Ashlin Perumall, Senior Associate, Corporate/M&A, Baker McKenzie Johannesburg.

Many of us are now well-adapted to the ‘new normal’ of global Covid-19 lockdowns, which has abruptly changed our perspectives on just about everything, including the role of technology in our lives. Before the lockdown, many saw the tech industry as one needing taming, but within the space of a few weeks, the role of connectivity, social-media and digital transformation has once again made an about-turn. Whereas mobile phones, tablets, gaming consoles and other connected gadgets may once have been the bane of parents lives, they now appear to be as a useful way of distracting the little ones in the endless tedium that is quarantine.

So changed is the world, that it is easy to forget that some risks remain and are perhaps enhanced with the sudden spike in user-attention on digital devices, waiting to be mined. A particular area that will attract such attention once this is all over is digital marketing, and of particular note: digital marketing to children and how their privacy rights should be protected.

A crucial area of concern in contemporary digital marketing is what legal and policy framework guides digital advertising in respect of the rights of children who are exposed to it. Child exposure to digital marketing is growing and mobile device proliferation amongst children and adolescents is high. There is little need to highlight how Covid-19 lockdowns are catalytic in this regard.

Children also have greater exposure to influencer marketing tactics and branded environments such as is prevalent in video games (particularly ‘advergames’ - those designed to promote a product or service).

However, despite the heightened exposure, the responsibility threshold for marketing organizations in respect of children is currently over-simplistic. Parental consent and age-gates are treated as the primary tools for age verification. Further scrutiny is needed as to whether these solutions technically and socially solve the problem in real world scenarios, or whether alternatives are needed. The tired paradox of confirming you are not a minor, whilst not having the capacity to confirm you are not a minor, needs no further explanation.

In Europe, some effort has already been made towards correcting this in respect of data protection. The General Data Protection Regulations (GDPR) provide for special conditions in respect of obtaining consent, with consent of children younger than 16 years requiring parental authorisation (this age can be lowered by member states to no less than 13 years). Also included in the GDPR is an obligation to ensure communication with children is transparent and in plain language, as well further miscellaneous provisions for the provision of helplines, awareness and participation in establishing codes of conduct and special rules in respect of the profiling of children.

In South Africa, the Protection of Personal Information Act, 2013 (POPIA), which was enacted in 2013, is expected to be implemented soon. POPIA will bring South Africa in line with international data protection laws by regulating the processing of the information of natural and juristic persons and placing more onerous obligations on responsible parties that process such information in South Africa. The privacy rights of children are closely guarded in POPIA and consent to contact them must be given by a competent adult. The Act defines a child as a natural person under 18 who is not legally competent to take any action or decision in respect of any matter concerning him or herself, without the assistance of a competent person. There Is a general prohibition with respect to the processing of personal data of children in the Act, with a few exceptions.

However, outside of data protection law, there are few common standards in respect of how modern digital advertising (such as programmatic advertising) should operate in respect of children. It has been argued that children are less likely to appreciate or understand the complex commercial intent behind modern advertising, with the harm such influence has on children being severe, for example through negatively influencing children’s dietary concerns, the sexualisation of children, and via creating or reinforcing stereotypes or radicalisation.

The overall structural framework for digital advertising requires assessment in the context of the rights of children. A policy framework needs to be developed that clearly identifies industry roles and responsibilities in respect of children’s rights regarding digital advertising, such as initiatives undertaken by UNICEF and the World Health Organisation.

Further, alternate age verification technologies need to be explored to prevent the ‘minimum age threshold compliance’ becoming a safe haven. Such solutions could include devices and browsers provided to children having been enabled to issue anonymised flags to programmatic systems, which systems can be architecturally designed to limit certain kinds of advertisement to such devices or browsers.

Instead of waiting for regulatory intervention, it would be in the best interests of organisations involved in digital marketing to begin establishing internal ethical policies and guidelines when targeting children in digital marketing campaigns, so as to ensure that new digital marketing technologies protect them, by design.