Dissecting the commercial profiling of children: A proposed taxonomy and assessment of the GDPR, UCPD, DSA and AI Act in light of the precautionary principle

Abstract

Over a decade after the Article 29 Working Party first stated that data controllers should refrain from the processing of children’s data for the purpose of behavioural advertising, children are still profiled at scale for commercial purposes, including behavioural advertising. The United Nations Convention on the Rights of the Child (‘UNCRC’) Committee urges States parties to prohibit profiling children for commercial purposes, as the practice is associated with a panoply of potential children’s rights violations and may cause children significant harm. Yet little scholarship is devoted to seeking granularity in defining what “profiling for commercial purposes” entails. The present article seeks to fill this gap and presents a new taxonomy of the various manifestations in which the commercial profiling of children occurs. This is followed by a children’s rights-based assessment of the six distinguishable manifestations of children’s commercial profiling, highlighting the importance of nuance in the academic and regulatory discourse on the subject. Whereas profiling children to directly monetise their personal data interferes with several children’s rights and likely causes children significant harm (although full scientific evidence thereupon is still lacking), in certain use cases profiling children for indirect commercial purposes may contribute to the exercise of their rights and wellbeing. The article subsequently assesses the EU regulatory framework governing the various manifestations of children’s commercial profiling through the prism of the precautionary principle, a general principle of EU law that justifies the regulation of a practice in the face of scientific uncertainty on the (long-term) harm it may cause. In the field of children’s rights, a strong precautionary approach is the norm, mandating the prohibition of practices that pose (unacceptable levels of) risk to children. The analysis dissects the relevant provisions in the General Data Protection Regulation (‘GDPR’), the Unfair Commercial Practices Directive (‘UCPD’), the Digital Services Act (‘DSA’) and Artificial Intelligence Act (‘AI Act’), to conclude that primarily, yet merely in theory, the GDPR is adequately equipped to uphold children’s rights in this regard, as the fairness and transparency principles that are cornerstones to the GDPR do not allow for the processing of children’s data in the context of the vast majority of children’s commercial profiling practices that remain omnipresent to date.