Child AI Product Privacy Checklist

Companion to is this AI product safe for my child’s data? A privacy checklist. Run this for any new AI-powered product before a child uses it, and re-check when its terms change.

Product name: ____________________________ Date checked: ____________________

The seven points

1. Age rules

• Stated minimum age: ____________________
• Parental-consent mechanism exists for younger children? Yes / No / Not stated
• Intended use: adult operates own account / child holds own account / school-managed account
• Does the intended use follow the provider’s account and credential rules? Yes / No / Unclear

2. Collection

• Beyond text, does it request: Voice ☐ Camera ☐ Contacts ☐ Location ☐ Other: __________
• Do the permissions match the stated purpose? Yes / No

3. Retention

• Stated retention period: ____________________
• Concrete number given, or vague “as long as necessary”? Concrete / Vague

4. Training and other secondary uses

• Is a child’s input used to train/improve the model? Yes / No / Not stated
• Can this be turned off? Yes / No / Not applicable
• Separate answers for profiling, personalization, engagement measurement and advertising:

  ---

5. Sharing

• Are specific third-party recipients named? Yes / No
• If yes, list them: ____________________________________________

6. Controls

• Can the child or responsible adult see, export, correct, restrict or delete stored data? Record each capability separately: ____________________________________________
• Does a linked/parent account see actual conversation content, or only settings and alerts?

  ---

7. Deletion

• Can data be deleted on request, before account closure? Yes / No
• Tested only with fictional or non-personal data? Yes / No / Not tested
• Backup, legal-retention, de-identification or model-development limits stated:

  ---

Review outcome — not a safety verdict

• Unresolved — one or more answers are missing, vague, untested or inconsistent with the child’s age, the intended use, school policy, consent, or applicable law. Do not treat silence as permission.
• Escalate for responsible-adult review — record the unresolved collection, retention, sharing, deletion, age, security, accessibility or safeguarding questions here: ____________________________________________
• Decline or pause this use — the responsible adult, school or qualified reviewer determined that the intended use is not appropriate, or the required controls cannot be established.

This checklist cannot issue an “allow” verdict. A deletion limitation is important, but no universal point count or single field determines legal compliance or child safety across products and jurisdictions.

For Estonia, the age-13 consent threshold for consent-based information-society services does not override a provider’s higher age limit, establish another lawful basis or certify the product as safe.

Reminder

• This checklist does not assess emotional appropriateness or companion-style attachment risk — see do not give a child an AI friend for that separate check.
• Re-run this checklist when the product updates its terms, not just once at install.
• Record the exact product, plan, account type, settings, policy version and intended use; controls can differ between consumer, school and enterprise configurations.

Log across products