Step 1: Identify the need for a DPIA

Explain broadly the nature of your online service, and the current stage of design or development. You may find it helpful to refer or link to other documents. Summarise when and how you identified the need for a DPIA.

We are launching a connected tablet aimed at children between the ages of four and 12. This is a new version of an established tablet originally launched in 2018 with updated app features. Over 500,000 copies of the original tablet have been sold in markets in the USA, Europe and Middle East (including the UK), and Asia.

It is an educational product which enables children to learn how to operate a tablet and develop skills such as cognitive development, problem solving, creative play, basic maths, reading comprehension, hand eye coordination and language development. It allows children to take and store photos and videos, browse the internet, listen to music and watch shows. 

The tablet uses the Google Android OS 10 operating system.

In conjunction with the tablet, we offer our own secure app store to which tablet users can connect and download age-appropriate apps, games, e-books and other products from a server operated by The Toy Company. These products are in age appropriate bands of four to five, six to nine, and 10-12 years old. Children are given a username by their parents at tablet set-up. They connect to the app store through their tablet using a tab, and are only able to see the products appropriate to their age bracket (with ages input by parents through the parental control screens). Children select the items that they want. If the item is free, they can download the app immediately to the tablet. If the app has a fee, their request triggers an email to their parents, who either confirm or reject the purchase. In the event of rejection, the children are shown an age-appropriate message advising them that the download has been rejected and to discuss their download request with their parents.

Parents are required to accept terms and conditions for the app store before it can be used by their children, and create an account for themselves and their children to use. Parents need to provide first name, last name, email address, username and password to create an account. They are able to associate a separate username and password to each child that they want to access the app store through the tablet.

Use of the app store is restricted to The Toy Company products only.

Our website does not feature content aimed at children above the age of 12.

Access to Google Play store is turned off-by-default.  Access may be enabled through the parental control screen. When parents set up the system they have the option of changing these settings permanently or enabling on a case-by-case basis.

Key features of the tablet include:

• a touchable interactive screen, microphone, camera with funny filters, MP3 player, web browser, calendar, clock and alarm;
• a series of built-in age-appropriate apps for gaming and learning, video recording, playback and editing;
• the ability to add apps, e-books, videos and music from our own website or the Google App Store. (Where a fee is charged for content, only parents may purchase apps etc. Purchases are made through the parental control dashboard);
• the ability to take and store photographs using a proprietary app with the photo stored on the tablet only. (Access to cloud based storage is turned off-by-default. Parents may turn on when they set up the system for their child);
• the ability to create and store artwork using a proprietary app with the work stored on the tablet only; and
• the ability to browse the web.

The toy is sold through online and in-shop retailers. We do not sell or deliver the tablets directly to customers. Although, we do sell downloadable content (eg apps, videos and music) for the tablet through our app store website. Apps may also be purchased through Google App Store if parents enable this feature through the product set-up stage.

We collect and process children’s personal data through in-house platform analytics and technical monitoring of children’s use of the toy. The tablet collects the game-play data from the children. We use this to provide the appropriate game level and challenges for children of different ages, and to guide the development of new features and services. We anonymise the data we collect for research and development purposes before use, and we analyse it to identify improvements to the apps and tablet. We do not share this data beyond the company.

Our tablet and apps support different age ranges: four to five, six to nine and 10 to 12. There are different settings available to different age groups if the tablet has multiple users. Games, music, and videos that feature a seven plus PEGI rating are only available to the 10 to 12 age groups.

When the tablet is launched, it asks parents to enter the date of birth for their children. Subsequent tablet launches asks children to log into their profile to ensure that the correct content is available for each individual child. In this way, each user of the tablet can only access their own content and data.

Users can access content from multiple curriculums and levels appropriate for the various age ranges. As the child plays one of our apps, the age range selection and details of the content and curriculum previously accessed are sent to our server. The server can then guide the child to the correct level based on previous progress. We do not retain or analyse data on external apps downloaded to the tablet. 

We have identified the need for a DPIA because we will be collecting and processing children’s personal data through platform analytics and technical monitoring of children’s use of the toy. This processing is included in the list published by the UK Information Commissioner’s Office under Article 35(4) of the GDPR.