CHILDREN'S RIGHT TO DIGITAL PRIVACY

1. INTRODUCTION

Digital technologies are increasingly integrated into children's daily lives. Social media platforms, online games, educational applications, smart devices, and AI-powered services offer children significant opportunities for learning, communication, self-expression, and participation in social life. However, these environments can also lead to the intensive collection, analysis, sharing, and commercial use of children's personal data.

Children's names, ages, photographs, videos, voices, location information, school information, health data, online behavior, and interests constitute personal data. Because of their developmental stage, children cannot foresee the long-term consequences of processing personal data as well as adults, making them more vulnerable to digital privacy violations. The Personal Data Protection Authority also points out that children, due to their level of understanding and age, may not be able to fully assess the risks of sharing personal data in the digital environment.

A child's right to digital privacy encompasses not only the right to have their personal data not unlawfully collected, used, or shared, but also the protection of their private life and communication. This right requires not only protection against monitoring by strangers, but also the restriction of data processing activities carried out by families, schools, public institutions, app developers, advertising companies, and social media platforms.

Article 20 of the Constitution of the Republic of Turkey stipulates that everyone has the right to respect for their private and family life and to demand the protection of their personal data. This constitutional guarantee also applies to children. Personal data belonging to children should only be processed in accordance with the conditions stipulated by law; the child's age, developmental level, best interests, and special protection needs must be taken into account in data processing activities.

International law also recognizes the need to protect children's rights in the digital environment. General Comment No. 25 of the United Nations Committee on the Rights of the Child states that the rights guaranteed in the Convention on the Rights of the Child must be fully implemented in the digital environment. Accordingly, states must establish regulations that protect children's privacy, personal data, and security; take children's views into account; and ensure that digital services are designed in a way that serves the best interests of the child.

The risks to children's digital privacy are not limited to the unauthorized sharing of personal data. Behavioral advertising, location tracking, facial recognition systems, online profiling, data breaches, cyberbullying, identity theft, and the misuse of children's images by third parties can also threaten this right. The digital footprints created during childhood can remain accessible for many years, affecting a child's future education, work, and social life.

The practice of "sharenting," where parents constantly share photos, videos, and private information about their children on social media, necessitates a reassessment of the boundaries between a child's privacy and the parents' authority to represent and raise the child. Parents' power to make decisions on behalf of their child is not unlimited and must be exercised in a way that respects the child's personality rights and best interests. As a child's age and maturity level increase, obtaining their opinion regarding the sharing of information about them becomes increasingly important.

Completely blocking children's access to digital platforms under the pretext of protecting them is not a rights-based solution. A child's right to privacy must be balanced with their rights to access information, education, play, freedom of expression, and participation. Therefore, the aim is not to remove children from the digital world, but to make digital services age-appropriate, safe, transparent, and privacy-focused for children. UNICEF also emphasizes that age restrictions alone are insufficient for ensuring children's online safety, and that platforms must develop systems that respect children's privacy and participation rights.

While Turkish law does not have a single, comprehensive law regulating children's digital privacy, the Constitution, Law No. 6698 on the Protection of Personal Data, the Turkish Civil Code, the Turkish Penal Code, and other legislation concerning the protection of children are applicable. The Personal Data Protection Board's investigations into data processing practices related to children's social media use also demonstrate the need to prioritize the best interests of children in digital services.

This study will examine the scope and legal nature of children's right to digital privacy; key issues such as the protection of personal data, parental sharing, the responsibility of social media platforms, children's consent, and the right to be forgotten will be evaluated within the framework of Turkish law and international child rights standards.

2. THE CONCEPT OF DIGITAL PRIVACY

2.1. WHAT IS PRIVACY?

Privacy is the right of an individual to not have their private life, personal information, body, thoughts, communication, and decisions about themselves interfered with by others without their permission. This concept also encompasses the right of individuals to decide which information they share, with whom, to what extent, and for what purpose.

Privacy is not limited solely to the protection of physical private space. Personal data, private correspondence, photographs, health information, location data, and online activities are also covered by the right to privacy.

Digital privacy means that personal data should not be collected, shared, tracked, or misused without permission. The right to privacy, especially for children, should be protected more strongly, taking into account the child's best interests and developmental stage.

2.2. WHAT IS DIGITAL PRIVACY?

Digital privacy refers to the protection of an individual's personal information, communications, and online activities generated through the internet and digital technologies. The foundation of digital privacy lies in individuals having control over which data is collected, how it is used, with whom it is shared, and for how long it is stored.

Name, surname, photograph, voice recording, location information, search history, social media posts, private messages, health data, and device information can be considered within the scope of digital privacy. Collecting, monitoring, sharing, or using this data for commercial purposes without the person's knowledge or a valid legal reason may constitute a violation of the right to privacy.

Digital privacy encompasses not only the protection of personal data but also the confidentiality of private life and communication. Therefore, social media platforms, mobile applications, educational systems, and online services must process users' data lawfully, securely, transparently, and in a manner limited to the intended use.

Digital privacy requires stronger protection for children. Because children may not be able to fully assess the risks they may encounter in the digital environment and the long-term consequences of data sharing, their best interests, age, and developmental level must be given primary consideration when processing their personal data.

3. LEGAL BASIS OF CHILDREN'S DIGITAL PRIVACY RIGHTS

Children's right to digital privacy is not independently regulated by a single law. This right is protected through a combined assessment of national and international regulations concerning the right to privacy, the protection of personal data, the confidentiality of communication, personality rights, and the best interests of the child.

3.1. Constitutional Grounds

The fundamental constitutional basis for children's right to digital privacy is Article 20 of the Constitution of the Republic of Turkey. This article stipulates that everyone has the right to demand respect for their private and family life, that the privacy of private life cannot be violated, and that everyone has the right to demand the protection of their personal data.

The right to protection of personal data encompasses the right to be informed about data concerning oneself, to access that data, to request the correction or deletion of inaccurate data, and to ascertain whether the data is being used for its intended purposes. These constitutional guarantees apply to children as well, as they do not impose any age limit.

The freedom and confidentiality of communication guaranteed under Article 22 of the Constitution also protect children's private messages, emails, and digital communications. Unlawfully monitoring, recording, or sharing a child's online correspondence with third parties may constitute a violation of this right.

Article 41 of the Constitution imposes special obligations on the state regarding the protection of children. The state is obliged to take protective measures against all forms of abuse and violence against children. This obligation should be considered in a way that also encompasses risks arising in the digital environment, such as data abuse, cyberbullying, misuse of images, and online stalking.

3.2. Law on the Protection of Personal Data

The Law No. 6698 on the Protection of Personal Data is the fundamental legal regulation regarding the processing of personal data belonging to children. A child's name, age, photograph, video, voice, location information, school information, health data, online behavior, and device information may be considered personal data.

According to Article 4 of the Law, personal data of children must be processed lawfully and fairly, for specific and legitimate purposes, in a manner that is relevant to the processing purpose, limited, and proportionate. Data should only be stored for the necessary period and should be deleted, destroyed, or anonymized when the purpose no longer exists.

The processing of a child's personal data must be based on one of the legal processing conditions specified in Article 5 of the Law. Stricter protection rules apply to the processing of health data, biometric data, or similar special categories of personal data. The information provided to the child, given their developmental level, must be clear, simple, and age-appropriate; the consequences of data processing must be explained in a way that the child can understand.

Law No. 6698 does not specify a particular age limit for children to give consent to digital services. Therefore, when evaluating the legal validity of consent, the child's capacity to understand, age, the nature of the process, the sensitivity of the data, and the parent's authority to represent the child must all be considered. However, parental consent does not render the unlimited processing of a child's personal data lawful. In all cases, the best interests of the child and the principle of proportionality must be observed.

Data controllers are obliged to take the necessary technical and administrative measures to prevent unlawful access to and use of children's personal data. Applications targeting children, social media platforms, schools, and digital service providers are under an obligation to protect data, store it securely, and report data breaches.

The Personal Data Protection Board also conducts investigations into how social media platforms process children's data and what security measures they take, prioritizing the best interests of children. In 2026, the Board initiated ex officio investigations into TikTok, Instagram, Facebook, YouTube, X, and Discord regarding the protection of children's personal data.

3.3. Turkish Civil Code

A child's photograph, image, voice, name, honor, reputation, and private life are part of their personality rights under Articles 24 and 25 of the Turkish Civil Code. If these values ​​are used unlawfully, legal action may be taken to prevent or stop the attack, to establish the unlawfulness, and to seek compensation for the resulting damage.

The fact that a child is young does not mean that they do not have the right to an independent personality. Parental custody is not an unlimited power that eliminates the child's personality rights. According to Article 339 of the Turkish Civil Code, parents must make decisions concerning the child in their best interests; they must allow the child the opportunity to organize their own life according to their maturity and take their opinion into account on important matters.

Therefore, parents' sharing of their child's photos and videos on social media is also limited by the child's best interests. Sharing content that humiliates the child, endangers their safety, violates their privacy, or could cause them future harm cannot be considered a lawful exercise of parental rights.

3.4. Child Protection Law

Article 4 of the Child Protection Law No. 5395 states that guaranteeing the child's rights to life, development, protection, and participation; ensuring their best interests and well-being; and taking their views into account in decision-making processes are among the fundamental principles.

The law also mandates measures to prevent the identification of children in legal proceedings. This approach provides significant protection, particularly against the online publication of images, names, and other identifying information of children who are victims of crime or involved in criminal activity.

3.5. Turkish Penal Code

Severe violations of children's digital privacy can also lead to criminal liability. Article 132 of the Turkish Penal Code criminalizes the violation of the confidentiality of communication; Article 134 criminalizes the violation of the privacy of private life; Article 135 criminalizes the unlawful recording of personal data; and Article 136 criminalizes the unlawful disclosure, dissemination, or acquisition of personal data.

These provisions apply to actions such as publishing a child's private messages, recording their private images, unlawfully sharing their photos and videos, or obtaining their personal information.

3.6. United Nations Convention on the Rights of the Child

The primary international basis for children's right to digital privacy is the United Nations Convention on the Rights of the Child. According to Article 3 of the Convention, the best interests of the child must be the guiding principle in all proceedings concerning children.

Article 12 of the Convention guarantees the right of a child who is capable of forming their own opinions to express those opinions on matters affecting them and to have those opinions given weight in accordance with their age and maturity. Therefore, it is important to obtain a child's opinion on matters such as the use of their personal data and the sharing of their digital images.

Article 16 of the Convention explicitly stipulates that no child shall be subjected to arbitrary or unlawful interference with his or her private life, family, home or correspondence, and that the child has the right to legal protection against such interference.

United Nations Committee on the Rights of the Child's General Comment No. 25 states that the rights guaranteed in the Convention should also be applied in the digital environment. States should establish regulations that restrict digital service providers from profiling, monitoring, and using children's personal data for commercial purposes; and ensure that privacy is protected from the design phase of services.

3.7. European Convention on Human Rights

Article 8 of the European Convention on Human Rights guarantees everyone the right to respect for their private and family life, their home and their correspondence. This provision also applies to children, and elements such as digital communication, personal data, images and online identity can be considered within this protection.

The Convention does not only require public authorities not to interfere arbitrarily with the privacy of children. The State also has a positive obligation to create effective legislation, oversight and avenues of redress to protect children's privacy from violations by other individuals and private companies.

Overall Assessment

Children's right to digital privacy is a multifaceted fundamental right protected by the Constitution, the Law on the Protection of Personal Data, the Turkish Civil Code, the Turkish Penal Code, the Child Protection Law, and international child rights documents.

The common thread in these regulations is that the child is recognized as an independent rights holder, and their best interests are prioritized in all matters concerning them. Parents, schools, public institutions, social media platforms, and other digital service providers should only use children's personal data on a legal basis, to the extent necessary, and in a secure manner.

In conclusion, a child's young age does not mean that the right to digital privacy belongs to the parents or the platforms. The child is the owner of their own personality rights and personal data. Custody and representation powers can only be exercised in the best interests of the child.

4. ELEMENTS THAT THREATEN CHILDREN'S PRIVACY IN THE DIGITAL ENVIRONMENT

Digital environments provide children with significant opportunities for education, communication, entertainment, and self-expression. However, children's inability to fully understand how digital services work and the long-term consequences of sharing personal data makes them more vulnerable to privacy violations. Threats to children's privacy can stem not only from malicious individuals but also from the behavior of social media platforms, app developers, advertising companies, educational institutions, and parents.

4.1. Excessive Collection of Personal Data

Social media platforms, mobile applications, online games, and educational systems can collect a wide range of personal data from children, including their name, age, image, voice, location, device information, search history, and online behavior.

Collecting, storing for extended periods, or using for purposes other than those necessary for the service provided threatens a child's digital privacy. In particular, a child's inability to understand which data is being collected and with whom it is shared reduces the transparency of data processing activities. The United Nations Committee on the Rights of the Child emphasizes that data processing activities relating to children must be limited to the purpose, proportionate, and in accordance with the best interests of the child.

4.2. Online Monitoring and Profiling

Detailed user profiles can be created for children by tracking the websites they visit, the videos they watch, the searches they conduct, the games they play, and the advertisements they click on. These profiles can be used to predict a child's interests, habits, economic situation, and behavioral tendencies.

Profiling children can result in them being shown personalized ads, being directed to specific content, or having their consumption habits influenced. Children are more vulnerable than adults to persuasive and manipulative designs, making behavioral advertising a significant privacy risk. UNICEF considers the use of children's personal data for economic gain, exploitative digital marketing methods, and dark design patterns that lead users to unwanted behaviors to be risky from a child rights perspective.

4.3. Parents' Sharing of Information Regarding Their Children

When parents share photos, videos, health information, school information, and details of their children's daily lives on social media, it is called "sharenting." While these shares are often made with good intentions, they can lead to the child's private life being exposed to a wide audience.

Shared content can be recorded, modified, published on other accounts, or used in training artificial intelligence systems by third parties. Information such as school uniforms, addresses, locations, or routine details in photos can also endanger a child's safety. Furthermore, digital footprints created during childhood can affect a child's future education, career, and social life. UNICEF emphasizes that content shared online can be permanent and that children's photos can be used by others for various purposes.

4.4. Use of Location Data and Smart Devices

Smartphones, watches, toys, cameras, and location tracking apps can generate data on children's whereabouts, who they are communicating with, and their daily habits.

Storing or sharing this data with third parties without adequate security measures can endanger the child's physical safety and privacy. In particular, openly sharing real-time location information can allow malicious individuals to track the child's daily movements.

Parental monitoring apps used to protect children also need to be used with moderation. Continuous and unlimited digital surveillance can eliminate a child's right to a private space appropriate to their age and developmental level.

4.5. Cyberbullying and Impersonation

Using a child's photos, videos, or personal information to humiliate, threaten, or exclude them can constitute cyberbullying. Creating fake accounts in a child's name, altering their images, or publishing their private messages also violates the child's digital identity and privacy.

Cyberbullying can occur through social media, messaging apps, online games, and mobile devices. Publishing embarrassing photos of a child, sharing false information about them, and sending messages in their name are common forms of cyberbullying.

4.6. Online Abuse and Grooming

Malicious individuals may try to gain children's trust by contacting them through social media, chat applications, and online games. This process, aimed at obtaining the child's personal information, private photos, or videos, is referred to as online grooming.

The perpetrator may assume an identity appropriate to the child's age, establish rapport through shared interests, or offer gifts and in-game advantages. The obtained images can then be used for threats, blackmail, or sexual abuse. The Council of Europe points out that online environments allow perpetrators to reach children more quickly and anonymously.

4.7. Data Breaches and Account Security Issues

Personal data belonging to children may fall into the wrong hands if the platforms where it is stored are subjected to cyberattacks, have security vulnerabilities, or if the data is misused by employees.

Using weak passwords, repeating the same password across different platforms, and not using two-factor authentication can also make it easier for someone to compromise a child's account. If an account is compromised, private messages, photos, videos, and location information can be accessed, and posts can be made in the child's name.

Therefore, digital services for children should not only be easy to use, but also designed to comply with data security and privacy principles from the outset.

4.8. Educational Technologies and Data Processing by Schools

Online educational platforms can process students' identity, academic performance, behavior, camera footage, audio recordings, and device information. Applications used in remote examination systems, such as facial recognition, screen monitoring, and camera control, can heavily intrude on children's privacy.

Schools and educational platforms should process student data only for educational purposes and to the extent necessary. Using data for advertising, profiling, or other commercial purposes may violate a child's privacy. Forcing a child to consent to unnecessary data processing in order to access education also raises questions about whether consent is based on free will.

4.9. Artificial Intelligence and Deepfake Technologies

Artificial intelligence systems can be used to analyze children's images, voices, and personal data, to create new content, or to generate realistic fake images. Overlaying a child's photograph onto another image, imitating their voice, or creating fake content in a child's name can lead to serious privacy and security breaches.

Deepfake sexually explicit images, especially those using children's identities, constitute a severe form of abuse, even if produced without the child's consent or knowledge. UNICEF states that AI-generated or altered sexual images of children cause real and direct harm, and that platforms should not only remove such content but also take measures to prevent its dissemination.

4.10. Persistence of Digital Traces

Information, images, and comments shared during childhood can remain in digital form for many years. Even if the content is deleted, it may have been saved, screenshotted, or reposted on different platforms by other users.

This situation can lead to the child being stigmatized, excluded, or harmed in their education and working life in the future due to their past social media posts. Considering children's right to development and change, the transformation of childhood mistakes and private information into permanent digital records is a significant privacy issue.

Overall Assessment

The threats to children's privacy in the digital environment are not limited to the unauthorized sharing of personal data. Excessive data collection, behavioral profiling, parental sharing, location tracking, cyberbullying, online abuse, data breaches, and AI-powered content all pose interconnected risks.

Preventing these risks cannot be left solely to the responsibility of children or parents. States must establish effective regulatory and supervisory mechanisms; schools, social media platforms, and application developers must take security and privacy measures that prioritize the best interests of the child. The Personal Data Protection Board has also initiated an ex officio investigation into leading social media platforms regarding how children's personal data is processed and what protective measures are implemented.

In conclusion, protecting children's digital privacy is not about completely isolating them from the digital world, but about making digital services safe, transparent, age-appropriate, and based on children's rights.

5. DIGITAL PLATFORMS AND PARENTS' RESPONSIBILITIES

Protecting children's digital privacy is not a matter that can be left solely to the child's careful behavior. Because children, due to their age and developmental level, may not be able to fully assess the risks they may encounter in the digital environment, this places greater responsibilities on digital platforms and parents. The best interests of the child, personal rights, the right to privacy, and the protection of personal data are fundamental criteria in fulfilling these responsibilities.

5.1. Responsibility of Digital Platforms

Social media platforms, online games, mobile applications, and educational services may process a large amount of personal data belonging to children, such as their name, age, photograph, voice, location, device information, and online behavior. To the extent that these platforms act as data controllers, they are obligated to process children's data lawfully and securely.

Platforms should primarily collect only the data necessary for the service from children. Processing children's data for unclear purposes, for extended periods, or to a greater extent than is required for the service may violate the principle of proportionality. When data is used for advertising, profiling, or influencing user behavior, the child's developmental level and need for protection against manipulation should be given particular consideration.

According to the Law No. 6698 on the Protection of Personal Data, personal data must be processed lawfully and fairly, for specific and legitimate purposes, in a manner that is relevant to the processing purpose, limited, and proportionate. Platforms are also obliged to take the necessary technical and administrative measures to prevent unlawful access to personal data and to ensure the secure storage of data.

It is insufficient for educational materials for children to be long, complex, and technically complex. The information must be presented in clear and simple language, appropriate to the child's age and developmental level, so that they can understand which of their data will be used, for what purposes, and by whom. The United Nations Committee on the Rights of the Child also considers it necessary for information regarding digital services to be presented in a way that children can understand and for children's privacy to be protected from the design stage onwards.

Platforms should initially set privacy settings for children's accounts to the highest level of protection. Automatically making accounts public, sharing location information by default, or making it easy for strangers to find a child increases privacy risks. Measures such as limiting data collection, disabling location sharing, and filtering messages from unknown senders should be implemented as part of a secure design approach.

In cases where explicit consent is required for the processing of children's data, the validity of consent cannot be reduced to simply checking a box on the screen. The child's capacity to understand, age, the nature of the data being processed, and the potential consequences of the processing must all be considered together. Even with the consent of a legal representative, unlimited processing of children's data is not possible. In all cases, the principles of data minimization, proportionality, and the best interests of the child must be adhered to.

The responsibility of digital platforms is not limited solely to data processing activities. Easily accessible reporting and complaint systems should be established for cases such as cyberbullying, threats, impersonation, sharing of private images, and online abuse targeting children. The processes for reviewing and removing illegal content should be carried out at a pace appropriate to the protection needs of children.

The Personal Data Protection Board has also initiated an ex officio investigation into TikTok, Instagram, Facebook, YouTube, X, and Discord regarding how children's personal data is processed and what protective measures are taken in relation to their use of social media. This development shows that the platforms' data processing and security practices for children are under the supervision of public authorities.

5.2. Parental Responsibility

Parents, within the scope of their parental authority, are responsible for the care, education, and protection of their child. However, parental authority does not grant unlimited power over the child's personal rights. A child, regardless of age, possesses the right to personality and privacy. Decisions made by parents regarding their child must be in the child's best interests.

One of the primary responsibilities of parents is to be informed about the digital services their children use. They should regularly check what data the apps access, who can view the accounts, whether location sharing is enabled, and whether strangers can contact their child.

However, parental control should not mean unlimited surveillance. Constantly monitoring a child's phone, messages, and social media accounts, without allowing age-appropriate and developmental space, can violate a child's right to privacy. The scope of supervision should be proportionate to the child's age, the specific risks they face, and their need for protection.

Parents should also exercise caution when sharing photos, videos, health information, school information, and location data of their children on social media. This type of sharing, known as "sharenting," can lead to the creation of a child's digital identity before they are old enough to make their own decisions. Content published online can be recorded, modified, or used for other purposes without the child's knowledge. UNICEF recommends that parents consider their child's privacy, opinions, and the potential future consequences of sharing before doing so.

If the child's age and maturity level permit, their opinion should be sought before sharing their photograph or personal information. If the child does not wish for such sharing, this wish should, as a rule, be respected. However, the child's consent does not make every sharing legally permissible. Sharing embarrassing, private, or security-threatening content may be contrary to the child's best interests.

Parents also need to teach their children digital literacy. Children should be taught to create strong passwords, use multi-factor authentication, not share information with strangers, not share their location, and report suspicious messages to adults. The goal is not to completely isolate children from the digital world, but to enable them to participate in it safely and with an awareness of their rights.

5.3. Joint and Supplementary Liability

The responsibility of platforms and parents in protecting children's digital privacy are not mutually exclusive. Platforms must establish safe and age-appropriate systems; parents must guide their children and respect their children's rights in their own sharing of content.

A digital platform cannot justify inadequate security measures by claiming that parents were not vigilant enough. Similarly, parents cannot interpret the platform's ability to share information as unlimited permission to publish any and all information about their child.

To effectively protect children's digital privacy, the state must also monitor platforms, establish effective complaint mechanisms, and support awareness campaigns for parents. According to the United Nations Committee on the Rights of the Child, children's rights must be respected, protected, and fulfilled in the digital environment as well as in the offline environment.

In conclusion, digital platforms are obligated to process children's personal data in a lawful, secure, transparent, and proportionate manner; and parents are obligated to exercise their parental authority in accordance with the best interests of the child. A child's young age does not mean they lack an independent right to privacy. Besides being a passive individual requiring protection, a child is also an independent rights holder who possesses personality rights and should participate in decisions concerning them in a manner appropriate to their developmental level.

6. CONCLUSION

Children's right to digital privacy is a fundamental right directly linked to the principles of privacy, protection of personal data, confidentiality of communication, and the best interests of the child. While digital technologies provide children with significant opportunities for education, communication, play, and access to information, they also bring serious risks such as excessive collection of personal data, online tracking, profiling, cyberbullying, identity impersonation, parental sharing, and AI-powered content.

Because children, due to their age and developmental level, cannot fully foresee the risks they encounter in the digital environment, stronger protection of their personal data and privacy is necessary. This protection cannot be left solely to the careful actions of the child or parents. The state, digital platforms, educational institutions, application developers, and parents share responsibility for protecting children's privacy.

Digital platforms must process children's personal data only to the extent necessary, for a lawful and explicit purpose. Information for children should be provided in a simple, clear, and age-appropriate manner; privacy settings should be set to the highest level of protection by default; and children should be protected against behavioral advertising and manipulative designs. Platforms must also establish rapid and effective reporting mechanisms against cyberbullying, abuse, and illegal content.

Parental custody is also limited by the child's personal rights. Sharing a child's photos, videos, health information, school information, and location data on social media is not something parents can freely decide upon in every situation. Before sharing, the child's best interests, safety, age, maturity level, and opinions must be considered. Sharing information that violates a child's privacy or could cause future harm cannot be considered a lawful exercise of parental rights.

Parental supervision aimed at protecting a child must also be proportionate. Constantly monitoring all of a child's messages, accounts, and online activities can infringe upon their right to age-appropriate privacy. Therefore, supervision should be limited to concrete risks and appropriate to the child's developmental level.

While Turkish law lacks a comprehensive law that fully regulates all aspects of children's digital privacy, significant safeguards exist under the Constitution, the Personal Data Protection Law, the Turkish Civil Code, the Turkish Penal Code, and the Child Protection Law. Furthermore, the United Nations Convention on the Rights of the Child and the European Convention on Human Rights provide international foundations for the protection of children's private lives and personal data.

However, given the rapid development of digital technologies, existing regulations need to be made clearer in areas such as age-appropriate consent for children, online profiling, the use of artificial intelligence, parental sharing, and advertising targeting children. Developing digital services for children in accordance with security and privacy principles from the design stage will provide more effective protection than interventions made later.

In conclusion, protecting children's digital privacy does not mean completely isolating them from the digital world. The main goal is to create a digital environment where children can safely enjoy their rights to education, access to information, communication, play, and freedom of expression, where their personal data is not misused, and where their private lives are respected. A child is not merely a passive individual who needs protection; they are an independent rights holder who possesses their own personality rights and should participate in decisions concerning them in a manner appropriate to their age and maturity level.