Children Deletion Requests

Managing Deletion Requests for Children's Data

Overview

Deletion of children's personal data operates under heightened obligations compared to adult data deletion. Under GDPR Article 17, the right to erasure applies with particular force when data was collected from a child — Article 17(1)(f) explicitly creates a right to erasure where personal data has been collected in relation to the offer of information society services to a child under Article 8(1). COPPA Section 312.6 requires operators to provide parents with the ability to review and delete personal information collected from their child. The UK AADC Standard 15 requires prominent and accessible tools to help children exercise their data protection rights. This skill provides a comprehensive framework for processing deletion requests involving children's data, including the complex questions of who can request deletion, verification procedures, scope determination, and third-party notification.

Legal Framework

GDPR Article 17(1)(f) — Right to Erasure for Children's Data

"The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where [...] the personal data have been collected in relation to the offer of information society services directly to a child referred to in Article 8(1)."

This ground for erasure is distinct from the other Art. 17(1) grounds because:

• It does not require that the original lawful basis has been withdrawn (unlike Art. 17(1)(b) consent withdrawal)
• It does not require that the data is no longer necessary (unlike Art. 17(1)(a))
• It applies specifically because the data was collected from a child, regardless of whether the data subject is still a child at the time of the request
• The CJEU has confirmed in Case C-131/12 (Google Spain) that the right to erasure is especially important where the data was collected when the data subject was a minor

GDPR Article 17(2) — Third-Party Notification

"Where the controller has made the personal data public, the controller shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure [...] of any links to, or copy or replication of, those personal data."

GDPR Article 12(3) — Response Timeline

"The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request."

COPPA Section 312.6 — Parental Access and Deletion Rights

• 312.6(a): Operator must provide a parent, upon request, with a description of the specific types of personal information collected from the child, and the opportunity to refuse to permit the operator's further use or future online collection of personal information from that child, and to direct the operator to delete the personal information collected from that child
• 312.6(b): The operator must delete the child's personal information within a reasonable time after receiving the parental request

UK AADC Standard 15 — Online Tools

"Provide prominent and accessible tools to help children exercise their data protection rights and report concerns."

Who Can Request Deletion

Parental-Initiated Deletion

Applicable When: The child is below the age at which they can independently exercise data protection rights.

| Jurisdiction | Age Below Which Parent Acts | Legal Basis | |-------------|:-------------------------:|-------------| | GDPR (default) | 16 (or national threshold 13-16) | Art. 8(1) — parental consent grounds extend to parental exercise of rights | | UK | 13 (DPA 2018 Section 9) | ICO guidance: parent exercises rights for children who cannot understand the implications | | US (COPPA) | 13 | 16 CFR 312.6 — explicit parental right to direct deletion | | France | 15 | Loi Informatique et Libertes Art. 45 | | Germany | 16 | GDPR default | | Spain | 14 | Organic Law 3/2018 Art. 7 |

Verification Requirements:

• Verify that the requester is the parent or legal guardian of the child
• Verification methods (proportionate to risk): match against existing parental account, email verification to registered parent email, knowledge-based questions, government ID (for high-risk scenarios)
• Verify the identity of the child whose data is to be deleted (match against account records)

Child-Initiated Deletion

Applicable When: The child has reached sufficient maturity to understand and exercise their data protection rights independently.

Age of Capacity Assessment:

The capacity of a child to independently exercise data protection rights is not determined solely by the Art. 8 age threshold. The ICO has stated that a child who is competent to understand their rights may exercise them independently, regardless of the Art. 8 threshold. This is analogous to the Gillick competency principle in UK common law.

| Scenario | Who Initiates | Capacity Assessment | |----------|--------------|-------------------| | Child aged 10 requests deletion | Parent must submit the request | Child below Art. 8 threshold in all jurisdictions; lacks capacity | | Child aged 14 in Belgium (threshold 13) requests deletion | Child can submit independently | Above national threshold; presumed competent | | Child aged 14 in Germany (threshold 16) requests deletion | Depends on maturity assessment | Below national threshold; controller may accept if child demonstrates understanding | | Former child (now 18) requests deletion of childhood data | Former child submits independently | Adult; full capacity; Art. 17(1)(f) explicitly protects this scenario |

Former Child (Adult) Requesting Deletion of Childhood Data

Art. 17(1)(f) does not require the data subject to still be a child at the time of the request. An adult may request deletion of personal data collected when they were a child. This is particularly relevant for:

• Social media posts from adolescence
• Educational records from childhood
• Health data from paediatric treatment
• Photos and videos uploaded by the child or their parents during childhood

The GDPR explicitly supports this by creating Art. 17(1)(f) as a standalone ground — the passage of time does not diminish the right.

Deletion Request Processing Workflow

Step 1: Receive and Log Request

Request received
│
├─ Channel: email / parental dashboard / in-app tool / postal mail
├─ Requester identity: parent / child / former child (adult)
├─ Child identifier: account ID / name / email
├─ Scope requested: full account deletion / specific data categories
├─ Timestamp: [logged automatically]
├─ Reference number assigned: DEL-CHILD-[YEAR]-[SEQ]
│
└─ Acknowledgement sent within 48 hours

Step 2: Verify Requester Identity and Authority

| Requester | Verification Method | Escalation | |-----------|-------------------|-----------| | Parent (existing account) | Match request email against registered parent email + security question | If match fails, request government ID | | Parent (no existing account) | Request proof of parental relationship (birth certificate or equivalent) + matching identification | Manual review by DPO | | Child (above threshold, existing account) | Match request against child's registered email + account security | If match fails, involve parent | | Child (below threshold) | Redirect to parent; inform child their parent can submit the request | Provide parent contact mechanism | | Former child (adult) | Standard identity verification (email + security question or ID) | Manual review if account is historical |

Step 3: Determine Scope of Deletion

| Scope Element | Default Inclusion | Exceptions | |--------------|:-----------------:|-----------| | Account profile data (name, DOB, email) | YES | None | | Activity/usage logs | YES | Anonymised aggregate retained for analytics | | Content created by child (posts, projects, uploads) | YES | Offer download before deletion | | Communication records (messages, chats) | YES | May retain if needed for ongoing safeguarding investigation | | Parental consent records | RETAINED for 6 years | Legal compliance: statute of limitations for GDPR enforcement | | Financial transaction records | RETAINED for applicable period | Legal compliance: tax and accounting obligations | | Safety/moderation logs | RETAINED if active investigation | Safeguarding obligation override per Art. 17(3)(d) | | Backup copies | YES (scheduled purge) | Deleted within backup rotation cycle (max 30 days) | | Third-party copies | NOTIFIED for deletion | Art. 17(2) obligation to inform third-party controllers |

Step 4: Execute Deletion

Timeline: Within one month of verified request (Art. 12(3)). Extension of up to two additional months permitted for complex requests, with notification to the requester within the initial one-month period.

Technical Deletion Process:

1. Primary database: Execute DELETE operations across all tables containing the child's personal data
2. Search indices: Remove the child's data from Elasticsearch, Solr, or equivalent search indices
3. Caches: Invalidate all cached entries containing the child's data (Redis, CDN, application cache)
4. File storage: Delete uploaded files (photos, documents, audio) from primary storage (S3, Azure Blob, GCS)
5. Analytics databases: Remove or anonymise records in analytics systems (BigQuery, Redshift, Snowflake)
6. Logs: Purge application logs containing the child's personal data (ELK stack, Splunk, CloudWatch)
7. Machine learning models: If the child's data was used to train ML models, assess whether the model must be retrained or whether the training data inclusion is irreversible (document the assessment)
8. Backups: Schedule deletion from backup systems within the next backup rotation cycle (max 30 days)
9. Third-party notification: Send deletion requests to all third parties that received the child's data per Art. 17(2)

Step 5: Confirm Deletion

{
  "deletion_reference": "DEL-CHILD-2026-0284",
  "child_identifier": "child_bp_8f3a2d",
  "requester": "parent_bp_c7e4f1",
  "requester_type": "parent",
  "request_date": "2026-02-15T09:00:00Z",
  "verification_date": "2026-02-16T11:30:00Z",
  "deletion_scope": {
    "account_data": "deleted",
    "activity_logs": "deleted",
    "content": "deleted (download offered, declined by parent)",
    "communications": "deleted",
    "consent_records": "retained (legal compliance, expiry 2032-02-16)",
    "backups": "scheduled_purge_2026-03-16"
  },
  "third_party_notifications": [
    {
      "recipient": "AWS (hosting provider)",
      "notification_date": "2026-02-17",
      "scope": "all stored objects for child account",
      "confirmation": "pending"
    }
  ],
  "deletion_completed_date": "2026-02-17T14:00:00Z",
  "backup_purge_date": "2026-03-16T02:00:00Z",
  "confirmation_sent_to_requester": "2026-02-17T14:30:00Z"
}

Step 6: Post-Deletion Verification

1. Attempt to retrieve the child's data from all systems listed in Step 4
2. Confirm that no personal data is returned from any system (except legally retained records)
3. Log the verification outcome
4. Schedule backup purge verification for 30 days after primary deletion

BrightPath Learning Inc. — Deletion Implementation

Deletion Channels

| Channel | Description | Response Time | |---------|-------------|---------------| | Parental dashboard | One-click "Delete Account" button with confirmation dialog | Immediate processing | | In-app (child) | "Delete my stuff" button in privacy centre (for children above threshold) | Immediate processing | | Email | privacy@brightpathlearning.eu | Acknowledgement within 48 hours | | Postal | BrightPath Learning Inc., 200 Education Lane, Amsterdam, 1012 AB, Netherlands | Acknowledgement within 5 business days |

Deletion Flow (Parental Dashboard)

Parent clicks "Delete Alex's Account"
│
├─ Confirmation dialog:
│  "This will permanently delete Alex's account and all their data,
│   including learning progress and any work they've saved.
│   This cannot be undone."
│  [Download Alex's data first]  [Delete everything]  [Cancel]
│
├─ If "Download first" selected:
│  ├─ Generate data export (JSON + PDF progress report)
│  ├─ Email download link to parent (valid for 7 days)
│  └─ Return to deletion confirmation
│
├─ If "Delete everything" selected:
│  ├─ Re-verify parent identity (password or security question)
│  ├─ Execute deletion across all systems
│  ├─ Send confirmation email to parent
│  └─ Display confirmation: "Alex's account and data have been deleted.
│      Backup copies will be removed within 30 days."
│
└─ If "Cancel" selected:
   └─ Return to dashboard (no action taken)

Handling Competing Interests

| Scenario | Outcome | Rationale | |----------|---------|-----------| | Parent requests deletion; child wants to keep account | Parent's request takes priority for children below threshold | Parent holds consent authority under Art. 8 | | Child (16+) requests deletion; parent wants to retain | Child's request takes priority | Child above UK threshold; autonomous rights holder | | School requests deletion of student data; parent wants to retain | Delete from BrightPath; inform parent they may retain their own copies | School's FERPA/contractual authority governs school-directed data | | Safeguarding investigation active on the child's account | Retention of relevant data permitted under Art. 17(3)(d) | Vital interests / public interest in protection of the child | | Child's data needed for ongoing legal claim | Retention permitted under Art. 17(3)(e) | Legal claims exception |

Exception Grounds — When Deletion Can Be Refused

Art. 17(3) provides exceptions where the right to erasure does not apply:

| Exception | Art. 17(3) Reference | Application to Children's Data | |-----------|---------------------|-------------------------------| | Freedom of expression | Art. 17(3)(a) | Rarely applies to children's data; would require compelling journalistic or artistic purpose | | Legal obligation | Art. 17(3)(b) | Tax records of transactions; mandatory educational records under national law | | Public health | Art. 17(3)(c) | Vaccination records; public health surveillance data | | Archiving in public interest | Art. 17(3)(d) | Educational research (with ethical approval and anonymisation) | | Legal claims | Art. 17(3)(e) | Data needed for establishment, exercise, or defence of legal claims |

Important: Even where an exception applies, the controller should delete as much data as possible and retain only the minimum necessary to satisfy the exception.

Common Compliance Failures

1. No child-accessible deletion tool: Requiring children to navigate adult-oriented privacy settings or contact forms to exercise deletion rights
2. Parental deletion blocked by verification failure: Overly burdensome verification requirements that prevent parents from exercising deletion rights
3. Incomplete deletion scope: Deleting the account profile but retaining activity logs, analytics data, or cached copies
4. No backup deletion: Deleting from production systems but retaining data indefinitely in backups
5. No third-party notification: Failing to notify third parties that received the child's data per Art. 17(2)
6. Exceeding the one-month timeline: Processing deletion requests beyond the Art. 12(3) one-month deadline without notifying the requester of an extension
7. No deletion of historical data on adult request: Refusing to delete childhood data when the (now adult) data subject requests it, on the grounds that the data is "old" or "archived"

Enfo

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: mukul975
• Source: mukul975/Privacy-Data-Protection-Skills
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.