the exploitation of their incredulity and inexperience resulting in economic risks such as overspending or online fraudulent transactions'. 99 In particular, children's ability to play and learn in physical and online spaces during the pandemic has been significantly affected by the increased surveillance in those spaces.
The language of corporate surveillance or 'surveillance capitalism' is increasingly used in this context, 100 reflecting the mass data collection and privacy-invasive practices underpinning the personalisation of services. However, while some recent empirical research has shown that 'children primarily think about privacy in "interpersonal" contexts rather than "institutional" or "commercial"', 101 other studies, such as Gordon's studies on children's experiences of online harms in the United Kingdom, have demonstrated that children pose questions about who has access to their information and data and also refer to privacy, surveillance and the 'scams' that result in commercial profits by perpetrators as key concerns for them when using online spaces. 102 The language of privacy is thus useful, particularly when one of the aims is to facilitate the ways in which children can engage with these issues, reflecting the right's participatory dimension. In a recent empirical study, children as young as 10-years-old also used this language when describing the mechanisms that they put in place to protect their privacy, such as choosing not to use their full names, using an alias or using virtual private networks that older siblings have established. 103 According to van der Hof, treating children as the product rather than customers when offering them online services (e.g., by collecting their personal data and using it or reselling it) can also be perceived as a form of economic exploitation. 104 Thus, particular attention needs to be paid to the commercially exploitative practices that are being facilitated by the corporate surveillance of online spaces for play, recreation and education. According to the interpretation of the CRC Committee, 89 De Cock "Early Gambling Behavior." In a recent study, it was found that young people who spend money on loot boxes are more than 10 times as likely to be problem gamblers than those who do not; Zendle, "Adolescents and Loot Boxes." 90 Bridge, "Top YouTube Stars." 91 Lupton "The Datafied Child." 92 Holloway, "Surveillance Capitalism and Children's Data." 93 Montgomery, "Children's Privacy in the Big Data Era." 94 Leonard, The Sociology of Children, 59. 95 Leonard, The Sociology of Children, 59. 96 CRC, art 31. 97 CRC, art 15. 98 Oostveen, "The Golden Age of Personal Data." 99 OECD, "The Protection of Children Online." 100 Zuboff, The Age of Surveillance Capitalism. 101 Keen, "Apathy, Convenience or Irrelevance?" 4. 102 Gordon, "Online Harms," 17. 103 Gordon,"Online Harms," 57,58. 104 van der Hof, "I Agree, or Do I," 123.
'exploitation' means 'taking unjust advantage of another for one's own advantage or benefit'. 105 More specifically, this includes manipulation, misuse, abuse, victimisation, oppression or ill treatment. The potential for exploitation online thus extends far beyond the risk of manipulation for economic purposes, and the increasing use of digital services for play and education exposes children to further risks. At the sharp end of the continuum are physical, mental and financial exploitations, including family violence, child labour and other harms, and those perpetrated online, such as cyberbullying and online sexual abuse. Around the world, estimates before the pandemic indicated that the number of children and young people exposed to some form of abuse, neglect and violence was well over one billion. 106 The negative effects of exploitation on children has been recognised by international bodies, such as the United Nations International Children's Emergency Fund (UNICEF), which have advocated extensively for better responses and measures to protect all children from violence, exploitation and abuse on the internet. 107 The construction of online spaces as 'risky' and the consideration of children as 'at risk' are dominant in the discourse. 108 As noted above, the increased use of online spaces for play, recreation and education during the pandemic has raised key issues relating to the increase in opportunities for children to experience exploitation. In a Joint Leaders' statement, the WHO referred to the increased violence against children as the 'hidden crisis of the COVID-19 pandemic'. 109 Initial reports from law enforcement agencies in Europe, such as the International Criminal Police Organisation, demonstrate the 'increased sharing of child exploitation material through peer-to-peer networks' is one of the effects of the pandemic. 110 In Australia, the Australian Federal Police have reported that 'the amount of child abuse material shared on the Dark Net between February and March doubled from the same period last year'. 111 The underreporting, delayed reporting and the increased use of forums on the Dark Net pose significant challenges for law enforcement agencies and child protective services. 112 The CRC notes that state parties should 'take all appropriate legislative, administrative, social and educational measures to protect the child from all forms of physical or mental violence, injury or abuse, neglect or negligent treatment, maltreatment or exploitation, including sexual abuse'. 113 Children should be 'protect[ed] … from all forms of sexual exploitation and sexual abuse'. 114 Specifically, state parties must 'recognize the right of the child to be protected from economic exploitation and from performing any work that is likely to be hazardous or to interfere with the child's education, or to be harmful to the child's health or physical, mental, spiritual, moral or social development'. 115 Thus, the general obligation requires state parties to take all appropriate measures to respect, protect and fulfil children's right to protection against exploitation. 116 Such measures include legislative protection measures (e.g., criminalising practices that involve the exploitation of children) and social, educational and remedial measures. 117 However, it is evident that the lack of policy consideration and measures taken globally in response to the pandemic also raises significant questions in relation to children's right to protection under the CRC from any form of exploitation.
In light of the evident failings to protect children from increased harm, the WHO has called for more government action to overcome the dramatic effects of the COVID-19 pandemic. 118 Making reference to arts 19, 28 and 34 of the CRC, Raman et al. specifically called on governments to 'respond to the additional threats and risks of violence, exploitation and abuse to children from perpetrators capitalising on reduced school attendance and surveillance by authorities' during the pandemic. 119 However, this is somewhat ironic, as in many ways, due to the increased time they spend online, children are under more surveillance than ever. Exploitation, particularly examples at the sharp end of the continuum of harm, demonstrates the need for protection mechanisms for children online. However, protection should not be in a form that severely encroaches on a child's right to participate. Unsurprisingly, children have reiterated that 'digital technologies were vital to their current lives and to their future'. 120 Striking a balance is essential for children to be able to able to fully engage with all of the opportunities online spaces provide in a way that is safe and not damaging to their health and wellbeing.
Designing products that integrate privacy in a way that is meaningful for children is important. Notably, while a response could include the provision of parental guidance in a manner that is consistent with the evolving capacities of the child (under art 5 of the CRC), as Tobin and Varadan note, art 5 is 'best characterized as the right of a child to receive appropriate direction and guidance from his or her parents to secure the enjoyment of his or her rights rather than a right of parents to have their rights regarding their parenting respected by the state'. 121 Further, Ruiz-Casares et al. assert that children's protection can be improved 'through meaningful and effective engagement of children … to ascertain their realities and respond'. 122 As such, it is not a right of parents to decide what is in their child's best interest but rather a right of children to receive direction and guidance in accordance with their evolving capacities. In this sense, any response to the effects of the pandemic on children should not be approached from this perhaps fictitious 'implied nature of familiar relations' but from the very messy and constrained reality that children face. 123 Accordingly, the CRC Committee has called for state parties to address the exploitation of children in digital environments not by prohibiting participation in environments or relying on parental consent but by requiring 'a high standard of cybersecurity, privacy-by-design and safety-by-design in the digital services and products that children use, to minimize the risk of such crimes'. 124 Embedding privacy into products and services for education and play should be part of policy responses that seek to protect children from commercial and other exploitation in digital environments.

Lessons from the Pandemic
Children are often dependent on and vulnerable to the decisions of others (especially the adults responsible for their care) that are made on protectionist grounds. This protectionist approach has been intensely felt in countries in which extended restrictions and lockdown measures have been implemented due to the pandemic. States must account for this particular form of 'special vulnerability' by ensuring that decisions are not made that affect the future capabilities of children. 125 In any decision making that relates to them, even in times of crisis, children have a right to be heard and have their views given due weight in accordance with their age and maturity and in a manner consistent with their evolving capacities. 126 The UN Special Rapporteur on the sale and sexual exploitation of children has reiterated that 'children should be given the space for meaningful and inclusive participation so that their voices would be heard and amplified in decisions affecting their lives'. 127 Lundy's model of participation conceptualises how this can be achieved by giving children space, voice, audience and influence. 128 For example, the #COVIDUNDER19 survey is an important initiative to give children space and voice in relation to the effects of the pandemic on them. 129 It is now important to ensure that those views are listened to and acted upon as appropriate. The effects of any public health responses on the rights of children should be considered as part of the decision-making process. 130 A range of measures that are grounded in children's rights are needed to give sufficient importance to participatory rights. 131 In the educational context, developing more robust privacy impact assessment frameworks for adopting new technologies, which include children, is one key step in realising participatory rights. Such assessments should adopt a children's rights perspective that considers the full range of children's rights at stake, including the child's right to be heard. 132 However, any online safety assessment tools and checklists to screen new technologies (such as those developed by the Australian eSafety Commissioner) 133 need to be coupled with support and resources to ensure schools and departments effectively implement such processes. 134 These could include further staff training within schools about privacy and data protection, dedicated privacy officers within schools and a coordinated agency to assess what technology is necessary and appropriate in the educational context. Further, principles in the data privacy/protection context, such as data minimisation, privacy-by-design and privacyby-default, need to be firmly embedded in the educational context. Li argues that the pandemic has highlighted the need for the law to recognise that there should be 'higher expectations of privacy in an educational setting than other businesses'. 135 Education is a significant and important right under the CRC; however, it should not only be understood in an institutionalised sense. The remote learning practices adopted during the pandemic have brought to light that the privacy of students is an important part of enabling this right to education more holistically.
Additionally, while there may be a push from educational technology providers to provide personalised learning to students, the profiling and tracking of students may hinder their ability to engage in new ideas, enjoy the process of development and flourish as individuals. Some sort of online learning may be inevitable and beneficial; however, the pandemic has highlighted the need to better support schools to assess any privacy implications before the adoption of educational technologies. This should include developing processes for engaging students and through empirical research, the development of pedagogical evidence that will identify the need for and scope of online solutions.
To ensure we create spaces for children and young people to learn and play, privacy should be considered not only as a right to seclusion or to be let alone but also as encompassing autonomy and self-determination (using a broad relational view of autonomy). This self-determination concept in the online environment particularly requires spaces to be free not only from excessive data capturing practices, commercial exploitation and personalisation but also from excessive parental monitoring. In General Comment No. 25, the CRC Committee reiterated that '[p]arents' and caregivers' monitoring of a child's digital activity should be proportionate and in accordance with the child's evolving capacities '. 136 To reflect this in terms of policy, there should be further development of data protection codes aimed at embedding children's rights, such as acting in the best interests of children, into the design of online technologies. 137 The development of codes will assist in the embedding of privacy norms in relation to children based on a notion of fiduciary responsibility or trust. 138 For example, in 2020, the Committee of Convention 108 adopted the 'Children's Data Protection in an Education Setting Guidelines', which provides recommendations for legislators, policy makers, data controllers and industry on how to support children's rights in relation to educational technology, including that 'profiles and history should be easy to delete at the close of a session'. 139 Cultural and media studies scholar, Eichhorn, claims that while we once had the ability to only carry forward tolerable or relevant childhood memories, the prevalent documentation of children now makes this virtually impossible. 140 Thus, direct and actionable child-specific privacy and erasure rights for children (which are not based solely on parental consent) also have a key part to play in safeguarding these issues as online education and play continues during and will most likely continue post the pandemic. 141 Finally, in addition to proactive privacy-by-design and assessment measures, the pandemic has also highlighted the need for effective legal frameworks and regulators that can deal with the individual issues of children and young people to ultimately ensure that they can exercise their rights. For example, the Australian eSafety Commissioner's office and remit, has been heralded as an online safety model for addressing exploitation, such as cyberbullying, image-based abuse and illegal content. 142 However, as outlined in Part 3 above, the exploitation of children due to their increased use of digital educational and play technologies during the pandemic includes pervasive commercial exploitation, which needs to be given more attention to properly identify the harms and sensibly regulate in this area.

Conclusion
The measures adopted during the COVID-19 pandemic have been felt acutely by children and young people, and there have been calls for government action to ease some of the key concerns of children, including increased mental health concerns and the provision of support in relation to education. 143 Hanson and Peleg reiterate the 'need to continue reflecting about the moral and legal rights children have and/or should have, and about how these rights can be further exercised, or need to be balanced against one another '. 144 This paper demonstrated the ways in which protecting the privacy of children during the pandemic is linked to and enables the provision of education and play in such a way that risks from potential exploitation (commercial or otherwise) are more effectively mitigated. In this sense, we endorse the CRC Committee's view that '[p]rivacy is vital to children's agency, dignity 135 Li,"Privacy in Pandemic," 76. 136 CRC Committee,General Comment No. 25,[76]. 137 For example, see the UK Code: Information Commissioner's Office, "Age Appropriate Design." 138 Waldman, "Designing without Privacy," 663-664. 139 Committee of Convention 108, "Children's Data Protection," 22. 140 Eichhorn,The End of Forgetting,50. 141 See, for example, Bunn's proposal of a take-down scheme for images of children: Bunn, "Unwanted Distribution of Children's Images." 142 Wayman, "The Horse Has Bolted on This." 143 Nicolson, "Impacts of COVID-19." 144 Hanson, "Waiting for Children's Rights Theory," 3. and safety and for the exercise of their rights' and thus that states should ensure that digital products and services for education and play are subject to robust data protection and privacy standards. 145 Embedding a children's rights-based approach throughout policy responses, offering real opportunities for children to express their views and ensuring they are acted upon as appropriate 146 will assist in thoughtful decision making in times of crisis.