1. Children’s data in GenAI EdTech
Generative artificial intelligence (GenAI) tools are increasingly embedded in digital services used in educational technology (EdTech), raising urgent questions about children’s rights and data practices. Children encounter GenAI through teacher-directed use, AI chatbots at home or school, often through integration into existing platforms such as Microsoft 365 or applications such as web browsers and assistive technologies. Children often have little say in whether or how the tools are used: adoption is typically decided by schools, teachers or platforms, not by children or by parents.
This is occurring against the backdrop of a fast-growing and data-intensive sector and the saturated digital mediation of children’s learning and leisure. The global EdTech market was valued at US$187.0 billion in 2025 and is projected to reach US$437.5 billion by 2033, growing at a pace of 10.8% from 2026 to 2033. Office of Communications (Ofcom) reports that UK child internet users aged 8–14 spend about 2 hours 59 minutes online each day on devices, rising to around four hours among 13–14-year-olds; among 13–17-year-olds, 78% say the internet helps with schoolwork, and 55% identify learning a new skill as a benefit of being online. However, how much time is spent using EdTech in and out of the classroom has yet to be systematically assessed. This combination of scale, data intensiveness and often constrained choice, especially where tools are introduced by schools, teachers or platforms, frames our study. We examine how tools already used in children’s learning organise data processing, design choices and accountability in practice today.
To examine this in practice, our study, A reality check on the Age Appropriate Design Code and GenAI in EdTech, analyses five UK case studies: Character.AI, Grammarly, MagicSchool.AI, Microsoft Copilot and Mind’s Eye. The UK Age Appropriate Design Code (AADC) is the Information Commissioner’s statutory code for online services likely to be accessed by children, underpinned by the fairness principle, translating data protection duties into 15 design standards. We ask whether these tools conform to the AADC, and what this reveals about compliance with Article 5(1)(a), mainly, data protection fairness. Building on our child rights audit of the same tools, we make a distinctive contribution to demonstrate how the AADC can serve as an audit framework for testing fairness in practice.
Grounded in socio-legal methods and a child-rights-based lens, informed by the UN Committee on the Rights of the Child’s General comment No 25 (2021), we selected tools for our audit through consultation with children and young people in the 5Rights Global Youth Ambassador network, alongside educators, policymakers, privacy engineers, developers and EdTech experts. Our work combines product walkthroughs, analysis of policies and companies’ marketing claims, review of terms and privacy policies, and browser tracking observations using Ghostery. This mixed-methods, child-rights approach informs our interpretation of the AADC standards, and our audit of children’s data lives in GenAI-EdTech.
2. Fairness: from abstract principle to design obligation
Fairness is a core but abstract principle of data protection law, and it is important for protection of vulnerable data subjects, including children. Article 5(1)(a) UK GDPR requires personal data to be processed lawfully, fairly and transparently, but in practice, fairness is treated as less concrete than lawfulness or transparency. This risks overlooking its substantive importance. For children, fairness has a distinctive protective value: a service may identify a lawful basis and provide a child-friendly privacy notice aligned with transparency rules yet still process children’s data in ways that exceed their reasonable expectations, weaken their agency, exploit their vulnerabilities or prioritise commercial interests over children’s best interests. Although compliance with fairness is often interpreted negatively, as preventing unfairness (e.g. discriminatory, exploitative or misleading, or harmful data practices, see EDPB Guidelines on Article 25)), the AADC gives fairness a more positive child-rights lens by translating fair processing into design expectations supporting children’s best interests, privacy, and other rights.
The AADC helps to make this abstract fairness principle more concrete as a design obligation: it is underpinned by fairness and sets out 15 design standards. Our AADC audit analysing data practices against these 15 standards, examines the gap between fairness as a legal principle and fairness as a design practice. Through product walkthroughs, privacy policy analysis, and tracking observations of 5 tools, we compare what each AADC standard requires with what children currently encounter in their daily lives. These are fairness concerns because they shape the conditions under which children learn, make choices, understand data practices and exercise their rights.
- The gap between AADC standards and GenAI EdTech practice
Our AADC audit found that none of the tools fully conformed to the AADC standards, while our broader child rights audit showed recurring risks to privacy, commercial exploitation, education, participation and access to remedies. Three patterns emerged across the case studies. First, privacy and safety claims were undermined by advertising or analytics cookies, unclear data-sharing practices, or consent interfaces that nudged users towards accepting tracking. Secondly, children’s apparent choices were weakened by defaults, institutional deployment, ongoing commercial data practices, or limited transparency around filtering, telemetry and data use. Thirdly, rights-enabling mechanisms were limited or absent: even tools designed with accessibility or inclusion in mind often lacked clear, child-friendly privacy information, accessible routes to remedy, or safeguards against opaque data sharing and biased outputs. Taken together, these patterns show why fairness cannot be reduced to the prevention of unfairness, and why EdTech companies must demonstrate what good, child-centred design looks like in practice.
3. What the AADC audit tells us about fairness?
Firstly, a child-rights reading of fairness requires going beyond the prevention of unfairness and detrimental use of data. The AADC supports this broader approach by directing attention to the design environment with positive actions and highlighting the importance of processing data aligned with children’s best interests. However, our findings show a persistent gap between these standards and current GenAI EdTech practices: children are not consulted in the design processes; privacy is not high by default; profiling and commercial tracking are not limited; and accessible tools for children to understand and exercise their rights are frequently absent, and data practices show that companies prioritise their own commercial interests over children’s best interests. While the AADC includes a standard on detrimental use of data, our audit shows that focusing only on harm risks overlooking whether systems are designed in ways that positively enable children’s rights. A child-rights interpretation of fairness, aligned with the UNCRC and the AADC best interests of the child standard, requires evidence that data practices and design choices support children’s rights beyond prevention of unfair data practices (e.g. detrimental use of data, discrimination).
Secondly, fairness should account for children’s constrained position within educational settings. A child using a GenAI tool for homework, assessment, accessibility or classroom participation may have little practical capacity to refuse or meaningfully choose. A child-rights approach to AI use in education, requires providers and deploying institutions to demonstrate not only necessity and proportionality, but also that processing serves children’s best interests, including their educational interests, and that children’s rights can be exercised in practice.
4. Conclusion
Our audit shows that current data and design practices often undermine children’s rights and best interests by prioritising commercial incentives, exposing children to opaque data processing and inappropriate outputs when they seek help or support, and placing their rights and wellbeing at risk.
A more positive interpretation of fairness, read through the AADC standards, makes visible how design choices affect children’s rights in practice, and how more child-centred approaches can support better GenAI EdTech futures. Using the UK AADC as an audit framework, our study offers recommendations for how European digital rulebooks can move beyond fragmented child protection towards fair data and design practices that support children’s rights, privacy, agency and self-determination in digital learning environments.
AADC audit snapshot
| Table 1. Summary of how the five case studies meet the Age Appropriate Design Code (AADC) standards, in accordance with data protection law.
This table presents work in progress and provides a snapshot of the AADC audit. The analysis will be further refined and, where needed, updated for the final version of the study. |
|||||
| AADC Standard | Character.AI | Grammarly | MagicSchool | Copilot | Mind’s Eye |
| 1 Best interests of the child | ✗ | ✗ | ✗ | ✗ | ◐ |
| 2 DPIAs | ? | ? | ? | ◐ | ? |
| 3 Age-appropriate application | ◐ | ◐ | ✗ | ◐ | ◐ |
| 4 Transparency | ✗ | ✗ | ✗ | ✗ | ✗ |
| 5 Detrimental data use | ◐ | ? | ◐ | ? | ? |
| 6 Policies/community standards | ✗ | ✗ | ✗ | ✗ | ◐ |
| 7 Default settings | ✗ | ✗ | ✗ | ✗ | ? |
| 8 Data minimisation | ✗ | ✗ | ✗ | ✗ | ✗ |
| 9 Data sharing | ? | ✗ | ✗ | ? | ✗ |
| 10 Geolocation | ? | ? | ? | ? | ? |
| 11 Parental controls | ✓ | ? | ✗ | ◐ | ? |
| 12 Profiling | ◐ | ◐ | ◐ | ◐ | ◐ |
| 13 Nudge techniques | ◐ | ✗ | ✗ | ? | ◐ |
| 14 Connected toys and devices | ? | ? | ? | ? | ✗ |
| 15 Online tools | ✗ | ✗ | ✗ | ✗ | ✗ |
How to read the symbols
| ✓ | Data practice appears to conform to the AADC and is aligned with related ICO guidance. |
| ◐ | Partial or mixed alignment. More information is needed to determine whether data practices conform to or undermine the AADC standard. |
| ? | Insufficient publicly available information to assess alignment. |
| ✗ | Non-conformant to the AADC, not aligned with ICO guidance and in violation of data protection laws. |
