🛡️ ChildSafe AI Compliance Report

Document: KidGuard UK — Privacy Policy & Safeguarding Overview · Generated: 06/10/2026, 11:32:00 · Report ID: fe-kg-9214

50/ 100

🟡 MEDIUM RISK · SIGNIFICANT GAPS IDENTIFIED

KidGuard’s privacy policy currently exhibits a deficient compliance posture with an overall score of 50/100 (medium risk), underpinned by critical vulnerabilities across both UK GDPR (50/100) and the Children’s Code (52/100). The most severe shortcomings include the complete failure to establish and document lawful bases under UK GDPR Article 6 for processing children's communications and call logs, alongside a direct breach of Children’s Code Standard 4 (Transparency) due to the absence of any child-facing privacy information. Operating child-monitoring software without these mandatory safeguards exposes the organisation to urgent regulatory intervention, including formal ICO enforcement notices and substantial administrative fines. To swiftly remediate this exposure, KidGuard must immediately articulate lawful bases for each monitoring function and publish an accessible, age-appropriate privacy notice directed specifically to the children whose data is being processed.

Framework Assessment

🛡️ UK GDPR

Data Protection Act 2018 · Criteria reviewed August 2026

AMBER · 50/100

Key Statutory Findings

Robust Privacy by Design (Art. 25): Demonstrates privacy by default under Article 25 by making keyword surveillance and the AI Learning Buddy opt-in rather than pre-enabled. Prohibits third-party commercial advertising, analytics trackers, and biometric harvesting.
Storage Limitation (Art. 5(1)(e)): Enforces commendable rolling data deletion, including automated 7-day purging for call logs and SMS metadata, and 30-day deletion for flagged AI conversation snippets.
Missing Lawful Basis (Art. 6 & Art. 9): Entirely fails to identify lawful bases under Article 6 for processing children's communications, as well as Article 9 conditions for potential special category data detected during keyword filtering. Simply framing the platform as a parent-managed tool does not exempt the controller from documenting a valid legal basis.
Undocumented International Transfers (Chapter V): Transmits child messages and telemetry to US sub-processors (Anthropic, OpenAI, Google, Zoho) without referencing UK International Data Transfer Agreements (IDTA) or the UK-US Data Bridge.
Omission of Mandatory Statutory Rights (Art. 13(2)): Lacks standard legal procedures for exercising comprehensive data subject rights (access, rectification, restriction, objection, complaints to the ICO), relying solely on an in-app delete button.
Gated Public Policy: The controller fails to provide its formal legal corporate name, registered office, DPO contacts, or ICO registration number, gating the legally binding full text behind an email request to privacy@kidguard-mobile.co.uk contrary to ICO transparency guidance.

UK GDPR Article Assessment

Article	Finding	Score
🟢 Art. 5: Principles	Strong data minimisation and storage limitation (7-day communications auto-deletion). Accountability documentation gated.	82/100
🟠 Art. 6/7: Lawful Basis	Monitoring operates on opt-in basis, but fails to articulate formal Article 6 legal grounds or statutory consent.	55/100
🟠 Art. 8: Children's Consent	States accounts are managed by parents, but provides no formal age-verification or parental responsibility verification.	65/100
🟠 Art. 9: Special Category Data	Keyword monitoring scans indicators of self-harm and abuse touching health data without an Article 9 gateway.	55/100
🟠 Art. 13/14: Transparency	Clear plain English summary, but acts only as a 'short version', omitting formal controller identity and DPO contacts.	60/100
🟢 Art. 17: Right to Erasure	One-tap in-app child data deletion with 35-day backup purging alongside automatic 7-day message expiry.	90/100
🟠 Art. 22: Automated Decisions	Employs Anthropic and OpenAI for automated filtering without explicit Article 22 human-in-the-loop explanation.	68/100
🟢 Art. 25: Privacy by Design	Exemplary default configuration: off-by-default monitoring, zero advertising SDKs, and rapid auto-deletion.	95/100
🟠 Art. 28: Processors	Lists key processors (Google, OpenAI, Anthropic, Zoho), but lacks confirmation of Article 28(3) contractual clauses.	60/100
🟢 Art. 32: Security	UK servers with encryption in transit and irreversible cryptographic scrubbing of log files.	85/100
🟠 Art. 35: DPIA Mandatory	Keyword surveillance and AI triage of vulnerable minors trigger mandatory statutory DPIA under Art. 35.	50/100

👥 ICO Children's Code

Age Appropriate Design Code (ICO statutory guidance)

AMBER · 52/100

Key Statutory Findings

Adherence to Privacy Defaults (Stds. 7 & 8): Off-by-default monitoring switches, rapid seven-day auto-deletion of communications, and strict minimisation that avoids addresses or dates of birth.
Protection from Commercial Exploitation (Stds. 5 & 12): Strictly prohibits commercial advertising, tracking SDKs, biometric collection, and behavioural profiling.
Violation of Transparency (Std. 4): Zero child-facing privacy information. No age-tailored notices exist for child users directly chatting with the AI Learning Buddy across the 5–8, 9–12, or 13–17 age bands.
Breach of Parental Controls Standard (Std. 11): Parental monitoring controls for SMS and call logs provide no transparency signals or visible indicators on the child device when active, undermining the child's dignity and reasonable expectation of autonomy.
Lack of Child Rights Tools (Std. 15): Rights management is restricted to parents or emailing support, lacking child-accessible, self-service tools for children to inspect or challenge data processed about them.

ICO Children's Code Standards Assessment

Standard	Assessment Finding	Score
🟢 Std 1: Best interests	Prioritises safety by refusing behavioural ads and embedding crisis intervention links (Childline/SHOUT).	88/100
🟢 Std 2: Data protection impact	Builds privacy protections directly into architecture with off-by-default monitoring. Mandatory DPIA required.	92/100
🟠 Std 3: Age appropriate	Incorporates age banding (5–8, 9–12, 13–17), but privacy text is tailored solely for parents without child tiers.	70/100
🟠 Std 4: Transparency	Readable for parents, but relegates legal terms to email request and provides zero child-facing transparency.	65/100
🟢 Std 5: Detrimental use	Prohibits commercial profiling, ad networks, tracking SDKs, and foundation model training.	95/100
🟢 Std 6: Community standards	Applies clear safety moderation across child messages and connects vulnerable users to support services.	85/100
🟢 Std 7: Default settings	Monitored features and AI Learning Buddy are disabled by default upon installation.	95/100
🟢 Std 8: Data minimisation	Avoids gathering addresses or birth dates; truncates AI inputs to 300 characters stripped of child identity.	95/100
🟠 Std 9: Data sharing	Sharing limited to functional APIs under non-training terms, but transfers outside UK lack documented safeguards.	72/100
🟠 Std 10: Geolocation	Google Maps used for lookup with location withheld from AI, but leaves background location tracking undefined.	60/100
🟠 Std 11: Parental controls	Gives parents granular control, but child receives no active indicator or alert when monitoring is active.	70/100
🟢 Std 12: Profiling	No behavioural profiling conducted for commercial targeting or product analytics.	95/100
🟢 Std 13: Nudge techniques	Avoids dark patterns, engagement nudges, or streaks that encourage children to extend screen time.	90/100
🟠 Std 15: Online tools	Offers one-tap data deletion in parent app, but provides no child-accessible tools to exercise rights directly.	70/100

🎯 Top Priority Statutory Actions

Document Article 6 Lawful Bases & Art. 9 Conditions: Formulate and publish legal bases for communications monitoring and AI safety screening.
Complete Mandatory Statutory DPIA: Document algorithmic keyword filtering and LLM risks under Article 35 UK GDPR and Children's Code Standard 2.
Execute Chapter V Transfer Safeguards: Implement UK IDTA or UK-US Data Bridge agreements with US vendors (OpenAI, Anthropic, Google).
Introduce Child-Facing Transparency (Std. 4): Deploy age-differentiated visual notices on the child device interface before activating the AI Learning Buddy.
Provide Active Monitoring Indicators (Std. 11): Implement on-device indicators so parental monitoring is transparent rather than covert.