Collect less, explain why, and protect young people’s information.
This is a publication-ready content framework, not final legal advice. Before launch, BIAA must insert the verified legal entity, controller contact, service providers, retention periods, transfer details and rights process required by applicable law.
Final controller and rights information must be verified before public launch.Information the website may need
The website should collect only information necessary to respond to an enquiry, operate an explicitly requested service, maintain security or understand aggregate site performance. Forms must identify required and optional fields.
- 01Do not request a child’s sensitive information through a general enquiry form
- 02Avoid free-text collection when a bounded choice is sufficient
- 03Document the purpose and legal basis before activating each data flow
Young people require stronger protection
A child should not submit personal information without an appropriate adult and a clearly explained purpose. Images, voices, projects and school identifiers require documented permission and careful publication review.
Cookies, analytics and service providers
Non-essential technologies should remain off until the required choice and notice are implemented. Every provider that receives data must be listed with its purpose, safeguards and current policy link.
Retention, security and individual rights
Keep information only as long as justified, restrict access, prepare incident procedures and provide a verified route for access, correction, deletion, objection or other applicable requests.
Contact BIAA about privacy
Final controller and rights information must be verified before public launch.