How the data is gathered¶

The surfaces through which a child’s data leaves them are mostly ordinary and mostly invisible. None of them looks like an attack. That is what makes the collection so complete.

Apps and games¶

The everyday surface. Games and apps aimed at children frequently carry advertising and analytics code that reports back usage, identifiers, and sometimes location, in the same way adult apps do. In-game chat is a surface of its own, a place where contact happens and where what a child says is logged. Free games are rarely free of this; the price is often the data.

Where older children spend their attention and leave the richest trail: posts, messages, viewing history, and the connections that map their social world. Age limits are widely worked around, so younger children are often present under an adult’s stated age, outside whatever child-specific protections exist.

Smart toys and wearables¶

Microphones, cameras, and location sensors reach into the nursery and onto the wrist. A talking toy, a child’s smartwatch marketed for safety, or a home assistant a child speaks to all route data to a cloud account, and their security record as a category has been poor. The youngest children are exposed here, by devices they cannot understand.

School devices and monitoring¶

The education surface. School-issued laptops and tablets, learning platforms, and classroom-management and safety software observe a substantial share of a child’s day, sometimes including what they type, search, and open, with flagging to staff. Because it runs on the infrastructure of schooling, a child and often a parent cannot decline it.

The surface inside the home. Family-sharing arrangements, location sharing, and parental-control apps give an adult visibility into a child’s device, messages, and whereabouts. Used with care and openness it is protective. It is also, technically, the same visibility an abuser seeks, which is why these tools sit at the centre of the stalkerware check playbook.

Images posted by others¶

The surface a child does not control at all. Photographs shared by parents, relatives, schools, and clubs, often with names, places, and dates attached, build a public record from outside the child. The photos runbook covers the metadata riding inside those images, which can give away a home or a school even when the caption does not.

Age checks themselves¶

The newest surface, and an ironic one. Verifying that a user is old enough, now required of many services, often means collecting identity: a face scan, a document, a card. A measure meant to protect children can attach a verified identity to a child’s activity, becoming a collection point in its own right.

Last reviewed: 2026-07-08.