Children's Data Reference

Detects personal data about an identified child - children's data, records and information, minors' personal information, and parental or guardian consent records - when the phrase sits with a populated child/parent identifier and consent or account fields.

Type

regex

Confidence

medium

Confidence justification

Low: the phrases are mostly used in policy text. Enforce tiers now require a populated child/parent identifier; 85 also requires a consent or account field and children's-privacy evidence.

Jurisdictions

global

Regulations

Privacy Act 1988 (Cth), NDB Scheme (Cth), Information Privacy Act 2009 (Qld), GDPR

Frameworks

ISO 27001, ISO 27701

Data categories

sensitive-data, pii, children

Scope

narrow

Risk rating

5

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:child(?:ren)?(?:'s)?\s+(?:data|record|information|privacy|protection|consent)|minor(?:'s)?\s+(?:data|personal\s+information|consent)|parental\s+consent|guardian\s+consent|under\s+(?:16|18)\s+(?:data|consent|record))\b

Should match

• Parental consent record Child name: Riley Ashworth Age: 11 Account ID: KID-448120 Parent: Jordan Ashworth Consent obtained: 12/08/2026 via card verification User is under 13 - COPPA verifiable consent flow completed. — Child account record with populated consent fields and children's-privacy evidence (85)
• Guardian consent received Student name: Casey Rourke Parent: Jordan Rourke — Consent note with labelled child and parent fields only (75)
• Minor's personal information - age assurance escalation T-20931 Young person: Taylor Brennick DOB: 14/03/2013 Account type: Teen Age verification method: ID document check by trust and safety School: Harbourview College Safeguarding review: account restricted pending guardian confirmation. — Age-assurance escalation on a minor's account with DOB, account type and safeguarding evidence (85)

Should not match

• The children played in the park — No children data phrase matched by the Purview regex
• Child-friendly restaurant menu — No children data phrase present
• Policy guidance: this procedure explains how children's data and parental consent records are collected, stored and shared, who may access them and how long they are kept. Staff should read the privacy section before completing any form. It contains no details about any individual. — Policy/guidance text naming the topic without any populated record (65 discovery at most)
• Parental consent form Child name: ____________________ Age: ____________________ Parent: ____________________ Consent obtained: ____________________ Signature: ____________ Date: __/__/____ — Blank form with unpopulated labelled fields (placeholder guard keeps it below 75)
• News: the regulator's draft Children's Online Privacy Code would require parental consent before apps collect children's data from users under 16. — News/training prose about the topic without a populated record (65 discovery at most)

Known false positives

• Generic references to children in non-data contexts. Mitigation: Require data-specific keywords alongside children references.

References

• Regulation (EU) 2016/679 (GDPR) - Article 8 conditions applicable to a child's consent
• OAIC - What is personal information
• Privacy Act 1988 (Cth)