Digital Literacy and Personal Data Protection in Childhood: Practices, Perceptions and Knowledge in Brand-Mediated Digital Contexts

Alfabetización digital y protección de datos personales en la infancia: prácticas, percepciones y conocimientos en contextos digitales mediados por marcas

Alfabetização digital e privacidade de dados na infância: compreensão das práticas, percepções e conhecimentos em ambientes digitais mediados por marcas

Paula Neira-Placer^1*
Beatriz Feijoo^2**
Erika Fernández-Gómez^3***

¹ Xunta de Galicia, Santiago de Compostela, Spain
² Villanueva University, Madrid, Spain
³ University of La Rioja, La Rioja, Spain
^* Lecturer at Xunta de Galicia, Santiago de Compostela, Spain. Email: paula.neira.placer@xunta.gal
^** Associate Professor at Villanueva University, Madrid, Spain. Email: beatriz.feijoo@villanueva.edu
^*** Associate Professor at International University of La Rioja, La Rioja, Spain. Email: erika.fernandez@unir.net

Abstract

Purpose: This study investigates the data-sharing practices of children aged 10 to 14 in Spain during their interactions with brands in online environments. It specifically examines digital literacy on data protection, sharing contexts, and factors influencing understanding and management of personal information. Methodology: To this end, a qualitative study was conducted based on 35 semi-structured interviews. Results: Findings show most children are reluctant to share personal information due to distrust. Some practice selective disclosure when they perceive a brand as trustworthy or the request unavoidable. Their understanding of how personal data is used and their awareness of digital rights remain limited. Although participants identify technological, economic, and personal risks, trust tends to increase when brands appear familiar or professionally designed. Promotional content is often met with scepticism. Parental mediation—particularly among girls—often reinforces control through fear-based messaging. Conclusion: Risk perception shapes children’s data management strategies, but fear-based educational models may limit their autonomy.

Keywords
Children; Data collection; Data protection; Digital literacy; Brand strategies; Parental influence.

Resumen

Propósito: El objetivo principal de esta investigación es analizar las prácticas de cesión de datos personales por parte de menores de entre 10 y 14 años en España en su interacción con marcas en entornos digitales, así como comprender su nivel de alfabetización digital en relación con la protección de datos, identificando los contextos en los que se produce dicha cesión y los factores que influyen en su comprensión y gestión. Metodología: Con este objetivo, se llevó a cabo un estudio cualitativo basado en 35 entrevistas semiestructuradas. Resultados: Los resultados muestran que la mayoría evita compartir información por desconfianza, aunque algunos lo hacen de forma selectiva si consideran que la marca es fiable o la cesión es imprescindible. Perciben riesgos tecnológicos, económicos y personales, y su conocimiento sobre el uso de datos y los derechos digitales es limitado. La confianza en las marcas aumenta cuando estas son conocidas o visualmente profesionales, mientras que las promociones suelen despertar escepticismo. La mediación parental, especialmente en niñas, refuerza el control y transmite una visión del entorno digital como espacio amenazante. Conclusiones: La percepción de riesgo guía la gestión de datos personales por parte de los menores, pero los modelos educativos basados en el miedo pueden limitar su autonomía.

Palabras clave
Niños y niñas; Recolección de datos; Protección de datos; Alfabetización digital; Estrategias de las marcas; Influencia parental.

Resumo

Propósito: O acesso cotidiano de crianças à Internet normalizou a coleta de dados pessoais por parte das marcas. Nesse contexto, o principal objetivo desta pesquisa é analisar as práticas de compartilhamento de dados pessoais por menores entre 10 e 14 anos na Espanha em sua interação com marcas em ambientes digitais, assim como compreender seu nível de alfabetização digital em relação à proteção de dados, identificando os contextos em que ocorre esse compartilhamento e os fatores que influenciam sua compreensão e gestão. Metodologia: Com esse objetivo, foi realizado um estudo qualitativo baseado em 35 entrevistas semiestruturadas. Os participantes eram estudantes de diferentes comunidades autônomas da Espanha. Resultados: Os resultados mostram que a maioria evita compartilhar informações por desconfiança, embora alguns o façam de forma seletiva quando consideram que a marca é confiável ou o compartilhamento é indispensável. Seu conhecimento sobre o uso dos dados e os direitos é limitado. Percebem riscos tecnológicos, econômicos e pessoais, mas a confiança aumenta quando as marcas são conhecidas ou visualmente profissionais. Promoções geram, com frequência, ceticismo. A mediação parental, especialmente com meninas, reforça o controle. Conclusão: A percepção de risco orienta a gestão dos dados pessoais por parte dos menores, mas modelos educativos baseados no medo podem limitar sua autonomia.

Palavras-chave
Crianças; Coleta de dados; Proteção de dados; Alfabetização digital; Estratégias das marcas; Influência parental.

1. Introduction

Mobile phone and internet access has become nearly universal among adolescents, particularly in Spain, where 99.5% of households report having at least one smartphone (Instituto Nacional de Estadistica, 2024), 70% of children aged 10 to 15 use a mobile phone (Sánchez, 2025).

This routine connectivity has contributed to the normalization of personal data collection, largely driven by the commercial interests of brands. Data is collected both directly—through cookies, registration forms, and proprietary databases—and indirectly, via platforms and search engines that track demographics, interests, and browsing behavior to personalize marketing strategies (Fathoni, 2024). However, such practices raise significant concerns regarding user privacy and data protection (Neira-Placer et al., 2025).

In this context, a growing tension emerges between the development of minors’ digital autonomy and their susceptibility to persuasive commercial narratives. This tension is exacerbated by the pervasive presence of the digital marketplace and the logic of datafication, which transforms virtually every online interaction into exploitable data. These dynamics underscore the urgent need for a form of digital literacy that extends beyond technical skills to include ethical, social, and critical dimensions. Such literacy should empower minors to recognize and navigate the risks associated with personal data use and to engage in digital environments as informed, responsible citizens (Martoni, 2025).

2. Theoretical Framework

2.1. Digital Literacy in Childhood and the Role of Brands

Digital literacy refers to the ability to critically use digital technologies to access, manage, and communicate information, create content, participate in social contexts, and reflect on their personal and collective impact (Avinç & Doğan, 2024). Rocha Estrada et al. (2022) identify seven dimensions of digital literacy: five consolidated and two emerging. The consolidated dimensions include: technological (functional use of devices and logical thinking), informational (search and critical evaluation), communicative (interaction in digital environments), critical or cognitive (ethical reflection), and digital safety (protection of data, identity, and emotional well-being). The emerging dimensions are digital citizenship—understood as responsible participation in online life—and digital emotional intelligence, which focuses on the management of emotions in technological environments. In this regard, literacy in personal data protection constitutes a key component of the security dimension, as it involves the knowledge and practices needed to safeguard personal information (Alauthman et al., 2024).

The effective exercise of digital rights—defined as human and legal rights concerning access to, use of, creation of, and dissemination of content in digital environments, including freedoms of expression and privacy—requires digital literacy as a fundamental prerequisite (Pangrazio & Sefton-Green, 2021). In the absence of such literacy, these rights are difficult to understand or assert, making critical digital education essential for autonomous and safe participation in digital life.

Privacy represents a particularly important dimension of digital literacy for children, especially younger users who are often neglected in this context (Brown et al., 2023). Privacy should be seen as a means of empowerment, enabling children to manage their personal data in today’s digital world (Desimpelaere et al., 2021). Beyond simply providing or protecting personal information, privacy in digital contexts also involves understanding how, why, and under what conditions personal data circulates. This perspective recognizes that privacy is not solely an individual responsibility but also shaped by the design of digital platforms and the institutional and commercial forces that influence them (Livingstone et al., 2021). From their earliest online interactions, minors make decisions about how much information to disclose to both known and unknown parties. However, many general-use digital products and services design fail to account for child users, thereby compromising their safety, privacy, development, and well-being (Pothong et al., 2024).

While children and young people often view the Internet as a space for entertainment, advertisers have long seen it as a prime channel for commercial activity (Brown et al., 2023). The advertising industry employs data intelligence techniques (big data) to track minors’ behavior and deliver personalized messages based on individual profiles (Brown et al., 2023). Companies frequently impose conditions that children are ill-equipped to negotiate: either they consent to data collection or are denied access to services, resulting in an asymmetrical relationship (Li, 2025). In this context, Desimpelaere et al. (2021) argue that fostering privacy literacy among minors could encourage more critical evaluations of such practices by helping them recognize their negative impact on children’s rights.

The presence of brands and platforms in children’s digital environments has triggered growing institutional concern, particularly within the European Union. According to the European Data Protection Board (EDPB, 2022), platforms, applications, video games, and social media not only mediate access to content but also design user interfaces that emotionally manipulate minors, prompting them to disclose personal data and exploiting their limited critical capacities. These practices undermine fundamental principles such as transparency and data protection by design (EDPB, 2022).

In these environments, commercial strategies targeting minors often involve gamification elements, promotions, prize draws, and reward systems (Daems et al., 2019). The EDPB (2022) notes that emotional incentives and playful activities are used to stimulate engagement and encourage personal data disclosure. These tactics intentionally blur the line between entertainment and commercial intent, making it difficult for children to recognize the marketing goals embedded in seemingly recreational content (Fernández-Gómez et al., 2024).

2.2. Personal Data Protection Literacy: A Multidimensional Competence

According to Calzada and Marzal (2013), data literacy is a specific dimension of information literacy that enables individuals to access, interpret, critically evaluate, manage, process, use, and communicate data ethically. The authors stress that this competence should be progressively developed at all educational levels—including school—and continually reinforced throughout life (Calzada and Marzal, 2013), particularly because the general population tends to lack awareness of the extent to which their personal data is collected and how it is used (Deahl, 2014).

In the realm of personal data protection, it is essential to adopt a perspective that recognizes its multidimensional nature. As Livingstone et al. (2019) note, the development of digital privacy awareness and competencies is not a linear or age-dependent process, but one shaped by a combination of cognitive, emotional, and sociocultural factors. This study adopts the ABC model (affect, behavior, cognition) originally proposed by Ostrom (1969) and later revisited by Chi et al. (2018). This model integrates behavioral, cognitive, and attitudinal dimensions, providing a framework for analyzing how these elements interact in minors’ management of privacy and personal data in digital environments.

The behavioral dimension concerns the actions minors take when faced with requests for personal data. Livingstone et al. (2019), in their study of children aged 5 to 17, found that while many are aware of sharing information in interpersonal contexts (e.g., social media or private chats), their understanding is limited when it comes to recognizing commercial strategies aimed at collecting and exploiting their data. As Kim et al. (2025) observe in a study of adolescents aged 13 to 18, data sharing among young people is often driven by a desire for social inclusion and group belonging.

However, data-sharing behaviors tend to vary with age. Desimpelaere et al. (2021) found that older minors are more likely to share less truthful data, suggesting a growing sense of caution. Interestingly, the same study reported that gender does not significantly affect the amount of information shared. Regarding protective behaviors, some adolescents—aware of potential risks—choose to obscure or erase their data (Chi et al., 2018; Livingstone et al., 2019), while others take no protective action, considering such measures unnecessary (Chi et al., 2018).

The cognitive dimension relates to the extent of minors’ understanding of what personal data is, how it is collected and used by companies, and what rights they possess in this regard. Bowler et al. (2017), in a study of American adolescents aged 11 to 18, found that although some minors are aware their data may be used by companies or governments, many fail to link their everyday digital behaviors with the creation of personal profiles or to identify their legal rights.

Research by Desimpelaere et al. (2020, 2021) shows that privacy education—particularly when it explains the types of data collected, their use, and protection strategies—improves both factual and procedural knowledge. Children exposed to this kind of instruction demonstrate greater capacity to apply protective measures in real-life contexts, such as refusing to provide data or altering the information requested. Despite this, the privacy paradox persists: users who are aware of privacy risks and express concern about data protection often still disclose personal information in exchange for digital services (Daems et al., 2019).

The attitudinal dimension refers to the emotional and psychological stance from which minors assess trust and perceive risk in their interactions with brands and platforms. Negative emotions—such as fear or suspicion—often motivate stronger privacy protection behaviors, while overconfidence is linked to inaction or minimal privacy settings (Chi et al., 2018). Conversely, a positive attitude toward a platform, such as a website or online game, tends to increase the likelihood of data disclosure (Daems et al., 2019).

Privacy education also affects this attitudinal component. Children who gained knowledge about data protection expressed lower satisfaction with brand interactions, showed less trust, and generally held a more critical view of brands (Desimpelaere et al., 2020). However, Desimpelaere et al. (2021) later found that perceived fairness can increase willingness to share personal data—particularly when rewards are offered—even among privacy-literate children. Moreover, while minors readily identify interpersonal risks (e.g., parental surveillance, bullying, or exposure by strangers or peers), they often overlook or normalize commercial risks, such as the profiling and monetization of their personal data for advertising purposes (Livingstone et al., 2019), likely due to limited understanding of the economic value of their information.

Parental mediation plays a moderating role in the development of personal data protection literacy, influencing behavioral, cognitive, and attitudinal components. This mediation should not rely solely on restrictive control but should include interpretive and communicative strategies that help parents support their children in understanding digital risks and using their data responsibly (Livingstone & Helsper, 2008; Dedkova & Mýlek, 2023).

To be effective, this mediation must involve reflective dialogue about what they share online and the implications of doing so (Steinberg, 2017). This form of parental mediation appears to have a particular impact on risk perception (Stoilova et al., 2024); however, if focused solely on protection, it may hinder the development of key competencies. However, many parents lack both the necessary knowledge and relevant educational experiences from their own childhoods, making intergenerational transmission of data protection knowledge challenging (Stoilova et al., 2024; Livingstone & Helsper, 2008). In some cases, parents may even contribute to the problem through sharenting, the widespread and sometimes excessive sharing of children’s personal information on social media (Steinberg, 2017).

Parents’ perceptions of risk are also often uneven. Helsper et al. (2024) note that adults tend to overestimate visible risks, such as cyberbullying, while underestimating less visible but equally harmful risks, such as exposure to targeted advertising or silent data collection. Additionally, gender plays a role in the nature of mediation. Recent studies show that girls receive more parental mediation than boys, both in restrictive and active forms, particularly regarding online interactions (Dedkova & Mýlek, 2023). This trend had already been identified by the EU Kids Online project, which surveyed over 25,000 children aged 9 to 16 across 25 European countries, girls receive more parental mediation overall—especially concerning Internet use, safety, restrictions, and monitoring—while boys are more likely to experience technical mediation only (Livingstone et al., 2013).

3. Objectives and Methodology

The primary aim of this study is to examine the practices of personal data disclosure among children aged 10 to 14 in Spain in their interactions with brands in online environments. The study also seeks to assess their level of digital literacy related to data protection, as well as to identify the contexts in which data disclosure occurs and the factors that shape their understanding and management of these practices.

The following research questions were formulated:

(RQ1).What types of personal data do minors in Spain share with brands in digital environments, and in what contexts does this disclosure occur?

(RQ2).What knowledge do minors in Spain have about how brands use their personal data, and what rights do they understand themselves to have?

(RQ3).What attitudes do minors in Spain adopt toward requests for personal data, and how does parental mediation influence these attitudes?

To this end, a qualitative methodology was selected due to its capacity to access young people’s voices and explore their worldviews, lived experiences, and personal judgments in depth (Mayan, 2023). In the field of children’s digital literacy and competencies, qualitative approaches are particularly valuable for understanding the experiences, practices, and meanings that minors associate with digital technologies. As highlighted by Chaudron et al., in a study coordinated by the Joint Research Centre of the European Union (2018), the lack of prior research on young children’s digital media use—along with the methodological challenges of working with children—further supports the relevance of a qualitative approach in this context.

The potential influence of the researcher’s positionality on the relationship with the children and the interpretation of their narratives was acknowledged throughout the process. This study employed a qualitative research design, based on 35 semi-structured interviews with children aged 10 to 14 residing in Spain as shown in Table 1. The sample size (n) was determined based on the point of saturation—that is, the moment when no new categories emerged. This criterion is consistent with approaches adopted in similar studies, such as Sweeney et al. (2021), who also reached saturation with 29 interviews.

Participants were selected from an initial pool of 1,070 minors from various Spanish regions who had taken part in the project’s preliminary quantitative phase. The selection process considered variables such as age, gender, school type, family socioeconomic status and access to digital devices (Supplementary material). Children between the ages of 10 and 14 were chosen because they are generally capable of active and effective participation in verbal exchanges, as noted by Zarouali et al. (2019). This age group is also significant in terms of cognitive development (Wu et al., 2025) and coincides with a notable increase in personal mobile phone ownership, particularly from the age of 10, which further justifies their inclusion in studies related to digital practices (INE, 2024).

All interviews and recordings were carried out with prior consent from parents or legal guardians, obtained through a signed informed consent form that was approved by the Ethics Committee of the [Blinded University]. This committee also validated the methodological design of the study. Families were clearly informed that all collected material would be used exclusively for scientific purposes.

The interviews were conducted between September and December 2023 via the Microsoft Teams platform. A semi-structured interview guide was used to facilitate conversation while allowing flexibility for follow-up questions. Interviewers emphasized that there were no right or wrong answers and that participants would not be judged, in order to foster a relaxed and trusting environment. This approach was essential for establishing open and fluent communication with the minors, facilitating the expression of authentic and spontaneous responses.

The interview guide was designed to address the study’s three research questions. To explore RQ1, participants were asked whether they usually shared personal information—such as their name, address, social media handles, or mobile numbers with brands, and whether this occurred, for instance, in the context of a promotion. Additional questions explored whether the shared information pertained solely to the child or also included details about their household. In relation to RQ2, participants were asked why they thought brands wanted their information and whether they believed it was possible to recover or delete the data they had provided. For RQ3, the questions focused on the reasons why participants chose to share or not share personal data, whether they perceived such actions as dangerous or harmless, and whether they discussed these topics with their parents.

The data analysis followed a systematic approach (Bingham, 2023) as presented in Table 2. To reduce interpretative bias, the interviewers did not take part in the data analysis, allowing for greater critical distance. After transcribing the interviews verbatim, thematic coding was applied based on the study’s objectives, followed by open coding to identify emerging patterns. Thematic clustering was supported by interpretative notes, and the process concluded with theoretical coding, which enabled the extraction of findings linked to the conceptual framework.

4. Results

4.1. Disclosure of Personal Data to Brands and Types of Information Shared (Behavioural Dimension)

From a behavioral perspective on data literacy, these results reveal how minors typically disclose personal information to brands. In response to the question “Do you usually share any personal information such as your name, address, Instagram profiles, phone number… with brands? For example, in a promotion?”, the majority of participants reported that they do not share their data in such contexts (70.58%): “No, not to brands. I tell my friends my Instagram, but no one else” (E6, boy, 13 years old, middle SES).

Some minors demonstrated awareness of privacy issues and a strong sense of control over their personal data, rejecting the idea of disclosure even when faced with commercial incentives. One girl expressed concern about potential exposure: “No way, I never share my info or anything like that. Because anyone could see it or whatever” (E14, girl, 13 years old, low SES). Another participant articulated a critical stance toward how brands use personal data: “No. I’m not selling my data just for stuff. My data is mine, and they’re not going to get it just because they want to lure me in with some prize I’m probably never going to win anyway” (E29, boy, 12 years old, low SES).

It is noteworthy that during the interviews, only one minor spontaneously linked their protective behavior to guidance received from authority figures such as parents: “My mom tells me: ‘Never talk to strangers unless it’s something about the game’” (E2, girl, 11 years old, low SES).

A minority of participants expressed a willingness to share personal data, albeit with conditions (29.41%). Among these, gender distribution appeared balanced. While affirmative responses were found across all age groups, they were most frequent among 13- and 14-year-olds. These participants justified data sharing—particularly of names, phone numbers, and postal addresses—when it was necessary to receive products: “With brands, yeah. Name, surname, and a contact number, just in case no one’s home when the package arrives, so they can call that number, and the address, obviously” (E33, boy, 13 years old, high SES). Some participants reported sharing data such as email addresses in exchange for incentives like discounts or entry into prize draws. For example: “Well, if you give Shein your email and sign up, you get discounts and stuff like that, so I guess that’s fine” (E7, girl, 14 years old, middle SES).

Children’s perception of data sensitivity varied depending on the type of information and the context in which it was requested. Email addresses were generally viewed as less sensitive: “I don’t mind putting my email in a form or whatever” (E7, girl, 14 years old, middle SES). In contrast, phone numbers and postal addresses were considered more sensitive and were typically only disclosed when necessary, such as for product delivery: “When you order clothes or something like that, you have to give your address so they can deliver it” (E15, girl, 14 years old, high SES). Some minors reported only sharing personal information through platforms they had previously used or that had been recommended by peers, reflecting a more selective approach: “On apps I’ve already bought from and I know they’re safe, and my friends told me they are too” (E25, boy, 10 years old, low SES).

In response to the question “Do you share only your own data or also data about your home?”, participants’ answers indicate that minors share a range of personal data, particularly contact information, location, and occasionally financial details. One participant admitted: “The credit card, yeah—my parents’. I don’t know, I’m not really sure what it’s for” (E5, girl, 14 years old, middle SES). This included phone numbers and email addresses, usually shared to receive updates or participate in prize draws:

“Like, at the mall I went to this store and bought this phone case. So I gave them my phone number and my email so they could message me too, because I was going to pick it up on my own, without my parents, you know?” (E16, boy, 12 years old, high SES).

Home addresses were also shared in connection with purchases and deliveries: “If I order a package or whatever and they ask for my address, I think it’s normal, so sometimes I give it” (E7, girl, 14 years old, middle SES).

In some cases, when participating in prize draws or collecting items, minors provided their parents’ contact information. Others chose to use public or business addresses instead of their home address: “Or like addresses of places, public businesses—like, my aunt has a bakery, so they usually put the bakery’s address instead, because, I mean, that’s something you can find on Google anyway. But not my address” (E15, girl, 14 years old, high SES).

4.2. Minors’ Knowledge of the Use of Personal Data and Digital Rights (Cognitive Dimension)

From a conceptual standpoint, data protection literacy involves an understanding of both the purposes for which brands request personal information and the rights associated with the control and deletion of that data. In response to the question “Why do brands want your information?”, a notable number of interviewees—particularly boys—admitted to not knowing the exact reason (21.21%): “I don’t really know, to be honest” (E17, boy, 11 years old, high SES).

Nonetheless, the majority of participants suggested that brands collect information primarily for commercial purposes (42.42%), such as advertising: “For example, you put in your email and they can send you ads by email” (E19, boy, 10 years old, low SES), or for market research: “Maybe if it was for a study or something like that, they’d want to know my age or my gender or whatever” (E7, girl, 14 years old, middle SES). Several participants also noted that personal data might be used for logistical management and product delivery (18.18%): “Well, so they can make the delivery” (E12, girl, 12 years old, middle SES).

Interestingly, a few participants speculated about potential misuse of data, including illegal activities (15.15%). One boy remarked: “So they can hack your phone and you end up with nothing” (E10, boy, 13 years old, low SES). Others assumed that brands might need the data simply to contact promotion winners, without elaborating further (3%).

Regarding digital rights, a large majority of the participants—both girls and boys—believed that once personal data is shared, it cannot be retrieved or deleted (68.75%). This reflects a limited understanding of data portability and deletion rights. One participant articulated this concern clearly: “I don’t think it’s easy, because you’ve sent your data to that platform and they’re not going to let you get it back—because you’ve already given it to them. I think it would be hard to get your data back and for them not to keep a copy” (E3, girl, 11 years old, high SES).

Only a few boys provided vague affirmative responses such as “I think so, yeah” (E11, boy, 12 years old, high SES), without further detail (28.12%). In contrast, a more nuanced view was offered by a 14-year-old girl who distinguished between recovering and deleting data:

“Getting it back, yes, but deleting it—I don’t think so. Because, after all, like I’ve always been told, any info that goes through the Internet or whatever is always going to stay there. I mean, it’s like you can never really delete it completely” (E15, girl, 14 years old, high SES).

4.3. The Attitudinal Dimension in Minors’ Responses to Requests for Personal Data and the Role of Parental Mediation in Digital Literacy

From an attitudinal perspective on data protection literacy, many minors cited distrust in the security and reliability of digital platforms or brands as a primary reason for not disclosing personal data (50%). This skepticism is reflected in statements such as: “I don’t trust certain websites” (E34, boy, 14 years old, middle SES), and “a lot of the time, it’s not believable” (E35, boy, 13 years old, high SES).

Participants also expressed doubts regarding the authenticity of promotions and prize draws, often perceiving them as deceptive or manipulative (37.5%). These perceptions contributed to their refusal to share data. One girl noted: “I usually don’t pay attention to giveaways. Because a lot of the time they can trick you” (E28, girl, 14 years old, high SES). Another participant added, “There’s little chance I’ll actually win” (E23, boy, 10 years old, high SES), while another commented: “Like it says, spin the wheel, you win an iPhone 14, and then it asks for your address or your card—it’s not believable” (E33, boy, 13 years old, high SES).

When asked whether they considered data sharing with brands to be dangerous or harmless, only one participant responded affirmatively to the latter: “That nothing would happen” (E27, girl, 14 years old, high SES). In contrast, many minors mentioned parental warnings as a major influence on their caution toward digital interactions (13.63%). Recommendations such as avoiding communication with strangers and being skeptical of pop-ups and promotions were commonly cited. For example: “My mom already told me that if something like that pops up, I should either tell her or close it, because it’s personal data they can use to put a virus on your phone” (E3, girl, 11 years old, high SES), and “My parents warn me a lot to be careful” (E14, girl, 13 years old, - SES).

Minors associated several risks with the disclosure of personal data, including hacking, doxxing and malware (22.72% of those who consider it dangerous), threats to personal safety (9%), scams (31.81%), and the unwanted receipt of advertising (4.5%). Some participants voiced concerns about the malicious use of data, particularly in relation to doxxing—the practice of collecting and publishing someone’s personal information without consent. One boy explained:

“Yeah, pretty dangerous. I mean, there could be a hacker. Well, I know there’s this thing called doxxing. It’s when someone looks you up, finds out where you live and your personal stuff. And like, if they see you’ve entered your address somewhere—like in a company or on some site—and they know how to hack, I think they could break a code or something and find your address” (E17, boy, 11 years old, high SES).

Others emphasized technological risks, such as malware: “I think it would be dangerous, because, well, they could take all your data and, well, put a virus on your phone, tablet, or computer” (E4, boy, 13 years old, high SES). More serious fears, such as kidnapping, were also voiced: “If you give your address, then of course someone could come and kidnap you at any moment” (E1, girl, 11 years old, middle SES). Concerns about economic fraud were also common: “It’s dangerous, they could take your money” (E35, boy, 13 years old, high SES); “It would be dangerous because they could scam me” (E31, boy, 13 years old, high SES).

The constant receipt of advertising following data disclosure was another point of concern. One girl described how targeted ads follow from entering data in promotions:

“Because if you see an ad, like, I don’t know, an iPhone being given away, you’d probably click on it, right? Most people would. Then you’d give them your data and stuff. And then it’s like they’ve got you on file, right? So they can keep sending you more ads, like, ‘iPhone 15 on sale.’ And then they just flood you with ads” (E21, girl, 13 years old, high SES).

Minors often expressed explicit fear—not just distrust—when discussing the risks associated with data sharing, especially in relation to promotions and giveaways. One boy observed: “It’s super hard to actually win, and sometimes it’s even fake” (E11, boy, 12 years old, high SES), while another stated: “Most giveaways are a scam” (E10, boy, 13 years old, low SES).

The degree of perceived risk was influenced by the visibility and credibility of the brand (30.30%). Familiarity with well-known companies or their social media presence served as a sign of trustworthiness. For example:

“Well, it depends on the site—whether it’s trustworthy or not. For example, Amazon’s or Nike’s official store, no—I mean, that’s completely trustworthy. But, like, new shopping apps? I never really use those, I don’t even download them to check. I just don’t like them” (E12, girl, 12 years old, middle SES).

By contrast, brands with little online presence or an unprofessional design generated suspicion. Elements such as follower count or interface design were mentioned as key indicators: “If you see a brand with 200,000 followers, you know it’s doing well. If you see one with 2,000, you could think anything” (E13, boy, 14 years old, high SES); “If it looks real and all that, then I think it’s fine. But if I see it’s fake, then I don’t like it” (E20, boy, 11 years old, middle SES).

While parental influence had already emerged spontaneously in earlier responses related to data-sharing behavior and risk perception, this portion of the interview included a direct question regarding parental mediation. Over half of the participants stated that they discuss the issue of sharing personal data with their parents (58.82%)—this was more commonly reported by girls. One participant explained: “I usually ask first” (E12, girl, 12 years old, middle SES).

However, a significant group of participants indicated that they do not discuss these matters with their parents (41.18%). In some cases, this choice was tied to a sense of personal control. One boy noted: “No, ’cause I don’t really pay attention to it either. I mean, I just... I see the ad, I close it, and I don’t tell my parents, but I also don’t give it any of my info” (E4, boy, 13 years old, high SES).

5. Discussion and Conclusions

5.1. Data-Sharing Practices: Risk Perception and Attitudes

The way minors in Spain manage the personal information they disclose to brands in digital environments is strongly shaped by their attitudes toward commercial strategies, and particularly by the level of perceived risk associated with each situation. Based on this risk assessment, they apply varying degrees of protection, selectively deciding which data to share and under which circumstances. Most participants reported avoiding the disclosure of personal data to brands, citing distrust in platform security, the perceived unreliability of promotional activities, and, in some cases, a growing awareness of privacy—even when commercial incentives are present. These findings align with those of Chi et al. (2018) and Desimpelaere et al. (2020), who argue that negative affective responses, such as privacy concerns, can promote active protective behaviors. These practices reflect an emerging form of children’s agency within digital environments.

Minors in this study largely viewed the sharing of personal information as a risky practice, indicating a heightened awareness of the potential dangers involved. This contrasts with the findings of Livingstone et al. (2019), who reported that minors often overlooked or underestimated the risks inherent in commercial practices. These risk perceptions do not emerge in isolation; rather, they are shaped by social discourses such as parental warnings and certain media narratives that reinforce a threatening image of the digital environment. Participants in the present study were able to distinguish among different types of risk: technological (e.g., hacking, viruses, or doxxing), economic (e.g., scams or financial theft), and personal (e.g., location tracking or abduction). These distinctions reflect a relatively nuanced understanding of potential threats, even if not always fully informed by technical or legal knowledge.

Perceptions of risk were closely tied to the degree of trust minors placed in specific brands, which was influenced by factors such as brand recognition, website design, and follower count on social media platforms. Promotional activities, particularly prize draws, were frequently met with skepticism, often being perceived as manipulative or deceptive—a finding consistent with Desimpelaere et al. (2020). However, their 2021 experimental study showed that the presence of a reward could increase both perceived fairness and willingness to share personal data, even among digitally literate children. This highlights a possible gap between stated intentions and actual behavior, shaped by motivational and contextual factors.

A minority of participants acknowledged sharing personal data but did so selectively and only in contexts they considered justified. This behavior was more common among adolescents aged 13 and 14, in line with Desimpelaere et al. (2021). These minors differentiated between types of data—viewing email addresses as relatively benign while reserving more sensitive details, such as home addresses or phone numbers, for necessary transactions. Some also employed protective strategies, a pattern observed in earlier studies by Chi et al. (2018) and Livingstone et al. (2019).

5.2. Knowledge of Personal Data Use and Digital Rights

Although many participants struggled to articulate why brands request personal data—especially younger boys—most were able to identify commercial motives such as advertising, market research, or logistics. Alongside this partial understanding, a few participants speculated about the potential for malicious use, including hacking and fraud. Notably, there was a widespread lack of awareness regarding digital rights, particularly concerning the ability to retrieve or delete personal data once it has been shared. Similar to the findings of Bowler et al. (2017), most minors in this study felt that once data is submitted, it is effectively out of their control. This perceived lack of control is exacerbated by the opacity of many digital promotions. Policymakers should regulate the design of platforms targeting minors by limiting persuasive incentives and safeguarding their digital rights.

5.3. Parental Mediation in Digital Literacy and Data Sharing

Parental mediation emerged as an influential factor in minors’ data literacy, particularly among girls, consistent with the findings of Livingstone et al. (2013). The data suggest the existence of an education model grounded in fear—built around socialization practices that emphasize potential negative consequences as a means of persuasion. This approach may stem from a broader lack of data literacy among adults, as suggested by Deahl (2014). Such strategies activate different emotional registers: appealing to a hedonistic concern about the loss of enjoyable possessions (e.g., phones or computers) and invoking affective fears related to personal safety (e.g., kidnapping). In both cases, the digital environment is framed as inherently threatening, which can reinforce dependence on adults and undermine the development of autonomy and critical thinking. The fact that this model was more commonly reported by girls also suggests the presence of gendered assumptions, where greater vulnerability is projected onto female minors, thereby justifying more restrictive forms of oversight. This highlights the importance of including content on privacy and data use in digital literacy programs from primary education onwards, with the aim of fostering critical autonomy and the exercise of digital rights.

5.4. Contributions and Limitations of the Study

This study offers valuable insights by addressing data protection literacy in childhood through a multidimensional lens and by foregrounding the perspectives of minors themselves. Its contribution is especially significant given the limited body of qualitative research on this topic in the Spanish context. Nevertheless, several limitations should be acknowledged. As a qualitative study based on interviews, the findings are not generalizable to the broader child population. However, they do support the identification of recurring patterns and the formulation of hypotheses for further investigation. Additionally, the study was conducted within a specific cultural and geographical context, which may limit the transferability of the results. Although every effort was made to center minors’ voices, their responses may have been influenced by social desirability or by their relationship with the interviewer. Given the complexity of the topic, future research would benefit from mixed-method approaches quantitatively exploring variations in trust by age or platform and examining the evolution of risk perception through longitudinal studies. The inclusion of perspectives from other key stakeholders, such as families, educators, or designers of digital environments could further enrich the analysis.

Funding

The research is part of the R&D&I project “Advertising Literacy in the Mobile Phone Era: An Analysis of Children’s Ability to Confront Persuasive Content. ADKIDS MOBILE”, funded by the Spanish Ministry of Science and Innovation.

Authors’ Contribution

Paula Neira: Conceptualization; Methodology; Formal analysis; Investigation; Writing – original draft; Writing – review and editing.

Beatriz Feijoo: Methodology; Investigation; Resources; Fund acquisition; Project management; Writing – review and editing.

Erika Fernández-Gómez: Methodology; Investigation; Resources; Fundraising; Project management; Writing – review and editing.

All authors have read and accepted the published version of the manuscript.

Conflicts of interest

The authors declare that they have no conflict of interest.

Data availability

The dataset referred to in Supplementary material that supports the results of this study was published in the Zenodo repository and can be accessed at https://doi.org/10.5281/zenodo.16570752

References

Alauthman, Mohammad; Ishtaiwi, Abdelraouf; Al Maqousi, Ali; & Hadi, Wael. (2024). A framework for cybersecurity in the metaverse. 2024 2nd International Conference on Cyber Resilience (ICCR), 1-8. IEEE. https://doi.org/10.1109/ICCR61006.2024.10532868

Avinç, Ece; & Doğan, Fatih. (2024). Digital literacy scale: Validity and reliability study with the rasch model. Education and information Technologies, 29, 1-47. https://doi.org/10.1007/s10639-024-12662-7

Bingham, Andrea J. (2023). From data management to actionable findings: A five-phase process of qualitative data analysis. International Journal of Qualitative Methods, 22(3), 1-11. https://doi.org/10.1177/16094069231183620

Bowler, Leanne; Acker, Amelia; Jeng, Wei; & Chi Yu. (2017). “It lives all around us”: Aspects of data literacy in teen’s lives. Proceedings of the Association for Information Science and Technology, 54(1), 27-35. https://doi.org/10.1002/pra2.2017.14505401004

Brown, Madison; Pounders, Kathrynn; & Wilcox, Gary. (2023). Examining issues of social media, children, and privacy. En: Angeline Close Scheinbaum (ed.), The darker side of social media. Routledge. https://doi.org/10.4324/9781003410058-12

Calzada Prado, Javier; & Marzal, Miguel Ángel. (2013). Incorporating data literacy into information literacy programs: Core competencies and contents. Libri, 63(2), pp. 123-134. https://doi.org/10.1515/libri-2013-0010

Chaudron, Stéphane; Di Gioia, Rosanna; & Gemo, Monica. (2018). Young children (0-8) and digital technology: A qualitative exploratory study across seven countries. Joint Research Centre. European Commission. https://doi.org/10.2760/294383

Chi, Yu; Jeng, Wei; Acker, Amelia; & Bowler, Leanne. (2018). Affective, behavioral, and cognitive aspects of teen perspectives on personal data in social media: A model of youth data literacy. In: Gobinda Chowdhury, Julie McLeod, Valerie Gillet & Peter Willett (eds.), Transforming Digital Worlds. iConference 2018. Lecture Notes in Computer Science, 10766. Springer. https://doi.org/10.1007/978-3-319-78105-1_49

Daems, Kristien; De Pelsmacker, Patrick; & Moons, Ingrid. (2019). The effect of ad integration and interactivity on young teenagers’ memory, brand attitude and personal data sharing. Computers in Human Behavior, 99, 245-259. https://doi.org/10.1016/j.chb.2019.05.031

Deahl, Erica. (2014). Better the data you know: Developing youth data literacy in schools and informal learning environments [Preprint]. SSRN. https://doi.org/10.2139/ssrn.2445621

Dedkova, Lenka; & Mýlek, Vojtěch. (2023). Parental mediation of online interactions and its relation to adolescents’ contacts with new people online: The role of risk perception. Information, Communication & Society, 26(16), 3179-3196. https://doi.org/10.1080/1369118X.2022.2146985

Desimpelaere, Laurien; Hudders, Liselot; & Van de Sompel, Dieneke. (2020). Knowledge as a strategy for privacy protection: How a privacy literacy training affects children’s online disclosure behavior. Computers in Human Behavior, 110, 106382. https://doi.org/10.1016/j.chb.2020.106382

Desimpelaere, Laurien; Hudders, Liselot; & Van de Sompel, Dieneke. (2021). Children’s perceptions of fairness in a data disclosure context: The effect of a reward on the relationship between privacy literacy and disclosure behavior. Telematics and Informatics, 61, 101602. https://doi.org/10.1016/j.tele.2021.101602

European Data Protection Board (EDPB). (2022). Guidelines 03/2022 on deceptive design patterns in social media platform interfaces: How to recognise and avoid them (v. 2.0). Technical report. https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-032022-deceptive-design-patterns-social-media_es

Fathoni, Ahmad Wildan. (2024). Personalization and consumer disclosure: Considerations of ethics in digital marketing communications. International Journal on Social Science, Economics and Art, 14(1), 63-72. https://ijosea.isha.or.id/index.php/ijosea/article/view/461

Fernández-Gómez, Erika; Neira Placer, Paula; & Feijoo Fernández, Beatriz. (2024). New mobile advertising formats targeting young audiences: an analysis of advertainment and influencers’ role in perception and understanding. Humanities and Social Sciences Communications, 11(1), 1-9. https://doi.org/10.1057/s41599-024-04003-3

Helsper, Ellen J.; Veltri, Giuseppe Alessandro; & Livingstone, Sonia. (2024). Parental mediation of children’s online risks: The role of parental risk perception, digital skills and risk experiences. New Media & Society. Advance online publication. https://doi.org/10.1177/14614448241261945

Instituto Nacional de Estadística (INE). (2024). Encuesta sobre Equipamiento y Uso de Tecnologías de Información y Comunicación en los Hogares. https://www.ine.es/dyngs/Prensa/TICH2024.htm

Kim, Jaewon; Cho, Soobin; Wolfe, Robert; Nair, Jishnu H.; & Hiniker, Alexis. (2025). Privacy as Social Norm: Systematically Reducing Dysfunctional Privacy Concerns on Social Media. Proceedings of the ACM on Human-Computer Interaction, 9(2), 1-39. https://doi.org/10.1145/3711049

Li, Jialin. (2025). Reflection on data right protection for minors in the digital age. Children and Youth Services Review, 170, 108167. https://doi.org/10.1016/j.childyouth.2025.108167

Livingstone, Sonia; & Helsper, Ellen J. (2008). Parental mediation of children’s internet use. Journal of Broadcasting & Electronic Media, 52(4), 581-599. https://doi.org/10.1080/08838150802437396

Livingstone, Sonia; Kalmus, Veronika; & Talves, Kairi. (2013). Girls’ and boys’ experiences of online risk and safety. In: Cynthia Carter, Linda Steiner & Lisa McLaughlin (eds.), The Routledge Companion to Media & Gender (pp. 190-200). Routledge.

Livingstone, Sonia; Stoilova, Mariya; & Nandagiri, Rishita. (2019). Children’s data and privacy online: Growing up in a digital age. An evidence review. London School of Economics and Political Science. https://bit.ly/42YmjNj

Livingstone, Sonia; Stoilova, Mariya; & Nandagiri, Rishita. (2021). Data and Privacy Literacy: The Role of the School in Educating Children in a Datafied Society. In Divina Frau-Meigs, Sirkku Kotilainen, Manisha Pathak-Shelat, Michael Hoechsmann & Stuart R. Poyntz (eds.), The Handbook of Media Education Research (pp. 414-424). Wiley. https://doi.org/10.1002/9781119166900.ch38

Mayan, Maria J. (2023). Essentials of qualitative inquiry (2nd ed.). Routledge. https://doi.org/10.4324/b23331

Martoni, Michele. (2025). Digital Transformation and e-Citizenship. Children’s Access to Online Services. Revista de Derecho Privado, n.º 48, 69-86. https://doi.org/10.18601/01234366.48.04

Neira Placer, Paula; Feijoo Fernández, Beatriz; Fernández-Gómez, Erika; & López Martínez, Adela. (2025). Alfabetización moral de menores entre 10 y 14 años en España: Reflexiones éticas sobre publicidad en redes sociales. AdComunica, (29), 27-48. https://doi.org/10.6035/adcomunica.8367

Ostrom, Thomas M. (1969). The relationship between the affective, behavioral, and cognitive components of attitude. Journal of Experimental Social Psychology, 5(1), 12-30. https://doi.org/10.1016/0022-1031(69)90003-1

Pangrazio, Luci; & Sefton-Green, Julian. (2021). Digital Rights, Digital Citizenship and Digital Literacy: What’s the Difference? Journal of New Approaches in Educational Research, 10(1), 15-27. https://doi.org/10.7821/naer.2021.1.616

Pothong, Kruakae; Livingstone, Sonia; Colvert, Angela; & Pschetz, Larissa. (2024). Applying children’s rights to digital products: Exploring competing priorities in design. In IDC ’24: Proceedings of the 23rd Annual ACM Interaction Design and Children Conference (1-12). ACM. https://doi.org/10.1145/3628516.3655789

Rocha Estrada, Francisco Javier; George-Reyes, Carlos Enrique; & Glasserman-Morales, Leonardo David. (2022). Security as an emerging dimension of Digital Literacy for education: a systematic literature review. Journal of e-Learning and Knowledge Society, 18(2), pp. 22-33. https://www.je-lks.org/ojs/index.php/Je-LKS_EN/article/view/1135440

Sánchez, Edgar. (2025). Móviles en España 2025: penetración, uso infantil y gestión sostenible. Barcelona: TBS Education. https://www.observatoriodelainfancia.es/oia/esp/documentos_ficha.aspx?id=8892

Steinberg, Stacey B. (2017). Sharenting: Children’s Privacy in the Age of Social Media. Emory Law Journal, 66(4), 839. https://scholarlycommons.law.emory.edu/elj/vol66/iss4/2

Stoilova, Mariya; Bulger, Monica; & Livingstone, Sonia. (2024). Do parental control tools fulfil family expectations for child protection? A rapid evidence review of the contexts and outcomes of use. Journal of Children and Media, 18(1), 29-49. https://doi.org/10.1080/17482798.2023.2265512

Sweeney, Emma; Lawlor, Margaret-Anne; & Brady, Mairead. (2021). Teenagers’ moral advertising literacy in an influencer marketing context. International Journal of Advertising, 41(1), 54–77. https://doi.org/10.1080/02650487.2021.1964227

Wu, Xinran; Zhang, Kai; Kuang, Nanyu; Kong, Xiangzhen; Cao, Miao; Lian, Zhengxu; Liu, Yu; Fan, Huanxin; Yu, Gechang; Liu, Zhaowen; Cheng, Wei; Jia, Tianye; Sahakian, Barbara J.; Robbins, Trevor W.; Feng, Jianfeng; Schumann, Gunter; Palaniyappan, Lena; & Zhang, Jie. (2025). Developing brain asymmetry shapes cognitive and psychiatric outcomes in adolescence. Nature Communications, 16(1), 4480. https://doi.org/10.1038/s41467-025-59110-9

Zarouali, Brahim; De-Pauw, Pieter; Ponnet, Koen; Walrave, Michel; Poels, Karolien; Cauberghe, Verolien; & Hudders, Liselot. (2019). Considering children’s advertising literacy from a methodological point of view: Past practices and future recommendations. Journal of Current Issues & Research in Advertising, 40(2), 196-213. https://doi.org/10.1080/10641734.2018.1503109