Privacy Policy


Cookie Policy

News & Media
Education & Training

Summer Academy For Global Privacy Law 2022

Engineering the data regulation(s) in an age of reform


BPH Privacy & Data Protection

Doctoral Seminars


Visiting Scholars Programme


Meet the Author Series


Brussels Privacy Symposium


Data Protection In the World Series


Enforcing Europe Series 2


Data Sustainability Series


Ad-Hoc Events


Working Papers

Data Protection & Privacy


Workshop Summaries

From BPH Events




Data Protection in Humanitarian Action



The International Observatory on Vulnerable People In data protection


Disclaimer: The resources are arranged per thematic sections to facilitate the consultation. However, we are aware of the intersections and overlaps thereof. And that AI is generating new categories outside the traditional ones. We are also aware that pre-identifying categories of vulnerable people in data processing is not possible, vulnerability being a largely contextual and elusive concept. We are not claiming to be exhaustive, but to initiate a discussion.

Do you have any suggestions as to how improve the repository? Have you come across any resource that should be included in the repository? Contact us.


- Academic writings


Caggiano, I. A. (2022). Protecting Minors as Technologically Vulnerable Persons through Data Protection: An Analysis on the Effectiveness of Law. European Journal of Privacy Law & Technology, 27. https://doi.org/10.57230/EJPLT221IAC

Crepax , T., & Tobias Mühlberg, J. (2022). Upgrading the protection of children from manipulative and addictive strategies in online games: Legal and technical solutions beyond privacy regulation. The International Review of Information Ethics, 31(1). https://doi.org/10.29173/irie480

Crepax , T. et al. (2022). Information technologies exposing children to privacy risks: Domains and children-specific technical controls. Computer Standards & Interfaces, 82(1). https://doi.org/10.1016/j.csi.2022.103624

Demetzou, K. L., Böck, L. & and O. Hanteer, O. (2018). Smart bears don’t talk to strangers: Analysing privacy concerns and technical solutions in smart toys for children. Living in the Internet of Things: Cybersecurity of the IoT – 2018, 2018, pp. 1-7, https://doi.org/10.1049/cp.2018.0005

Dolan, J. (2022). Fundamentals for a Child-Oriented Approach to Data Processing
European Data Protection Law Review, 8 (1), 7-13 https://doi.org/10.21552/edpl/2022/1/4

Grimes, S. M. (2022). The Politics of Children’s Privacy, European Data Protection Law Review, 8 (1), 14-18 https://doi.org/10.21552/edpl/2022/1/5

Lievens, E van der Hof, S., Ton Liefaard, T., Verdoodt, V.,  Milkaite, I., & Hannema, T. (2019).  ‘Submission to the Committee on the Rights of the Child in View of Their Intention to Draft a General Comment on Children’s Rights in Relation to the Digital Environment. The Child Right to Protection against Economic Exploitation in the Digital World

Macenaite, M. (2017). From universal towards child-specific protection of the right to privacy online: Dilemmas in the EU General Data Protection Regulation. New Media & Society19(5), 765-779 https://doi.org/10.1177/1461444816686327

Milkaite, I., & Lievens, E. (2020). Child-Friendly Transparency of Data Processing in the EU: From Legal Requirements to Platform Policies. Journal of Children and Media 14 (1), 5-21 .https://doi.org/10.1080/17482798.2019.1701055

Milkaite, I., & Lievens, E. (2018) Towards a Better Protection of Children’s Personal Data Collected by Connected Toys and DevicesTowards a Better Protection of Children’s Personal Data Collected by Connected Toys and Devices. (Digital Freedom Fund) https://digitalfreedomfund.org/towards-a-better-protection-of-childrens-personal-data-collected-by-connected-toys-and-devices/

Milkaite, I., & Lievens, E. (2010). Children’s Rights to Privacy and Data Protection around the World: Challenges in the Digital Realm. European Journal of Law and Technology 10(1). https://ejlt.org/index.php/ejlt/article/view/674/912

Milkaite, I., & Lievens, E. (2019). The GDPR child’s age of consent for data processing across the EU – one year later (July 2019) https://biblio.ugent.be/publication/8621651 Ingrida

Milkaite, I., & Lievens, E. (2019). The internet of toys: playing games with children’s data? In G. Mascheroni & D. Holloway (Eds.), The internet of toys: practices, affordances and the political economy of children’s smart play (pp. 285–305). https://doi.org/10.1007/978-3-030-10898-4_14

Milkaite, I., Verdoodt, V., Martens, H. & Lievens, E.Ingrida Milkaite, Valerie Verdoodt, Hans Martens, Eva Lievens, (2017) The General Data Protection Regulation and Children’s Rights: Questions and Answers for Legislators, DPAs, Industry, Education, Stakeholders and Civil Society. Roundtable Report  

Nogueira da Gama, G. C. (2020). Human Rights Challenges in Brazil: Children and Vulnerable Persons. British Journal of American Legal Studies (9)3, 461-473 https://doi.org/10.2478/bjals-2020-0010

Ong, L. L., Fox, A. K., Cook, L. A., Bessant, C., Gan, P., Hoy, M. G., … & Steinberg, S. B. (2022). Sharenting in an evolving digital world: Increasing online connection and consumer vulnerability. Journal of Consumer Affairs56(3), 1106-1126. https://doi.org/10.1111/joca.12462

Pangrazio, L., & Selwyn, N. (2018). “It’s not like it’s life or death or whatever”: Young people’s understandings of social media data. Social Media+ Society4(3). https://doi.org/10.1177/2056305118787808

Piasecki, S., & Chen, J. (2022). Complying with the GDPR when vulnerable people use smart devices. International Data Privacy Law. https://doi.org/10.1093/idpl/ipac001  

Shade, L. R., & Singh, R. (2016). “Honestly, we’re not spying on kids”: School surveillance of young people’s social media. Social Media+ Society, 2(4). https://doi.org/10.1177/2056305116680005

van der Hof, S., Lievens, E., & Milkaite, I. (2019). The protection of children’s personal data in a data-driven world : a closer look at the GDPR from a children’s rights perspective. In T. Liefaard, S. Rap, & P. Rodrigues (Eds.), Monitoring children’s rights in the Netherlands : 30 years of the UN convention on the rights of the child (pp. 77–123). Leiden University Press.

van der Hof, S., Lievens, E., Milkaite, I., Verdoodt, V., Hannema, T., & Liefaard, T. (2020). The child’s right to protection against economic exploitation in the digital world. International Journal of Children’s Rights, 28(4), 833–859. https://doi.org/10.1163/15718182-28040003

van der Hof, S., & Ouburg, S. (2022). “We Take Your Word For It” — A Review of Methods of Age Verification and Parental Consent in Digital Services, European Data Protection Law Review 8(1), 61 – 72. https://doi.org/10.21552/edpl/2022/1/10

- NGO Reports

Center for Cuntering Digital Hate (CCDH) (2022). TikTok pushes harmful content promoting eating disorders and self-harm into user’s feed. https://counterhate.com/research/deadly-by-design/

- Data Protection Authorities' Guidance

ICO (Information Commissioner’s Office) (September 2020). Children’s code – Age appropriate design: a code of practice for online services https://ico.org.uk/for-organisations/guide-to-data-protection/ico-codes-of-practice/age-appropriate-design-a-code-of-practice-for-online-services/

Irish DPC (Data Protection Commission) (December 2021). The Fundamentals for a Child-Oriented Approach to Data Processing. https://www.dataprotection.ie/en/dpc-guidance/fundamentals-child-oriented-approach-data-processing

- Laws

- Case Law

European Court of Human Rights

Gaskin v. The United Kingdom (Plenary) 10454/83  1989 https://hudoc.echr.coe.int/eng?i=001-57491

McMichael v. The United Kingdom (Chamber) 16424/90 1995 https://hudoc.echr.coe.int/eng?i=001-57923

M.G. v. The United Kingdom (Second Section) 39393/98 2002 https://hudoc.echr.coe.int/eng?i=001-60642

Tsourlakis v. Greece (First Section) 50796/07 2009 Official Language in French: https://hudoc.echr.coe.int/eng?i=001-95044 Unofficial English Translation: In pp. 153-154 https://rm.coe.int/new-caselaw-06-2021/1680a2fc58

Godelli v. Italy (Second Section) 33783/09 2012 https://hudoc.echr.coe.int/eng?i=001-113460

E.S. v. Sweden (First Section) 34209/96 2002 https://hudoc.echr.coe.int/eng?i=001-60564

Bogomovola v. Russia (Third Section) 13812/09 2017 https://hudoc.echr.coe.int/eng?i=001-174420

Omorefe v. Spain (Third Section) 69339/16 2020 Official Language in French: https://hudoc.echr.coe.int/eng?i=001-203179 Unofficial English Translation: In pp. 374-376 https://rm.coe.int/new-caselaw-06-2021/1680a2fc58

United States

Gonzalez v Google, 598 US _ [2023]  https://www.justice.gov/osg/brief/gonzalez-v-google-llc

Twitter v. Taamneh,598 US _ [2023]  https://www.oyez.org/cases/2022/21-1496

- Policy documents

Council of Europe, Recommendation CM/Rec(2018)7 of the Committee of Ministers, ‘Guidelines to Respect, protect and fulfil the rights of the child in the digital environment’, https://rm.coe.int/guidelines-to-respect-protect-and-fulfil-the-rights-of-the-child-in-th/16808d881a 

- Global Developments

Witzleb, N., Paterson, M., Wilson-Otto, J., Tolkin-Rosen, G., Marks, M. (2020). Privacy risks and harms for children and other vulnerable groups in the online environment. https://www.oaic.gov.au/__data/assets/pdf_file/0012/11136/Report-Privacy-risks-and-harms-for-children-and-other-vulnerable-groups-online.pdf

Instituto Nacional de Transparencia, Accesso a la Información y Protección de Datos Personales INAI) (Octubre 2020). Código de buenas prácticas para orientar el tratamiento en línea de datos personales de niñas, niños y adolescentes.  https://home.inai.org.mx/wp-content/documentos/pdpdoctosguias/codigobuenaspracticasnna.pdf

UNICEF (2021). The Case for Better Governance of Children’s Data: A Manifesto. https://www.unicef.org/globalinsight/media/1741/file/UNICEF%20Global%20Insight%20Data%20Governance%20Manifesto.pdf https://www.unicef.org/globalinsight/good-governance-childrens-data



- Others