Children’s privacy online: legislation and protections

Service page: Digital commerce and AI lawyer: terms, privacy and direct mailing.

Which law protects children online?

Every time your child opens an app, signs up for an online game or browses YouTube, someone is collecting information about them: name, age, location, preferences. The Protection of Privacy Law, 5741-1981 prohibits invading a person’s privacy without their consent (section 1). It requires whoever asks for personal information to state whether providing it depends on consent, what it is requested for, and to whom it will be passed on (section 11). Unlike the American law (COPPA), this Law does not set a special age below which parents’ consent is required. The Privacy Protection Authority stresses one point. To use information about children for an additional purpose, such as marketing, you need separate and express consent from the parents (the Authority’s opinion on consent, גילוי דעת, of 25 February 2026).

The Privacy Protection Authority is responsible for enforcing the Protection of Privacy Law in Israel, including for minors’ data. A person who believes information about them was collected unlawfully can file a complaint with the Authority. The request to inspect the information, and the request for correction or deletion, go to the controller of the database (sections 13–14).

What must technology companies do when children are involved?

The Protection of Privacy Regulations (Data Security), 5777-2017 require security measures for every database. The security level is set, among other things, by the type of information, the number of people and the number of authorized users, not by the age of the data subjects. Every website or app that collects personal information must give notice of the purpose of the collection, of who will receive the information, of the identity of the controller of the database and how to contact them, and of the rights of access and correction (section 11 of the Law, as amended by Amendment No. 13). Consent must be informed (section 3). General “terms of use” that nobody reads will not always meet this. Using information for a purpose other than the one for which it was given, such as selling it to a third party, is an invasion of privacy (section 2(9)).

What may parents monitor, and what not?

Parents have a duty to protect their children, including in the digital world. Reasonable monitoring of a child’s online activity is legitimate. But parents have limits too: uploading personal photos of a child to the internet without the child’s consent, accessing a teenager’s private content, and sharing a child’s private conversations could all be considered an invasion of the child’s privacy. The older the child, the greater the expectation of autonomy, and the court will weigh this in disputes between parents and children on this subject.

“Sharenting”: may a parent post photos of their child online?

“Sharenting”, parents who record and post almost every moment of their child’s life on social media, raises legitimate legal questions. Experts on children’s rights in Israel and around the world point out that a child who cannot refuse does not give real consent. When the child grows up and discovers years of personal records online without ever having been asked, there is a basis for a claim of invasion of privacy and of dignity.

How do you ask for information about a child to be deleted from the internet?

Under the Protection of Privacy Law, every person, including a minor (personally or through their guardian), is entitled to inspect the information about them in a database (section 13). If the information is not correct, complete, clear or up to date, they can ask for it to be corrected or deleted (section 14). Contacting the company directly is the first step. If the company refuses, you can file a complaint with the Privacy Protection Authority, and in serious cases file a civil claim. The “right to be forgotten” in the sense of the European GDPR is not set in Israeli law. But you can demand deletion of wrong information (section 14) and deletion from a database used for direct mailing (section 17F).

A request on the child’s behalf: step by step

1. The parent, as guardian, sends the controller of the database a written, signed request for access on the child’s behalf (section 13(a) of the Law; regulation 1 of the Inspection Regulations).
2. Access must be allowed within 30 days of receiving the request (regulation 2(a)). A refusal must be given within 21 days, and silence counts as a refusal (regulation 5).
3. Did you find information that is not correct, complete, clear or up to date? Send a request to correct or delete it by registered letter (section 14; regulation 7(a)). A refusal must be given within 30 days (regulation 7(b)).
4. A refusal can be appealed to the Magistrates’ Court within 30 days of the refusal notice (regulation 8). You can also complain to the Privacy Protection Authority.
5. A database used for direct mailing: demand in writing that the information be deleted (section 17F(b)). Did you not receive written notice within 30 days that the information was deleted? You can apply to the Magistrates’ Court (section 17F(e)).

Why may children’s data not be used for advertising?

Using minors’ information for targeted advertising, without informed consent to this use, could be an invasion of privacy under the Protection of Privacy Law. “Terms of use” accepted with a click of a button are not consent to every possible use. A company that uses children’s data for marketing purposes is exposed to a civil claim and to a complaint to the Privacy Protection Authority. In addition, passing information to a third party for a purpose other than the one for which it was given is an invasion of privacy (section 2(9)), which is a civil wrong (tort) (section 4).

The child is a victim of cyberbullying: what are the legal steps?

When a minor is a victim of cyberbullying (sharing embarrassing photos, systematic harassment, threats), there are real legal tools. Threats are prohibited under the Penal Law, and harassment by means of a telecommunications facility is an offense under section 30 of the Communications (Telecommunications and Broadcasting) Law, 5742-1982. You can file a complaint with the police. In addition, the civil cause of action for defamation (Prohibition of Defamation Law, 5725-1965) also applies to online publications.