KOALA Hero Toolkit: A New Approach to Inform Families of Mobile Datafication Risks

2.1 Datafication Risks of Mobile Apps

Most smartphone apps collect and share information with various first and third parties snippets of code, so-called trackers, that collect and send information about a user’s online activities to other companies [22]. A study analysing 1 million Android apps showed that trackers are found in almost every single app [96]. Research has also indicated that 90% of the websites include at least one tracking script [32], resulting in a multi-billion dollar business where many companies earn huge amounts of money by selling or leveraging the data collected from users [53, 62]. A more recent 2023 study on popular children’s mobile applications revealed that 13 out of 15 apps shared more user information with third parties than was disclosed in their respective privacy policies [30].

Along with the huge amount of data being collected from users, there is a growing worry about how online platforms may further exploit this data [22], giving rise to a set of datafication risks that extend beyond commonly addressed concerns like inappropriate online content and excessive screen time [57, 72]. Datafication here refers to the process that children’s actions are pervasively recorded, tracked, aggregated, analysed, and exploited by online services in multiple ways that include behavioural engineering, and monetisation [61, 68, 116]. Such practices can be found in almost every online platform, such as how Facebook provides personalised group recommendations to users [83], how Google tailors news for different users [16], and how Instagram presented “idealised body images” to teenage girls [94]. While data tracking and subsequent datafication can result in enhanced services and potentially improved user experiences, this may also lead to harmful profiling of children’s data, which is exacerbated by increasingly sophisticated online surveillance [84, 116], leading to more nuanced and individualized harms. A 2021 study showed Facebook profiles underage users using personal data, often sensitive, directing them to specific content providers, including potentially harmful or risky interests, such as smoking, gambling, alcohol, or extreme weight loss [104]. In fact, such datafication is core to the business models of numerous online service providers [44, 79, 104]. A recent report revealed advertisers pay around $3.03 to target a thousand youths interested in alcohol, $38.46 for those into extreme weight loss, and $127.88 for those curious about smoking [44]; intensifying concerns about harmful micro-targeting and behavioral engineering.

On the other hand, efforts have been made to mitigate issues related to datafication. Prior research has led to advanced privacy control techniques in mobile apps, such as reverse-engineering app source code and network traffic analysis [22, 50, 70, 78], which enable users to trace personal data flows from first to third parties, thus offering a clearer view of data management [31, 90, 97]. Self-regulatory initiatives by industry leaders have also emerged with the intention to offer users greater transparency and control over their personal information. Apple, for example, has introduced privacy labels to inform users about data tracking and linkage [3]. Google followed suit with its own privacy labels for apps, enabling developers to declare their adherence to data security best practices [12]. However, these efforts are mainly tailored to general users with some prior knowledge, making it difficult for specific groups like children to understand and use the provided information. At present, the majority of child-focused solutions are parental control apps designed for parents, which primarily concentrate on general online safety for children, providing limited guidance on the more specific issues of datafication (see Section 2.3).

2.2 Children and Parents’ Perceptions of Risks Around Their Data Online

In response to these growing concerns relating to children’s data privacy, researchers have looked into how we may better support children and their parents in gaining a better understanding or awareness of such practices. Zhao et al. [115] found that children aged 6 to 10 were capable of recognising privacy risks like oversharing or revealing identities online, but had a limited grasp of issues like online tracking or personalised advertisements. Kumar et al. [51] found that children between the ages of 8 and 11 began to grasp the idea that data collection on online platforms may pose certain risks to them, but often tend to link such risks solely to “stranger danger”. Older children, aged 14 to 18, had interpersonal concerns but frequently overlooked potential privacy threats from first- and third-parties using their data [75]. Children have also been found to struggle particularly with drawing personal connections to “data trackers” [14], focusing more on data they knowingly provide than on data extracted without their awareness or consent[58], and struggling to view the ongoing flow of their data as a dynamic process [24]. Some more recent studies found that children below the age of 13 have some basic understanding of datafication, like how their personal data could be processed to make “assumptions” about them. However, they often lack the ability to understand the mechanisms and reasons for data sharing across different platforms and the resulting collective profiling that occurs [100]. Another study demonstrated a significant desire among children to receive support in managing datafication risks, not limited to the collection of their data, but particularly those related to the processing and profiling of their data [101].

Meanwhile, researchers have also been looking into how parents perceive their children’s online privacy. A survey with 2,032 UK parents showed that online privacy is the top barrier for parents’ internet use. The survey also found that digital privacy skills are not uniformly distributed among parents and children, with only approximately half of the parents reporting knowledge on how to modify privacy settings for their children [54]. Another survey with 1,300 parents from 51 countries showed that although parents and guardians might have a certain level of awareness and knowledge about their children’s online privacy, this knowledge was confined to understanding how online platforms collect their children’s data and did not extend to the potential risks associated with other datafication practices such as sharing, processing, and profiling [59]. Studies have found that parents reported being confused and concerned regarding online privacy issues [57, 72]. Although children often turn to them for guidance about privacy online, parents felt ill-prepared and were sometimes equally confused about the digital environment and the dangers it poses to privacy, let alone the more implicit risks related to the datafication of children’s online activities [57].

2.3 Parental Control, Parental Mediation, and Family Joint Media Engagement

Traditionally, many existing interventions were crafted under the premise that parents would guide their children through the digital landscape [42, 57]. Parental control apps, for instance, are mobile apps that allow parents to monitor and restrict their children’s activities online[112]. Research has been trying to assess how effective these apps are for safeguarding children online. A review of 75 parental control apps revealed that the commercial market primarily adopts restriction and monitoring approaches [105], such as limiting access or implementing strict screen time rules. Children frequently found these apps to be invasive and overly restrictive, leading to increased tension between them and their parents [39, 40, 99]. On the other hand, active mediation approaches, like promoting communication [41], collaborative rule-setting [43], and co-learning experiences [47], were preferred by both children and parents [99], leading to heightened privacy awareness and stronger protective attitudes in children [91, 106].

Some more recent research has shifted focus from specific parental mediation strategies to exploring varied patterns of co-engagement between parents and children. Joint Media Engagement (JME) here refers to the shared experience of individuals, such as parents and children, siblings, or peers, interacting with media content together, deepening their collective understanding. Research on JME, including activities like co-viewing [92, 93], playing digital games together [60, 110], co-searching [60, 77], co-reading [65, 82, 109, 114], and co-designing [19, 107, 111] between family members, demonstrated that it significantly enhances family learning by fostering shared understanding, promoting linguistic and social development, and supporting discourse and media practices. This research direction also resonates with recent calls emphasising a “family-centered approach” [29], which advocates for creating meaningful and contextual experiences for both children and their families.

While there is a wealth of research focusing on the dynamics between parents and children concerning children’s online wellbeing, a noticeable gap persists in the literature. Prior studies have primarily focused on the immediate online safety issues, such as inappropriate content, or have taken a broader approach to digital literacy [17, 18, 112]. Few have delved into how to assist parents in addressing the subtler risks of datafication tied to children’s use of mobile apps. These risks encompass not only data collection and processing but also extend to threats posed to a child’s online engagement and digital autonomy through practices like profiling and related behavioural manipulations. We posit that studying collaborative interactions within families, including parents and siblings, can enrich our understanding of these risks and enhance our support for intra-family communication and trust.

3.1 Design Considerations

We drew inspiration from Kafai et al.’s computational thinking framework [46], which advocates a multiple-perspective approach for supporting children’s development of computational thinking, and contains three key frames: i) Cognitive thinking focuses on the understanding of key computational concepts, practices, and perspectives and the associated skill building and competencies; ii) Situated thinking encourages learning to take place in contexts that the learner cares about so that they include their personal expression and social engagement in their pathway of learning; and finally iii) critical thinking emphasises the importance of supporting the questioning of larger structures and processes behind the computational phenomenon. While existing online safety and privacy measures often prioritise children’s cognitive understanding, they often overlook contextualization in personal situations or the promotion of critical examination of observable phenomena [33]. While we do not claim the approach from Kafai et al. to be definitive, we used it as inspiration to enhance our family support design.

Our design goal is to create a toolkit with an app that enables families to discuss and collaboratively understand the datafication risks on mobile devices. We began by outlining the app’s key components, such as the ability to detect and disable trackers, or gain an overview of trackers associated with all the apps on the device. We ensured that these components comprehensively address all aspects of Kafai et al’s theory. All co-authors actively contributed to the ideation of these fundamental components, which are detailed in Table 1. The first three co-authors, each with extensive design experience, then proposed design features for each component to foster various aspects of Kafai’s computational thinking. These features were then jointly evaluated by all co-authors, by considering factors like user impact, innovation, and technical feasibility. The top features for each component were then implemented.

Table 1:

View Table

Table 1: Mapping the KOALA Hero Toolkit features to Kafai et al.’s computational thinking framework. The toolkit is aimed to be age appropriate and encourage open-ended play in its design choices.

3.2 KOALA Hero Tracker App

As a result of these design considerations, the KOALA Hero Toolkit contains the following key components, summarised in Table 1¹. Figure 1 illustrates the six main screens of KOALA Hero tracker app, which are described in detail below:

Figure 1:

View Figure

Apps Dashboard, shown in Figure 1(b), provides a summary of all the apps on children’s device and the number of trackers associated with each app. By designing the KOALA Hero tracker app as an app that children can install on their own devices, children can see the trackers associated with their own apps. This encourages children’s situated understanding of the datafication risks they are currently experiencing during their use of devices. It aims to create scenarios that may be more relevant to the families, and allowing children to be more in control with their app choices.

Trackers Dashboard shown in Figure 1(c), provides a summary and ranking of all the trackers found on children’s device. Similar to the apps dashboard, this feature also fosters situated thinking and encourages families to explore apps and trackers associated with higher risk factors. By configuring which trackers to block in Tracker View, this interactive element is intended to potentially provide children with a sense of achievement, by observing how the overall ranking of trackers may change.

Trackers View, shown in Figure 1(d), provides a summary of all the trackers of each individual app, grouped into four major types: essential (necessary for basic app functionality), advertising (used for marketing purposes), social (for social media integration), and others (trackers with functions that are not immediately recognizable). For each tracker category, we provide a basic explanation about each type of trackers, enhancing children’s cognitive understanding of the concepts. As users click into each of the tracker categories, we provide a list of the exact trackers that have been collecting their data (Figure 1(f)), fostering a more situated reflection on the datafication risks in their daily lives.

Data Destinations View, shown in Figure 1(e), displays a map showing global destinations of their data for each app, supporting both the cognitive and situated thinking on their datafication risks. Using this intuitive map presentation, we aim to foster an environment that encourages children to freely explore and engage at their own pace.

Trackers Control for individual app is shown in Figure 1(f). Children and parents can use the “block” buttons to block data collection by certain companies. By enabling children to explore this function alongside parents and exercise agency over their own data choices, we aim to support families’ critical thinking and enhance their sense of control.

Implementation. The KOALA Hero app is an Android app that is built, for the purposes of tracking analysis, on top of TrackerControl (TC) [49], which itself expands on the popular Android firewall NetGuard [23]. It offers dynamic and static tracking analysis of apps. Using Android’s VPN functionality, the dynamic analysis examines and blocks app network communications on the device. Network traffic is cross-referenced with lists of tracker domains, such as those by Disconnect.me [34] and App X-Ray [22, 48]. For static analysis, it evaluates tracking libraries within apps using the Exodus Privacy tracker database [37], bypassing the need to monitor app network traffic.

Figure 2:

View Figure

3.3 KOALA Hero Data Cards

To better facilitate hands-on exploration for families and foster deeper, more situated reflections, we incorporated physical elements into our toolkit design. The second component of our toolkit is a set of 18 data cards (see Figure 2), each illustrating the different types of data that might be collected from children’s apps, ranging from account username, personal information such as age, gender and location, to online behavioural data such as browsing and search history. While these 18 data types do not cover all data online platforms collect, they represent the most significant categories from our analysis of major platform privacy policies (Google [8], Amazon [2], and Meta [11]). The data cards, designed to be physically printed and played by children and parents, were created to support the cognitive comprehension of data associated with their mobile apps and online activities. Furthermore, we curated the data card descriptions as examples to help children and parents contextualise their own activities, such as “You are friends with Sarah and Tom on Snapchat”, facilitating their situated understanding of how the data integrates into their daily lives.

Figure 3:

View Figure

3.4 KOALA Hero Tasksheet & Worksheets

The third component of the hybrid KOALA Hero Toolkit is a tasksheet, including accompanying worksheets, for families to complete together. The tasksheet (Figure 3 a) is designed to weave together and offer directions for families to effectively navigate through the KOALA Hero tracker app and utilize the KOALA Hero data cards. The tasks include selecting 3 most used apps by the children (one social media app, one gaming app, and one educational app) on their device, creating a context for children and parents to have more situated reflection on their own experience. For each of the selected app, the participants were first instructed to go through their chosen app using the KOALA Hero tracker app to learn about the different trackers associated with this app, and where their data is being sent to, supporting their cognitive understanding of the datafication risks around them. They were then instructed to play around with the data cards, and to discuss topics around the collection, transmission and the processing of their data. Finally, participants were instructed to control and manage the trackers associated with this app through the KOALA Hero tracker app and discuss their decisions. Through combining digital (KOALA Hero tracker app) and physical (KOALA Hero data cards) resources, this component fosters meaningful discussions between children and parents, encouraging critical reflection on the data collected and its potential implications for data transmission and processing. It also encourages exploration of the larger structures and processes behind the mobile data, uncovering deeper datafication risk considerations. The participants were given a set of three worksheets (Figure 3 b) in total, with each worksheet being identical in format. Each worksheet was designated for recording their observations and thoughts about a different one of the three apps they explored, ensuring organized and specific feedback for each app.

4.1 Study Overview

In our study, we aim to address our three research questions: firstly, to explore how families currently perceive and navigate datafication risks; secondly, to assess how our toolkit might influence families’ perceptions of datafication risks; and thirdly, to explore how our toolkit can help families become better informed about these risks, while also identifying any additional support needed. Participants were invited to our lab for the study, and were asked to bring the children’s most used Android device. Our user study consisted of three parts: 1). an onboarding session, 2). activities with the KOALA Hero Toolkit session, and 3). an open-ended family reflection session. To complement our data, we also used pre-study surveys (for parents and children to complete separately) to establish a baseline of their individual perceptions and experiences on mobile privacy in the onboarding session; and post-study surveys (for families to complete together) to reflect on their joint experiences and thoughts in the reflection session. Each study was designed to last about 1.5 hours, with one parent and 1 – 3 children from the same household. Each study was facilitated by 1 – 2 researchers, who took observation notes and offer assistance without disrupting family activities, intervening only to provide technical support when needed, aiming to minimise their involvement in the family’s activities unless assistance was requested.

4.2 Participants

Participants were sourced from local schools and a public family recruitment forum starting April 2023, after obtaining institutional research ethics approval. We conducted 17 user study sessions with 23 children and 17 parents between May and June 2023. Each session consisted of a single family, typically comprising one parent and one to three children. We recognise that “family” could be a broad term, encompassing relationships like grandparents, aunts, and cousins. Yet, this study focuses on what is typically the nucleus of a family: parents, children, and siblings. This aims for an understanding of primary dynamics before potentially expanding to extended family in future studies. Each participant received a £15 e-gift card as a thank you gift for their participation.

To participate in the study, each child was required to have access to an Android device, and have a parent who was at least 18 years old, to participate alongside them. We carefully selected the age range of child participants to be between 10 and 14, for several reasons: previous research has shown that from 10 onward, children gradually transitioned away from mainly parent-guided online activities [71]; evidence has also shown that children under 13 are active users on many social media platforms despite of the age restrictions claimed by these platforms in their terms and conditions [73, 81], exposing them to a wide range of risks online [15, 88, 89, 116]. Of the 23 children, 12 were aged 10–12 and 11 were 13–14, averaging 12 years (range 10–14, s.d. = 2.06). 14 identified as boys, 9 as girls. Of the 17 parents, most were 35–44 (9), followed by 45–54 (6), and 25–34 (2). 12 were moms and 5 were dads.

Beyond considering participants’ ages, we ensured a diverse demographic background. Participants were sourced from three local schools: one private school (which charges fees to attend instead of being publicly funded), one grammar school (government-funded schools that select their pupils by means of academic performances), and one state school (government-funded schools that provide inclusive educational free of charge). For those recruited from public forums, we recorded their ethnicity, children’s school type, and parents’ education and employment status. Out of the 17 families, 7 identified themselves as Asian, 5 as White, 2 as Black, and 3 as mixed ethnicity families. 10 children were in private schools, 9 in state, and 4 in grammar. Parents held master’s (9), PhD (3), bachelor’s (3), or high school degrees (2). 12 parents worked full-time, while others were part-time-employed (2), self-employed (2), or full-time parents (1).

4.3 Data Collection

Data collection took place throughout May and June 2023, during which we conducted 17 user study sessions with 23 children and 17 parents. All sessions were audio-recorded with the participants’ consent/assent, which was obtained through signed physical forms. For the children’s assent forms, we ensured each child had a clear understanding of the study, including the fact that their interactions would be recorded and anonymised. The first and second authors transcribed the audio recordings, systematically removing all personally identifiable information pertaining to the participants or any individuals they mentioned, from session recordings, notes and transcripts. There was a total of 1586 minutes of audio data, of which 86.3% were made by the participants, and the rest were made by researchers. The median length for each session was 96 minutes.

4.4 Data Analysis

We analysed the data using a thematic approach to develop codes and themes [26]. Photographs of families’ activity sheets and their use of data cards were also consulted to complement our analysis. The thematic coding process started by dividing the transcriptions into two equal-sized sets. The first two authors independently analysed the first set of the transcriptions to derive an initial set of codes. They then met to consolidate and reconciled codes into a final codebook, with a coding agreement of Cohen’s kappa of 0.81. The first author then completed the coding of the remaining transcripts using this final codebook. Our final codebook included themes related to families’ existing perceptions of risks, families’ thought process development, noticeable family changes of perceptions of datafication and decision-making, and their desire for additional support. More specifically, results from part 1 of the study (Onboarding Session) mostly contained families’ existing perceptions and practices of navigating mobile datafication risks (RQ1). Results from part 2 of the study (Activities with the KOALA Hero Toolkit Session) mostly contained findings on how the toolkit influenced families’ perceptions and thought processes on handling mobile datafication risks (RQ2), as well as our observations on their decision-making processes and the kind of support they required (RQ3). Results from part 3 of the study (Family Reflection Session) further enriched our understanding of the support families needed (RQ3). However, it’s important to note that the findings for each of the three research questions are not strictly confined to any single part of the study. For example, families might discuss their existing perceptions and practices at any point. The study is best viewed as an integrated process where themes can emerge and be explored at any stage. The survey data has been employed as descriptive information, offering an overview on families’ perceptions and practices on mobile datafication risks, and used to enrich our analysis; however, it has not been used to identify any direct correlations or measurable effects, nor employed as a source of direct quantitative measurements.

5.1 Families’ Existing Perceptions and Practices on Datafication Risks

Here we present families’ existing perceptions and practices on datafication risks prior to using the KOALA Hero Toolkit, as reflected in their pre-study surveys and their articulations of choices during the Onboarding Session (RQ1).

Most families reported that children had their own devices, with only one using a parent’s device and another sharing among siblings. Of the children, 9 out of 23 used their devices for 1–3 hours weekly, 5 used theirs for 4–6 or 6–8 hours, and 4 used theirs for over 9 hours weekly. Most children (17/23) responded not very concerned about apps and companies collecting their data. 13 children reported neither agree nor disagree and disagree when answering I would like to discuss privacy issues with my parents. Parents exhibited a higher awareness of online risks compared to their children, but their primary focus was on online safety rather than data and privacy. For instance, 11 out of 17 parents used parental controls, mainly to limit access to age-specific apps. When discussing how they select apps for their children, 12 parents prioritized their functionality and educational value, while only one considered privacy aspects. However, a majority (14/17) expressed concern over data collection practices by apps and their parent companies. While 15 parents wished to discuss this with their children, only 3 felt confident doing so. Even though nearly all parents had prior online safety talks with their children; the discussions rarely touched on data and privacy, with 16 out of 17 parents admitted they had rarely or never addressed these issues at home.

Furthermore, as illustrated in Figure 4, families demonstrated a diverse range of understanding when it comes to the more specific data concerns, such as the collection, transmission, and processing of their data by their mobile apps:

Figure 4:

View Figure

5.2 Families’ Thought Process: From Cognitive Understanding, Situated Reflection to Critical Thinking

As families engaged in the Activities with the KOALA Hero Toolkit session, they demonstrated a variety of ways to utilise the toolkit, exhibiting many playful ways to explore and make sense of datafication assisted by our toolkit. Through this process, we observe how this usage influenced their thought process about datafication and its associated risks (RQ2).

5.3 Families’ Change in Perceptions on Datafication

The various thought processes of families also affected their perceptions about mobile datafication risks (RQ2).

5.4 Families’ Change in Decision-making and Desire for Additional Support

In this section, we outline our observations of how the KOALA Hero Toolkit facilitated collaborative decision-making among families; and the additional support they desired, as reflected upon during the Family Reflection Session (RQ3).

6.1 Impact on Families’ Thought Process

Throughout our observations we noticed a consistent progression in family participants’ thought processes. It’s noteworthy that this pattern remained consistent across all the families, despite the varying ages (10–14) of the child participants. We also observed that regardless of families’ initial understanding about datafication risks, this progression mirrored Kafai et al.’s three forms of computational thinking (Section 3): from cognitive thinking (i.e., understanding of basic computational concepts) – families figuring out basic concepts such as what are trackers, what data are being collected; to situated thinking (i.e., situate the abstract computational concepts in context children know and care about) – children connecting with their real life experiences, parents reflecting on their data practices for the children; and finally to critical thinking (i.e., supporting the questioning of larger structures and processes behind the computational phenomenon) – families questioning the dominance of tech giants, reflecting on how users are inferred and monetised in the datafied future, and making informed decisions based on their consolidating of information. While this is not a linear progression, we noticed that the cognitive and situated abilities are critical for enabling users’ critical thinking.

How was such progression achieved then? While we do not claim that the KOALA Hero toolkit are the sole factors driving this change, we notice a strong relationship between some specific design features we included and the triggering moments experienced by families, which appeared to have fueled the progression in their thought process. We identified four critical triggering moments during families’ interactions with the toolkit. The first triggering moment is when parents and children see things right before their eyes on the tracker app, supported by the information disclosure features on the KOALA Hero tracker app (e.g., trackers view and data destination view). This was the moment when almost all participants expressed surprise for the first time, expressing this either contradicted their previous beliefs or confirmed unverified suspicions. The second is when families started to read through examples on the data cards. The sentences are formulated in such a manner (e.g., “You are xxx / You did xxx last Friday”) that all families started to connect with their own experience and reflect on what they did before spontaneously. The third moment is when families documented their responses on the worksheet. This formal requirement to write down answers encourages families to integrate all their observations and speculations derived from a range of activities, such as experimenting with data cards, identifying top trackers in the tracker dashboard, observing the total number of trackers on their phone, and speculating potential data collection based on their activities. And finally, the fourth moment is when families exhibited controls on the tracker app for each of their favourite mobile apps. This transition from passive observation to active control prompts an array of discussions and critical reflections.

These four triggering moments correspond closely to the four stages of Kolb’s learning cycle [64]: Concrete Experience, learners encounter a new experience (e.g., see trackers’ existence for the first time); Reflective Observation, after an experience, learners reflect, question, and discuss (e.g., connect examples to real life data experience); Abstract Conceptualisation, learners classify concepts and draw conclusions from events (e.g, families systematically jot down their observations and refine their thoughts); and Active Experimentation, learners test out their new ideas and lessons gathered from the experience (e.g., families experimented with controlling trackers based on their reasoning).

While we do not position KOALA Hero as an education tool, our experience has shown that the use of what we call triggering moments can be valuable in promoting moments of reflection, conceptualisation and experimentation. These triggering moments can take various forms: they can be embedded as “pause” moments within systems to motivate user engagement and raise awareness; set up “game rules” that nudge users to explore with existing information; introduce “consolidation phases” for users to conceptualise their experiences; and provide opportunities for users to test their hypothesis. These ideas also resonate with several recent design principles for children, such as the Four Lenses of Play by Bekker et al [21], and Project Zero’s Agency by Design [1], which encourage the prioritization of playful elements in digital designs to enhance children’s engagement and exploration of new knowledge. We encourage future research to explore further the nuances of these design choices for offering effective engagement for families.

6.2 Implications on Family Joint Engagement

One of our research questions was to investigate how KOALA Hero could provide improved support to families in making more informed and joint decisions. Our aim was to explore whether we could provide an alternative to the existing parent-led approaches, which can undermine children’s autonomy, hinder the development of their risk coping abilities, and potentially damage trust and communication within families. Hence, we integrated design elements that fostered families’ situated reflection and enriched their experience with playful physical components and activity sheets.

Our observations indicate that KOALA Hero enhanced family engagement, with several instances of active negotiation and collaboration for collective decision-making, suggesting the toolkit’s positive influence on family joint engagement. Previously, it was commonly assumed that parents, due to their greater expertise, would take the lead in guiding their children’s navigation of the digital space [87]. However, our observations indicate that, particularly in the context of datafication risks, this assumption may not always apply. We noted a shift in expertise dynamics, with parents not always leading and children sometimes initiating discussions. While we observed some tensions in families making joint decisions—for instance, when parents noticed the large number of trackers related to an app and wanted to disable it completely, despite it being the child’s favorite and most-used app—the friction tended to be minor, and families generally found a way out. This was mainly because our toolkit offered a more moderate approach by allowing families to turn off only certain types of trackers. Moreover, our toolkit provided a joint learning experience for families, enabling them to explore and collaborate with each other during the process. In general, all families in our study showed a trend towards more balanced engagement over time, with initially dominant members like parents or older siblings increasingly valuing others’ inputs, and quieter members becoming more vocal.

In our study, we noted instances that could be described as ‘bonding moments,’ which seemed to have encouraged joint decision-making among family members. Some of these points include moments to complete tasks that children might have superior expertise or a greater personal interest instances, such as clarifying the function of their apps or navigating the data destination view of trackers. Another set of bonding moments happened when family members encountered points of disagreements and had to engage in negotiation with each other. For example, when families used the Data Cards to discuss datafication risks, it often involved bringing up real-life examples and putting forward critical arguments. Fisher [38] and Wegerif [102] proposed that there are three distinct types of conversations when guiding children’s involvement in collaborative activities, namely disputational talk (i.e., disagreements and counter-assertions), cumulative talk (i.e., speakers build positively but uncritically on what the other has said), and exploratory talk (partners critically yet constructively engage with each other’s ideas, providing justifications and alternatives). All three types of talks were observed within our family participants. In particular, we noticed that when families engaged with our toolkit, such as using Data Cards and relating app information to real-life scenarios, it appeared to influence a shift from initial disputational talk (simply expressing disagreement without deep engagement or reasoning) [102], to more explorative discussions. In these discussions, statements and suggestions were not just exchanged but also critically examined, with challenges being justified and alternative ideas presented, aligning with the principles of exploratory talk as described by Mercer and Barnes [20, 69].

Though exploratory talk is often seen as an ideal outcome for constructive interactions between parents and children [20, 103], it doesn’t naturally occur just because they are using the same device [27, 113]. Factors like parental dominance [52, 99] and challenges in recognizing shared goals [95, 108] can impede this process. Guidelines such as Playful by Design [56] suggest considering age-appropriateness and open-ended play to promote a balanced and explorative learning environment in families. Our observations of ‘bonding moments’ offer insights that complement these guidelines, highlighting the potential of designing shared experiences to enhance family joint engagement. However, these are preliminary findings and require further empirical investigations, and we recommend that future designs consider incorporating features that might support these dynamics for further investigation.

6.3 Implications on Legislative and Policy Development

Our study unveiled grave concerns among families regarding the impact of datafication on children. Families expressed their apprehensions about the influence of data inference and collective profiling on society at large. They voiced discomfort about the apparent data monopoly held by a select few tech giants. Children were particularly anxious that every aspect of their lives was being datafied and used in hidden ways to shape their thoughts and actions (“have to have a strong mind” C4, age 11). Parents echoed these concerns and extended them to worries about their children’s future in a heavily data-driven society, with inadequate safeguards in place (“legislation that actually works” P7). Both parents and children yearned for greater transparency regarding how major platforms (e.g., Google, Meta, Amazon) utilise their data. At the same time, we observed how families transitioned from initially knowing little about the implications of datafication risks to developing heightened cognitive awareness of these issues and a strong desire for change. While our toolkit shows promising impact on users’ perceptions, addressing all these complex issues likely exceeds the scope of a single toolkit.

The robust demand from families necessitates a fundamental reassessment of current legislative and policy development regarding children. However, current regulations across the globe mainly address traditional online safety issues for children, such as harmful content and stranger dangers [76, 98]. Examples include the US’s Kids Online Safety Act [10], mandating account setting safeguards for minors, the UK’s Online Safety Bill [76], focusing on illegal content and age verification, and China’s Cyberspace Protection Regulations [6], enforcing protection against inappropriate content with strict penalties. While there is an increasing number of legislative efforts globally specifically targeting children’s online safety, subtler risks associated with datafication largely remain under the radar. Recent initiatives such as ‘Child Rights by Design’ by the Digital Futures Commission [4], and ‘Responsible AI for Social Empowerment and Education’ at MIT [13] provided useful starting points by addressing child-centric AI technologies, though with less emphasis on data-centric perspectives. Meanwhile, projects such as ‘Agile-EDU’ [36] explore data in educational systems, laying a solid foundation for understanding data in everyday contexts. Our research highlights a clear demand from children and their families for enhanced ability to access and control, particularly from a data perspective, and an immediate impact on their perception of datafication risks through raised awareness. This calls for a comprehensive revision of the current data governance framework related to technologies accessible to children and more targeted legislation addressing families’ specific datafication concerns. We advocate for sustained exploration into the creation of comprehensive ethical data governance systems, replacing the current data-driven approach to innovation and re-balancing the power between users and platforms, allowing families to assert their data rights and setting the groundwork for a more ethical data landscape in our society.