- Enact specific, dedicated Online Child Protection Act
- Obtain parental consent for data collection from minors and processing personal data
- Put in place age verification mechanisms for accessing certain online services
Although Sri Lanka has made some progress with general child protection laws and with the activities of the National Child Protection Authority (NCPA), the law and the relevant regulations targeting online threats and privacy remain a significant gap. To fill its regulatory lapses, Sri Lanka must contemplate coming up with special legislation, review the current legislation, improve digital literacy initiatives and collaborate with international agencies to establish a secure internet space in which children can explore the internet.
These concerns were raised and recommendations were made in an article on "Safeguarding children’s rights in the digital age: A comparative study of Sri Lanka, the EU, and the US" which was authored by A Bopagamge, and published in the Sri Lanka Journal of Development Administration.
EU legislative developments
The EU has developed comprehensive legal frameworks to address the challenges and risks faced by children in the digital environment. These frameworks aim to strike a balance between protecting children’s rights and enabling their access to digital opportunities. The EU’s approach is grounded in various legislative instruments, strategies, and policy initiatives that safeguard children from online risks, ensure their privacy, and promote digital literacy.
General Data Protection Regulation (GDPR)
The General Data Protection Regulation (GDPR) which came into effect is one of the most significant legislative measures for protecting the privacy and personal data of individuals, including children. The GDPR explicitly recognises the need for enhanced protection for children, especially in the digital world. It establishes specific provisions that focus on the rights of children, including the following: Article 8 - Conditions Applicable to a Child's Consent in Relation to Information Society Services (Requires that for children under the age of 16, consent for processing their personal data must be obtained from their parent or guardian. Member States have the flexibility to lower this age limit to 13, but, the emphasis remains on protecting younger users); and the Right to Erasure (Article 17) - The ‘right to be forgotten’, allows individuals, including children, to request the deletion of their personal data when it is no longer needed for the purpose for which it was collected. This is especially important for children who may have posted or shared information online without fully understanding the implications.
The GDPR's focus on consent and data protection reflects the EU’s commitment to safeguarding children’s privacy online and ensuring that their personal information is not exploited by digital services (Article 17).
Audiovisual Media Services Directive (AVMSD)
The Audiovisual Media Services Directive (AVMSD) is another critical legal instrument in the EU aimed at protecting minors from harmful content in the digital media. Revised in 2018, the AVMSD sets out rules for both traditional broadcasting and video-on-demand services, including online platforms like YouTube and streaming services. Key provisions related to children include: the requirement that content likely to impair the physical, mental, or moral development of minors be restricted and that parents or guardians have tools to control children’s access to such content (Article 6a); and places responsibilities on video-sharing platforms to ensure that minors are protected from harmful content and to prevent the promotion of hate speech, violence, and child exploitation on their services (Article 28b).
The AVMSD helps establish a safer online environment by obligating digital platforms to implement measures that prevent children from accessing harmful material, thereby addressing issues like online harassment and exposure to inappropriate content (Article 28b).
EU Strategy for a Better Internet for Kids (BIK+)
The EU Strategy for a Better Internet for Kids (BIK+), updated in 2022, is a comprehensive policy initiative designed to create a safer online environment for children. The Strategy focuses on four main areas: Encouraging the creation of high-quality, age-appropriate content that supports the positive development of children; Promoting digital literacy among children, parents, and educators to ensure that children can navigate online spaces safely and critically; Enhancing measures to combat cyberbullying, child sexual abuse material, and other online risks, while also supporting mechanisms for reporting and removing harmful content; and Empowering children to have a voice in shaping online spaces and policies that affect them, ensuring that their views are considered in the development of safer online environments.
The BIK+ Strategy is significant in providing a holistic approach to child protection in the digital age, complementing legal measures with educational and awareness-raising initiatives.
The European Parliament’s Resolution on Children’s Rights in the Digital Environment
In 2021, the European Parliament adopted a Resolution on Children’s Rights in the Digital Environment, which recognises the need for a balanced approach that respects children’s rights while ensuring their safety. It highlights several recommendations, including: Recommending that digital service providers adopt stronger measures to protect children’s data and ensure transparency in data processing activities; Calling for enhanced efforts to address cyberbullying, online harassment, and other forms of violence against children online; and Emphasising the importance of digital literacy and online safety education in empowering children to use technology safely and responsibly.
This Resolution reflects the EU’s ongoing commitment to adapting its legal and policy frameworks to the evolving challenges of the digital age, recognising the critical importance of children’s rights in this context.
The EU’s legal framework for safeguarding children's rights in the digital age is built on a combination of binding Regulations like the GDPR and the AVMSD, as well as policy initiatives like the BIK+ Strategy. These frameworks collectively address key aspects of child protection, including privacy, safety, and digital literacy. By continuously adapting its legislative and policy measures, the EU seeks to provide a balanced environment where children can benefit from digital opportunities while being protected from online risks. This serves as a model for other jurisdictions, including Sri Lanka, which can draw on the EU’s experience to enhance its own digital child protection mechanisms.
The USA's legislative developments
The USA has developed a complex legal framework to address the unique challenges faced by children in the digital environment. This framework includes Federal laws, State regulations, and guidelines that seek to protect children’s privacy, ensure their safety, and regulate their interactions with online content. The emphasis is on balancing the protection of children with the preservation of their access to online educational and social resources.
Children’s Online Privacy Protection Act (COPPA)
The Children's Online Privacy Protection Act (COPPA) is one of the most critical pieces of Federal legislation aimed at protecting children’s privacy online. The COPPA is designed to regulate the collection, use, and disclosure of personal information from children under the age of 13 by websites and online services. According to the COPPA, websites and online services that collect personal information from children under 13 must obtain verifiable parental consent before collecting such data. This includes information such as a child’s name, address, and contact information (15 USC § 6502(b)(1)(A)). Operators are required to provide a clear and comprehensive privacy policy that details their data collection practices and must notify parents directly about how they collect and use children’s information (15 USC § 6502(b)(1)(A)(i)). Also, parents have the right to request the deletion of their child’s personal information from a website's database (15 USC § 6502(b)(1)(B)).
The COPPA is enforced by the Federal Trade Commission (FTC), which can impose penalties for non-compliance. The Act is significant because it sets clear standards for privacy protection in online spaces frequented by children (Children’s Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business). However, some critics argue that the Law has limitations, such as its focus on children under 13, leaving older minors with less protection (P.M. Regan's "Legislating privacy: Technology, social values, and public policy").
Children’s Internet Protection Act (CIPA)
The Children's Internet Protection Act (CIPA) is another crucial Federal law aimed at protecting children from harmful online content. The CIPA requires that schools and libraries that receive Federal funding for internet access or internal connections implement measures to block or filter internet content that is obscene, child pornography, or harmful to minors (47 USC § 254 (2000)). Key components of the CIPA include that schools and libraries must use technology protection measures to block access to visual depictions that are obscene or harmful to minors (47 USC § 254(h)(5)(C)) and the CIPA also mandates that schools and libraries develop and adopt internet safety policies to monitor minors' online activities and educate students about appropriate online behaviour (47 USC § 254(h)(5)(C)).
The CIPA focuses primarily on protecting children from harmful content in educational settings, ensuring that they have a safer browsing experience. While it has been effective in schools and libraries, critics argue that the scope of the CIPA is limited as it does not extend to all online environments that children access.
State-level regulations and initiatives
In addition to Federal laws, individual States have enacted legislation to further safeguard children in digital spaces. Some States have implemented more stringent privacy laws that extend protections to minors beyond what is provided under the COPPA. Examples include: the California Consumer Privacy Act (CCPA) - While not exclusively for children, the CCPA provides enhanced privacy rights for California residents, including minors (Cal Civ Code § 1798.100). It requires businesses to provide a clear notice to consumers about data collection practices and offers individuals the right to access, delete, and opt-out of the sale of their personal information; and the California Age-Appropriate Design Code Act (CAADCA) - Aims to create a safer digital environment for children by requiring online platforms to prioritise the privacy and safety of users under 18. The CAADCA focuses on designing online services that take into account children's best interests (AB 2273).
These State-level initiatives complement Federal efforts and reflect a growing recognition of the need to adapt privacy and safety measures to the changing digital landscape.
The legal framework of the USA for protecting children in the digital age encompasses a blend of Federal laws like the COPPA and the CIPA. These frameworks aim to address the diverse risks that children face online, from privacy violations to exposure to harmful content and exploitation. While these efforts have made significant strides in enhancing child safety online, challenges remain in adapting laws to evolving digital threats and ensuring uniform protection across all States. The experience of the USA highlights the importance of continuous legislative adaptation and coordinated policy efforts to safeguard children’s rights in an increasingly digital world.
Recommendations for SL
Enact specific legislation for online child protection
Sri Lanka has taken initial steps to protect children from online risks through its existing legal and policy frameworks, but, significant gaps remain in adapting to the challenges of the digital age. Sri Lanka can develop a more robust system for safeguarding children’s rights in digital spaces.
Strengthen data protection for children
Develop a comprehensive Data Protection Act that specifically addresses children’s data privacy and which can ensure that online services are held accountable for how they handle minors’ data.
Improve the institutional capacity and enforcement mechanisms
The NCPA can be empowered with a dedicated unit focused on online safety and digital child protection. This unit could work in collaboration with law enforcement and the Telecommunications Regulatory Commission and the Computer Emergency Readiness Team to monitor online activities that pose risks to children.
Integrate online safety into the National Policy on Child Protection
The current National Policy on Child Protection should be revised to explicitly include measures for protecting children from online violence and digital threats. This would align Sri Lanka’s Policy framework with international standards. Including specific goals related to online safety in the Policy would ensure that resources are allocated for implementation, monitoring, and continuous improvement.
Implementing these recommendations will require legislative reforms, capacity building, and active collaboration with international partners. A comprehensive and adaptive approach will help create a safer digital environment for Sri Lankan children, allowing them to fully benefit from the opportunities of the digital age while minimising potential risks.
Conclusion
The protection of children in digital environments is a growing concern in the modern world of fast-paced digital models. The EU and the USA, on the other hand, offer examples with particular regulations such as the GDPR and the COPPA which deal with the specific exposures that children face in the digital space. Such models prioritise data protection, online privacy and digital literacy, and are useful examples that Sri Lanka can learn from. By adapting best practices from global examples to local needs, Sri Lanka can build a comprehensive framework that ensures that children can safely engage with the digital world, benefiting from its opportunities while being protected from its risks.