Perspective | Legal Protection of Minors' Personal Information on Online Platforms

In June 2022, the seminar on the protection of minors online released the "Research Report on the Current Situation of Online Protection of Minors" (hereinafter referred to as the "Report"). The report shows that in recent years, incidents of minors' information leakage have occurred frequently and analyzes the reasons for the leakage of minors' personal information. The background for the release of the report is not only due to the rapid development of network technology and the emergence of various online platforms that minors can participate in, but also based on the frequent disputes over minors' personal information rights on online platforms in recent years, indicating an urgent need for protection. On August 18, 2022, the Hangzhou Internet Court announced the mediation conclusion of the first national civil public interest lawsuit on "Protection of Minors Online". The case originated from the discovery by the Yuhang District Procuratorate that a short video APP operated by a certain company was infringing on the personal information of many unspecified children. Specifically, the APP did not distinguish and manage the information of minors, allowing users to privately message minors' accounts simply by clicking "follow" and access sensitive personal information such as minors' geographical locations and facial features. The APP also pushed short videos containing minors' personal information to users who liked browsing content related to minors through backend algorithms, creating opportunities for criminals. On December 2, 2020, the procuratorate filed a civil public interest lawsuit with the Hangzhou Internet Court, which ultimately concluded with mediation. The technology company compensated 1.5 million yuan for public welfare matters such as the protection of children's personal information safety and rectified the short video APP. This case reflects the numerous enterprises that illegally infringe upon minors' personal information rights.

On January 1, 2024, the "Regulations on the Protection of Minors Online" will be officially implemented, increasing the efforts to protect minors online. Although relevant laws and regulations such as the "Civil Code", "Law on the Protection of Minors", and "Regulations on the Protection of Minors Online" have strengthened the legal protection of minors' personal information on online platforms, some issues still need further clarification and improvement:

First, the issue of defining the scope of subjects for the protection of minors' personal information. The definition of minors generally uses age standards for classification, but different academic fields have different claims regarding age classification standards. This article will explore how to define the concept of minors when delineating the scope of subjects for the protection of minors' personal information on online platforms. Second, what are the categories of objects for the protection of minors' personal information? The aforementioned case mentioned minors' geographical locations, facial information, etc. Which personal information of minors needs legal protection? Third, after the introduction of a series of laws such as the "Civil Code", "Cybersecurity Law", "Personal Information Protection Law", "Law on the Protection of Minors", and "Regulations on the Protection of Minors Online", how can we reconstruct the legal mechanism for the protection of minors' personal information rights for issues that still need improvement? This article will focus on exploring the above issues.

The personal information of natural persons is protected by law, and minors are a particularly special category within natural persons. Their special status is determined by the incompleteness of minors' physical and mental development. Compared to adults, minors' personal information is more sensitive and should receive more special protection. It is important to note that in our civil law, minors do not completely equate to minors under the personal information protection law. The age range for special personal information protection should comprehensively consider the legislative protection of minors and civil capacity, balancing the protection of minors' personal rights and their social development space is urgent. Current legal provisions in China define minors as natural persons under the age of 18. Related legal age provisions include: The "Compulsory Education Law of the People's Republic of China" stipulates that the compulsory education period for minors is from 6 to 16 years old, and their educational rights protection period does not extend to 18 years old. Additionally, the "Labor Law" of China clearly states that minors under the age of 16 do not have the right to work, while minors over 16 can participate in labor and receive corresponding remuneration. The relevant age provisions in the "Civil Code" are as follows: natural persons under the age of 18 are minors, and the civil capacity of minors aged 8 to 18 is classified as limited civil capacity, with one exception: minors who are 16 years old and whose main source of livelihood is their own labor income have obtained independent living ability and possess judgment capabilities equivalent to adults, thus the civil law treats them as having full civil capacity and can independently bear civil responsibility. This leads to the question of what age is appropriate for the protection of minors' personal information in China. The author believes that minors' personal information under the age of 16 should receive special legal protection for the following reasons:
 

1. The widespread use of the internet among minors at the current stage in China.

Minors over the age of 16 use the internet more than adults, and their online behavior has become more adult-like. Guardians cannot fully supervise their online behavior, and entities engaged in information services find it difficult to identify the information publishers individually with existing technology. If special protection is to be provided for the personal information of minors over 16, it would require individual identification of their online behavior, which would inevitably impose excessively high sunk costs on information service providers and would be nearly impossible for their guardians to accomplish. If such restrictions are imposed, the special subjects of minors over 16, who are treated as having full civil capacity in civil law, would also be unable to fully realize their labor rights, which would be detrimental to their personal development and would also limit their social capabilities.

2. The incompleteness of personality development in minors under 16 is also a reason for their need for special protection.

Minors, who are in the process of physical and mental development, have a high curiosity about the online world and a weak awareness of privacy protection. At this stage, minors find it difficult to make rational judgments and cannot identify the sensitivity of personal information. They are prone to provide personal information without protection, and once this information is improperly handled, it can cause irreparable damage. In terms of protection difficulty, minors under 16 are in the stage of receiving compulsory education, where school and family occupy their main living space. At this time, family members and schools, as guardians, can effectively guide and protect them, supervising and controlling their online behavior.

3. It does not hinder the social participation of minors under 16.

Minors under the age of 16 cannot participate in social work, and the special protection of their personal information will not affect their right to social participation, while their right to work will not be restricted. Referring to the practices of the Civil Code of our country, minors over the age of 16 can be regarded as having full capacity for civil conduct, so there is no need for special protection for them. This process represents a gradual transition where personal information protection gives way to personality development, marking a transitional period. At the same time, having completed the compulsory education stage, minors over the age of 16 are about to enter higher education or participate in social work, gradually distancing themselves from the previously strict monitoring and educational environment. Therefore, the special protection of their personal information is no longer as reasonable as that for minors under the age of 16.

4. Summary

Based on the above reasons, considering China's legal protection tradition for minors and the current situation of minors' internet usage, special protection should be provided for the personal information of minors under the age of 16 in our country.

Guardians have obligations to support and educate those they are responsible for. Legal guardians need to understand the handling of minors' personal information during the guardianship process. This includes the content of their information and the circumstances under which it is obtained, stored, used, and utilized by third parties. To better serve the interests and physical and mental development of minors, guardians need to have a more comprehensive understanding of minors' personal information, which includes broad rights to be informed. Additionally, since guardians may need to act on behalf of minors in civil matters at necessary times, they also need to have broad decision-making authority. Therefore, based on this guardianship relationship, guardians still have the legal right to access the privacy and sensitive information contained in minors' personal information. This includes identifiable information such as images, biometric data, chat records, geographic locations, and other social activity data used by minors on social networking platforms, to identify and prevent third parties from violating their legal obligations to protect minors' personal information. Inevitably, the exercise of the right to know about minors' personal information must be mindful of the collision with minors' personal growth space. The exercise of the right to know by guardians should serve the protection of minors' rights, promote their better and healthier development, and help them make more reasonable choices. When obtaining minors' personal information, guardians should strive for sufficient communication beforehand and avoid using improper means such as violence, deception, or theft.
 

After the introduction of the "Regulations on the Protection of Children's Personal Information on the Internet" in 2019, major domestic online platforms have set up clauses regarding "minor information." However, upon closer observation of several representative online platforms, such as Baidu and Douyin, they only vaguely stipulate that the information of minors may require guardian consent, but do not specify the age at which minors need special protection. At the same time, this consent system seems to be a mere formality, as it is unclear how to obtain guardian consent, lacking more operational regulations. If it merely requires guardians to read relevant clauses, if they do not agree to the relevant clauses of the "privacy policy," services will be terminated. However, in practice, this system has already collected minors' personal information before obtaining guardian consent, which is essentially a post-notification. Once minors' personal information is recorded online, it is very difficult to completely erase it. Therefore, whether the guardian consent system can continue to be applicable is still a topic worth discussing in academia.
 

Before the promulgation of the "General Principles of Civil Law," there was a lack of relevant legislation on personal information in our country. During the period of the "General Principles of Civil Law," only general provisions on personal information protection were made, which were merely declarative clauses. It was difficult to implement them in judicial practice. The "Cybersecurity Law" passed in 2016 provided protection for personal information from the perspective of cybersecurity. In the era of the "Civil Code," while inheriting the declarative provisions of Article 111 of the "General Principles of Civil Law" on personal information protection, it also basically absorbed relevant content from the "Cybersecurity Law" and placed it within the chapter on personality rights. At the same time, privacy rights, as a specific personality right, are listed alongside personal information protection in a chapter on personality rights. This has led to an intersection of the structure of personal information and privacy rights.
 

A close reading of Article 1032 of the "Civil Code" reveals a more detailed classification of personal information, where personal private information belongs to both personal information and personal privacy. Article 1033 explicitly states that handling others' private information constitutes an infringement of others' privacy rights. The provisions of these two articles create a content intersection between personal information and personal privacy.

Another manifestation is the intersection in the application of rules. Article 1034 of the "Civil Code" establishes the priority of applying privacy rights.

In judicial practice, there has also been an intersection in the case causes. In order to adapt to the formulation of the Civil Code, the Supreme Court issued a revised "Provisions on the Causes of Civil Cases," changing the previous third-level cause of action from "privacy rights disputes" to "privacy rights and personal information protection disputes."

Thus, a relationship has formed where personal information protection and privacy rights protection intersect in structure, content, application rules, and causes. With the introduction of the "Personal Information Protection Law," although the definition of personal information is clearly defined in Article 4, this intersectional relationship remains unchanged. For plaintiffs, it is often difficult to determine which cause of action to choose, leading them to often file lawsuits for both privacy rights and personal information protection, which are then judged by the people's court.

Our country classifies minors' personal information as private personal information, based on the following value considerations:
 

1. The Constitution of our country clearly stipulates the protection of citizens' personal and property rights.

The special protection of minors' personal information reflects a people-centered legal philosophy, in line with the requirements of the Constitution. Respecting the civil subject status of minors and their basic rights under the law is also a reflection of the special protection of minors' dignity in our civil law.

2. From the perspective of social public interest, the healthy development of minors' physical and mental well-being is an inevitable choice under various special protection policies. Enhancing the safety and stability of the online environment can maximize the protection of their legitimate rights and interests, reflecting a people-centered social governance philosophy.

3. Regulating market order and maintaining market value.

The industrial transaction order of minors' personal information is maintained, making its usage standards transparent. This maintains the market value created by the legal use of minors' personal information by information practitioners. The importance of protecting minors' personal information is self-evident, and their basic rights and healthy personality development should be maximally guaranteed, protecting their personal privacy from infringement and their personal information rights from violation. On this basis, there is also a need for limited and reasonable development of the market value of minors' personal information, exploring the beneficial factors within it. At the same time, it promotes the development of our information industry and maintains social public interests.

Considering the three aspects of value interests, our country's personal information protection legislation should treat minors' personal information as private information and provide more special and stringent protection.

In recent years, our country has accelerated the legislative pace regarding the protection of minors' personal information rights. Collectors and users of information, as well as users who publish and obtain information, can find regulations within the existing legal framework.
 

1. Strict protection: Minors' personal information is considered sensitive information.

The "Civil Code" stipulates the intersection between personal information and privacy rights. Personal information is divided into personal sensitive information and general personal information: the former falls under the category of personal privacy, and if a network platform unlawfully collects, processes, or uses personal sensitive information, it will infringe upon the privacy rights of the information subject, and the law imposes strict regulations on it; the latter has lower sensitivity and identifiability, allowing network platforms to collect, process, and use it legally and compliantly, thus meeting the needs of sustainable development of information in the online society. After the introduction of the "Personal Information Protection Law," further regulations have been established for personal sensitive information and general personal information. From the relevant legislation, it can also be seen that the legal characterization of minors' personal information is as personal sensitive information, which is subject to strict protection.
 

Minors' personal information has a high degree of privacy and sensitivity. When information processors on network platforms obtain minors' personal information through contracts or other means, they must fully respect and protect the legitimate interests of minors as a special subject, safeguarding their physical and mental health development. The rules for processing ordinary user information cannot be directly applied; more detailed distinctions must be made. For example, for minor internet users, one cannot directly profile them based on their personal information, and certain content on the internet cannot be opened to minors without restrictions. There must be strict control over the advertisements, links, etc., that are pushed to them. If minors' personal information is treated the same as that of ordinary users, it may lead to immeasurable losses to the rights and interests of this special subject. In judicial practice, cases of online infringement of minors' personal information show issues such as dispersed infringing subjects, difficulties in evidence collection, and vague legal causation. Therefore, it is necessary to strictly control the entry of minors' personal information into network platforms, categorizing it uniformly as sensitive personal information under the law and protecting it strictly.

2. Parental protection: Informed consent mechanism for guardians or parents.

The informed consent mechanism for guardians or parents is developed based on privacy control theory and theories of parental rights and guardianship. In early 2017, Article 16 of the "Regulations on the Protection of Minors in Cyberspace (Draft for Review)" clearly stated that the use of minors' personal information should obtain the consent of the minors or their guardians. At this time, consent could be obtained from either the minors or the guardians. As the protection of minors' personal information has been further strengthened, the conditions have become stricter. For example, in August 2019, Article 9 of the "Regulations on the Protection of Children's Personal Information in Cyberspace" clearly stipulated that network operators collecting and using children's personal information must inform the guardians in a prominent and clear manner and obtain their consent. However, the informed consent mechanism for guardians has some issues. For instance, the relevant laws in our country adopt an age-based classification, treating minors differently. For collecting personal information from minors aged 14 and above, consent can be obtained from either the minors themselves or their guardians; for minors under 14, consent from the guardians must be obtained before collecting and using their personal information.
 

The informed consent mechanism for parents or guardians faces some practical difficulties. First, the feasibility and rationality of merely using age classification have been questioned by scholars. Moreover, in actual network platforms, very few truly use 14 years as a dividing line; for example, WeChat's privacy policy explicitly restricts the collection of personal information from minors under 16. Secondly, the informed consent mechanism for parents or guardians can only serve as a prompt protection before network platforms use minors' personal information. Many network apps merely state this in their privacy policies, lacking actual technical protection. For instance, during the registration process of a network app, although the privacy policy states clear regulations, there are no specific technical restrictions on the registration of minors' personal information. Finally, even if informed consent is genuinely obtained from minors and their guardians, it is difficult to predict how their personal information might be misused. Users and information processors are in an unequal position, and legislation has focused too much on consent before collecting minors' personal information, neglecting the consequences of misuse after a blanket authorization.

3. Educator protection: Clarifying the right to know and the obligation to protect minors' personal information.

In addition to the family, schools and other educational institutions are also major living places for minors. The Constitution of our country stipulates that minors have the right and obligation to receive education. Therefore, the protection of educators is also an important part of protecting minors' personal information. Our educational legislation lacks provisions regarding the scope and methods by which educators can obtain minors' personal information. Especially with the use of new educational devices, the methods and scope of how educators collect minors' personal information should receive greater attention. Issues such as obtaining minors' private life through surveillance, whether "face recognition" attendance methods infringe on minors' personal information, and the issue of publicly displaying minors' academic rankings along with their personal information online need to be addressed. The "Family Educational Rights and Privacy Act" in the United States regulates how educators can obtain, collect, use, and process minors' personal information. In public schools, except for statutory circumstances, the disclosure of student information requires the consent of the guardians. Our country also needs to further clarify the obligations of educators to protect minors' personal information.
 

1. United States: Specialized legislation for the protection of minors' personal information.

The United States has long enacted a series of laws regarding the protection of minors' personal information. At the federal level, the "Family Educational Rights and Privacy Act" (FERPA), the "Children’s Online Privacy Protection Act" (COPPA), and supporting rules issued by the Federal Trade Commission have been enacted. Congress has also introduced a series of regulations, including the "Student Privacy Protection Act" (SPPA), which requires companies to obtain parental consent before collecting information from minors under 18 for marketing purposes. In 2015, Congress continued to enact the "Student Digital Privacy and Parental Rights Act" (SDPPRA).

2. Europe: Principles for the processing of minors' personal information.

In 2011, Europe proposed recommendations for the protection of minors from online risks. The "General Data Protection Regulation" (GDPR) enacted in May 2018 made principled provisions for the processing of minors' personal information, namely the principle of prior informed consent. However, the principled provisions made in the GDPR have not yet effectively played a regulatory role in specific disputes involving the infringement of minors' personal information on network platforms.

1. Guardians: Improving the informed consent mechanism for guardians.

The previous text mentioned the dilemma of the guardian's informed consent mechanism. To improve this mechanism, a "contextual differentiation" can be made at the legal mechanism level, which means applying the principle of guardian informed consent differently based on specific scenarios. For example, in health scenarios, medical apps need to adjust the application of the guardian informed consent mechanism for minors with different needs. For minors with treatment needs, the application of guardian informed consent can be mandatory, but for minors seeking consultation, enforcing guardian consent may hinder timely communication between minors and professional medical personnel, which may not necessarily protect the legal rights of minors. In such cases, the application of the guardian informed consent mechanism can be relaxed. This means that the guardian informed consent mechanism is not the only standard for protecting minors' personal information, nor is it the only approach; it should be differentiated as a service means based on context.

Additionally, the age definition of minors in the guardian informed consent mechanism should not be a one-size-fits-all regulation; different regulations should be made based on the nature of the online platform.

2. Online Platforms: Requirements for Active Disclosure and Modification, Deletion Prompts for Information Storage and Use

Online platforms and internet users are in an unequal position regarding information processing, especially when it comes to minors as a special group. Due to characteristics such as lower mental maturity, lower discernment ability, and insufficient knowledge reserves, minors cannot predict how online information processors will use their personal information when authorizing it. At this point, online platforms need to increase their obligation for transparent processing.

First, online platforms should actively disclose the storage and use of minors' personal information. Currently, the disclosure of regulations regarding the storage and use of personal information by online apps is often lumped together in privacy policies. Some apps do not actively prompt users, and even if they do, users have no option but to click "agree" to continue using the software. Moreover, privacy terms are generally formatted based on existing laws and regulations. To further strengthen the disclosure of minors' personal information storage and use by online platforms, I believe that periodic announcements can be made, such as updating disclosure announcements every three months; in terms of format, a separate section for minors' personal information can be established, independent of the privacy terms.

Secondly, there should be increased requirements for prompts regarding the modification and deletion of personal information aimed at minors. China's Personal Information Protection Law stipulates the right to delete personal information, but its practical application is still quite difficult. This requires enhancing the technical requirements for online platforms to effectively implement measures for modifying and deleting personal information.

3. Legal Mechanism: Establish Specialized and Detailed Legislation

Although our country has successively introduced legislation on personal information protection, the pace of legislation for the protection of minors' personal information is also accelerating. However, future legislative work needs to focus on specialization and detailed approaches. For example, industry norms can be established for the review process of privacy protection and information security for minors in online apps, and graded handling of online platform abuse of minors' personal information can be implemented; different punitive norms can be established for different infringement behaviors; a certification system for minors' personal information security can be established; and a mechanism for accountability for major safety incidents involving minors' personal information can be constructed, among others. All these ideas require advancing the legislation for the protection of minors' personal information towards specialization and detailed approaches, necessitating coordination among various legal departments and supporting measures such as judicial interpretations and local regulations.