appConfigEntityId

bodyType

customContents

entityId

entityUuid

isVideo

articlePageQuery

article

articleSchemaContent

content

hooksArticlePageAdvertisementConfigArticle

hooksArticlePageFloatingButtonConfigArticle

appConfig

filter

json

liveArticle

Emily Hung

A global investigation involving Hong Kong authorities has found that more websites and mobile apps designed for children are collecting personal data – ranging from phone numbers to addresses – than they did about a decade ago.
The 2025 Global Privacy Enforcement Network Sweep, which included the participation of Hong Kong’s Office of the Privacy Commissioner for Personal Data, examined 876 websites and mobile apps specifically designed for children across multiple sectors in early November, including education, gaming, social media and video streaming.
“As the cognitive abilities of children are still developing, they may not fully understand their personal data privacy rights and are therefore more vulnerable to privacy risks arising from less privacy protective settings and design features of websites and mobile apps,” Privacy Commissioner for Personal Data Ada Chung Lai-ling said on Wednesday.
The investigation found that while some platforms have adopted good practices to protect children and their personal data, more online services now require users to provide their personal data to access the full functionality of the platform compared with 2015, raising concerns about children’s privacy.
Last year, 41 per cent of platforms required users to provide their names, up from 29 per cent in 2015. About 20 per cent needed to give their phone numbers, up from 12 per cent a decade ago.
More platforms also asked for users’ addresses and photos or videos.
As many as 85 per cent of the platforms indicated in their privacy policies that they may share children’s personal data with third parties, a substantial jump from 51 per cent in 2015.
Nearly half of the platforms deployed some form of age assurance, which represented a 30 percentage point increase from 2015. However, more than 70 per cent could have the age assurance measures circumvented because they only asked for self-declaration.
More than one-third did not provide an accessible way to delete accounts, although the figure represented a substantial improvement on 71 per cent in 2015.

Meanwhile, nearly 60 per cent required users to provide an email address to access all functions, with 46 per cent requiring geolocation.
More than 90 per cent had privacy policies in place, but only 56 per cent had the personal data collected set to private by default.
Notably, bullying, abusive or hateful content was found in 15 per cent of the platforms, while sexual content appeared in 11 per cent of them.
Only 35 per cent of the platforms found to have high-risk data processing and design features for children had privacy communications, such as pop-up messages, directing children to seek permission from their parents to continue using the services.
Authorities taking part in the investigation suggested operators of websites and apps designed for or popular with children adopt child-friendly and privacy-protective measures.
Chung said organisations should ensure that the best interests of youngsters were the primary consideration in the collection, processing and use of children’s data.
They should “adopt privacy by design and by default to ensure that privacy protection measures are embedded from the very beginning of the design and development stages of products and services, with a view to enabling children to use online services safely”, she said.


14 key takeaways from John Lee’s policy address, Hong Kong’s first 5-year plan

Hong Kong’s first five-year plan seeks to boost innovation

Hong Kong must prepare for the impact of heat-related work stoppages

Kowloon Bay’s new Amoy Footbridge set to draw neighbourhood closer together

Hong Kong society

More websites, mobile apps for children collecting personal data: study

Nearly half of the platforms examined deployed some forms of age assurance, the investigation found. Photo: Winson Wong

Privacy chief Ada Chung says the best interests of children should come first. Photo: Jelly Tse

Hong Kong plans to revive privacy law requiring firms to report data breaches

Privacy Commissioner Ada Chung says the mandatory breach reporting measures may be carried out in phases. Photo: Jelly Tse

The watchdog received 246 data breach notices in 2025, with hacking as the main cause of leaks. Photo: Getty Images

Fix, don’t fire ‘digital employee’ OpenClaw over security risks: Paul Chan

OpenClaw functions as a proactive assistant – once permissions are granted, it controls applications, organises files, processes emails, sorts data and executes coding workflows. Photo: Getty Images

Finance chief Paul Chan has said that AI agent OpenClaw should not be dismissed but rather improved to address security risk concerns. Photo: Eugene Lee

News

Hong Kong

Society

Global investigation examined 876 websites and mobile apps designed specifically for children across multiple sectors


Global investigation examined 876 websites and mobile apps designed specifically for children across multiple sectors.


More websites, mobile apps for children collecting personal data: study

.css-1c6uqr6{color:inherit;font-weight:inherit;font-size:inherit;font-family:inherit;line-height:inherit;overflow-wrap:break-word;}Global investigation examined 876 websites and mobile apps designed specifically for children across multiple sectors

Global investigation examined 876 websites and mobile apps designed specifically for children across multiple sectors