The impact of encryption on children’s rights

This chapter explains the human rights framework that applies to children’s rights, and analyses the implications of encryption for these rights, with a particular focus on children from disadvantaged or marginalised communities.

The international human rights framework

All States, with the exception of the US, have ratified the Convention on the Rights of the Child (“CRC”). ¹⁷⁹ It is the world’s most ratified human rights treaty and so provides an internationally agreed basis for the scope and content of children’s rights. The CRC recognises civil and political rights as well as economic, social and cultural rights. The practice and jurisprudence of the Committee on the Rights of the Child (“the Committee”), through its General Comments, Communications and State Reviews, also provides authoritative guidance on how the CRC applies.

General principles

Within the CRC, the four “general principles” stand as rights in themselves and as tools to interpret and apply the other rights within the Convention.

Non-discrimination (Art. 2 CRC)

States must ensure that all of the rights within the CRC are respected for all children, without discrimination. The grounds of prohibited discrimination set out in the CRC are non-exhaustive and, to date, the Committee has recognised more than 50 grounds of prohibited discrimination. As the Committee has explained, this right requires children to have equal and effective access to the digital environment and that they not be discriminated against by being excluded from using digital technologies and services, or by receiving hateful communications or unfair treatment through those technologies.¹⁸⁰

Best interests of the child (Art. 3 CRC)

In all actions concerning children, their best interests must be a primary consideration. This right has three aspects:¹⁸¹

1. A substantive right: when making decisions that affect children States must reach an outcome that treats the best interests of children as a primary consideration.
2. A procedural right: wherever a decision is made that will affect a child, a group of children or children in general, the process must include an evaluation of the impact of the decision on the children.
3. An interpretive right: if a legal provision is open to more than one interpretation, the interpretation which most effectively serves the best interests of the child must be chosen.

Any consideration of what is in the best interests of the child must include respect for children’s right to be heard and children’s views must be given due weight.

Right to life, survival and development (Art. 6 CRC)

All children have the right to life and States are required to ensure to the maximum extent possible the survival and development of the child. Regarding the digital environment, the Committee has specifically highlighted risks “relating to content, contact, conduct and contract encompass, among other things, violent and sexual content, cyberaggression and harassment, gambling, exploitation and abuse, including sexual exploitation and abuse, and the promotion of or incitement to suicide or life-threatening activities, including by criminals or armed groups designated as terrorist or violent extremist.”¹⁸²

Right to be heard (Art. 12 CRC)

Children have the right to express their views freely in all matters that concern them and for those views to be given due weight in accordance with their age and maturity. This is not only a procedural right requiring them to have the opportunity to give their views, but also requires States to act on those views. The right also applies not only to decisions that affect an individual child, but also to those that affect children as a group.¹⁸³ The Committee has recommended that States “should involve all children, listen to their needs and give due weight to their views. They should ensure that digital service providers actively engage with children, applying appropriate safeguards, and give their views due consideration when developing products and services.”¹⁸⁴

Other key rights in the context of encryption

Evolving capacities (Art. 5 CRC)

Even though it is not in itself a general principle of the CRC, the concept of “evolving capacities” plays an important role in the realisation and application of children’s rights. It refers to the responsibility of parents (and others) to “continually adjust the levels of support and guidance they offer to a child”, depending on the “child’s interests and wishes”, as well their “capacities for autonomous decision-making” and understanding of their best interests.¹⁸⁵

Violence against children (Arts. 19, 34, 39 CRC)

States are required to take all appropriate legislative, administrative, social and educational measures to protect children from all forms of violence, including physical, mental and sexual violence. These protective measures should include social programmes to provide support to children and those who care for children, as well as other measures for prevention, identification, reporting, referral, investigation, treatment and follow-up to instances of maltreatment. States are also required to take all appropriate measures to promote the physical and psychological recovery of child victims of violence.

Freedom of expression (Art. 13 CRC)

Children have the right to free expression, including the freedom to seek, receive and impart information and ideas of all kinds. This right may be subject to restrictions where provided by law and necessary for the respect of the rights or reputations of others and for the protection of national security, public order, or of public health or morals. Applying this right, the Committee has stated that “[a]ny restrictions on children’s right to freedom of expression in the digital environment, such as filters, including safety measures, should be lawful, necessary and proportionate. The rationale for such restrictions should be transparent and communicated to children in age-appropriate measures.”¹⁸⁶ The Committee has also recommended that States should protect children from cyber aggression and threats, censorship, data breaches and digital surveillance.¹⁸⁷

Access to information (Arts. 13, 17 CRC)

In addition to the recognition of children’s right to seek and receive information and ideas of all kinds, the CRC requires States to ensure that children have access to information and material from a diversity of national and international sources, especially those aimed at the promotion of social, spiritual and moral well-being and physical and mental health. The Committee has recommended that States ensure that digital service providers comply with relevant guidelines, standards and codes and enforce lawful, necessary and proportionate content moderation rules, but that content moderation and controls are balanced with the right to protection of children’s other rights, including their rights to freedom of expression and privacy.¹⁸⁸

Freedom of association and peaceful assembly (Art. 15 CRC)

Children have the right to freedom of association and peaceful assembly. This right must not be restricted except in conformity with the law and necessary in a democratic society in the interests of national security or public safety, public order, the protection of the public health or morals or the protection of the rights and freedoms of others. The Committee has recognised that “[p]ublic visibility and networking opportunities in the digital environment can also support child-led activism and can empower children as advocates for human rights”, and “that the digital environment enables children, including children human rights defenders, as well as children in vulnerable situations, to communicate with each other, advocate for their rights and form associations.”¹⁸⁹

Right to privacy (Art. 16 CRC)

No child shall be subjected to arbitrary or unlawful interference with their privacy, family, home or correspondence, nor to unlawful attacks on their honour and reputation. Children are entitled to the protection of the law against such interference or attacks. The Committee has recognised that privacy is vital to children’s agency, dignity and safety and for the exercise of their rights.¹⁹⁰

Right to the highest attainable standard of health (Art. 24 CRC)

Children have a right to the highest attainable standard of health. In the context of the digital environment, the Committee has recognised the desire from children for “access to free, confidential, age-appropriate and non-discriminatory mental health and sexual and reproductive health services online” and recommended that States “ensure that children have safe, secure and confidential access to trustworthy health information and services, including psychological counselling services.” The Committee has also recommended that “[t]hose services should limit the processing of children’s data to that which is necessary for the performance of the service and should be provided by professionals or those with appropriate training, with regulated oversight mechanisms in place.”¹⁹¹

Access to justice

The Committee has recognised that children face particular challenges in enforcing their rights related to the digital environment, for example because of the lack of specific legislation, the difficulties in identifying perpetrators, or the lack of knowledge of their rights. The Committee therefore stated that States should ensure that appropriate and effective remedies are available for violations of children’s rights, including in the digital environment. States should provide for complaint and reporting mechanisms that are free, safe, confidential, responsive, child-friendly and accessible. They should also establish frameworks for the referral of cases and provide effective support to children who are victims. In particular, they should provide specialised training for law enforcement officials, prosecutors and judges. States should also ensure that businesses provide effective complaint mechanisms, and that agencies with oversight powers relevant to children’s rights investigate complaints and provide adequate remedies for violations of children’s rights.¹⁹²

The table below sets out an analysis of how the full range of children’s rights are engaged by encryption, whether positively or negatively.

Non-discrimination (Art.2 CRC)

The benefits of encryption

• Encryption protects the communication of all children, including those who are not aware of the benefits of encryption.
• It poses specific benefits to children from disadvantaged or marginalised groups, who face more risks online based on what they communicate, e.g. LGBT+ children, Indigenous children, children from ethnic or religious minorities, children affected by domestic violence, children engaged in political activism in settings where that poses a risk, children with disabilities.
• Encryption protects women and girls against the involuntary disclosure of information, where they face particular threats of surveillance, harassment and violence online

The risks of encryption

• Content that promotes discrimination, either generally or against specific children, can be circulated undetected in encrypted platforms.
• If law enforcement does not have access to communications because they are encrypted, they might use other data (such as metadata or behavioural signals) in a discriminatory manner.

Right to life (Art. 6 CRC)

The benefits of encryption

• Encrypted platforms keep communications private, which ensures the safety of those who would otherwise be targeted in a way that puts their lives at risk, based on the content of their communications.

The risks of encryption

• Encrypted platforms facilitate the sharing, undetected, of communications that endanger the lives of children (e.g. incitement to suicide, hate speech and incitement to violence that could result in deaths, the planning of terrorist attacks or other crimes).
• Children who have been subjected to sexual abuse perpetrated by means of encrypted channels might try to self-harm or take their lives.

Right to be heard. Freedom of expression and information (Arts. 12, 13 CRC)

The benefits of encryption

• The privacy afforded by encryption bolsters children’s freedom of expression and information. It provides them with the opportunity to express their opinions and seek, receive and impart information on a variety of topics, including political, social, cultural and religious issues, without fear of repercussions. This is particularly true of children from disadvantaged or marginalised groups.

The risks of encryption

• The spread of “bad-information” like disinformation or hate speech through encrypted channels can lead children to censor themselves when seeking information.
• Children cannot access encrypted information of interest to them or the general public without the key.

Freedom of thought, conscience and religion (Art. 14 CRC)

The benefits of encryption

• Religious minorities can use encrypted channels to communicate securely.
• By protecting the privacy of their communications, encryption can uphold the freedom of thought of those whose beliefs might not be widely accepted in society (e.g. abortion rights advocates).
• Platforms themselves cannot monitor the content of end-to-end encrypted communications, therefore they do not have data that allows them to “manipulate or interfere with children’s right to freedom of thought and belief in the digital environment, for example by emotional analytics or inference”. ¹⁹³

The risks of encryption

• Encrypted channels can be used to propagate hate speech against religious minorities, or circulate information that threatens children’s freedom of thought. ¹⁹⁴

Freedom of association and freedom of peaceful assembly (Art. 15 CRC)

The benefits of encryption

• Encryption can enable child protesters to organise without fear of being targeted for reprisals.

The risks of encryption

• Encrypted platforms could be used to propagate hate speech about certain children or groups of children (especially those disadvantaged or marginalised), who could become fearful of exercising their freedoms of association and assembly.

Privacy (Art. 16 CRC)

The benefits of encryption

• By limiting the number of people who can see what information children exchange online or access their data, encryption benefits children’s privacy. Knowing that they are not being continuously surveilled, whether online or offline, helps children to build trust with parents, teachers or others they have personal relationships with, and makes it more likely that they will ask for help when they need it.
• Privacy and trust-building are particularly important for children who have a higher risk of being targeted for what they communicate about, especially those from disadvantaged or marginalised communities.

The risks of encryption

• Encrypted services might be used to disseminate content that violates children’s privacy, such as non-consensual information and child sexual abuse material.

Protection from information and material injurious to well-being (Art. 17(e) CRC)

The benefits of encryption

• There is a danger that the protection language in Art. 17 CRC is misused to justify bans on certain types of information being made available to children (e.g. the ‘gay propaganda’ ban in Russia and some countries in Eastern Europe and Central Asia) or that it is misapplied to promote prejudice among children (e.g. through racist propaganda). Where this is the case, those who organise against the misuse of protection language can use encrypted channels to avoid being targeted.

The risks of encryption

• Encrypted channels can be used to disseminate information injurious to children’s well-being, such as child sexual abuse material or hate speech. They make it difficult to identify and remove such content and identify perpetrators.

Protection from violence and exploitation (Art. 19 CRC)

The benefits of encryption

• Encrypted services can protect children from being targeted for violence based on information they send or receive, especially where they are part of disadvantaged or marginalised groups.
• Access to children’s personal data can make them vulnerable to grooming and exploitation, but encryption helps to keep the data secure.
• Children who are sexually exploited can communicate securely through encrypted channels in order to ask for help, store or send evidence, etc.

The risks of encryption

• Encryption can facilitate violence against children, in particular sexual abuse, for example by allowing perpetrators to access and disseminate child sexual abuse material online undetected.
• Encryption keeps the communications between the child and the perpetrator private in the case of grooming, bullying or harassment, making it more difficult to investigate and prosecute abuse.

Health and health services (Art. 24 CRC)

The benefits of encryption

• Patients’ data can be shared and stored securely thanks to encryption.
• Encrypted platforms facilitate the sharing of information about health, especially where it might otherwise be censored (e.g. parents sharing pictures of their children’s health condition where automated tools might block them; information about HIV prevention and treatment shared by LGBT+ groups).

The risks of encryption

• Disinformation about health can circulate in encrypted channels without being detected.
• Encrypted platforms can be used to disseminate information that threatens children’s health, for example on eating disorders or self-harm.
• Encrypted platforms can be used to facilitate violence against children, putting at risk their physical and mental health.

Adequate standard of living (Art. 27 CRC)

The benefits of encryption

• Encryption facilitates secure financial transactions.

The risks of encryption

• None

Right to education (Art. 28 CRC)

The benefits of encryption

• Encrypted channels can be used to share educational and vocational information and guidance which would otherwise be censored.

The risks of encryption

• None.

Right to leisure, play and culture (Art. 31 CRC)

The benefits of encryption

• Encrypted platforms can be used to share information that facilitates children’s participation in cultural, artistic, recreational and leisure activity in contexts where this information might otherwise be censured.

The risks of encryption

• None.

Sexual exploitation (Art. 34 CRC)

The benefits of encryption

• Access to children’s personal data can make them vulnerable to grooming and exploitation, but encryption helps to keep the data secure.
• Children who are sexually exploited can communicate securely through encrypted channels in order to ask for help, store or send evidence, etc.

The risks of encryption

• Encryption can facilitate child sexual exploitation and abuse, for example by allowing perpetrators to communicate with each other, or to access and disseminate child sexual abuse material online undetected.
• Encryption keeps the communications between the child and the perpetrator private in the case of grooming, making it more difficult to investigate and prosecute abuse.

Abduction, sale and trafficking (Art. 35 CRC)

The benefits of encryption

• Trafficked children can communicate securely through encrypted channels in order to ask for help, store or send evidence.

The risks of encryption

• Encrypted platforms can be used by child traffickers to facilitate the abduction, sale and trafficking of children.

Protection of children affected by armed conflict (Art. 38 CRC)

The benefits of encryption

• During armed conflicts, encrypted messaging ensures secure communication among civilians, including children.

The risks of encryption

• During armed conflict, encrypted channels can be used to plan activities which threaten the right to protection of civilians, including children.

Child justice (Art. 40 CRC)

The benefits of encryption

• Encrypted data storage and transfer, for example regarding court cases involving children, can facilitate the smooth and secure administration of child justice.
• By using encryption, law enforcement can prevent leaks of investigative material.

The risks of encryption

• None.

The right to privacy - for children and for adults - has formed a central part in the debate about the regulation of encryption.

A more detailed analysis of the right to privacy, however, and its permissible restrictions can set out a framework for how to engage with regulation of encryption in a way that is children’s rights respecting, including where there may be tensions in the application of children’s rights more broadly.

Scope

Children’s right to privacy is well established in international human rights law. It is enshrined in a number of treaties and declarations, ¹⁹⁵ including, as seen above, in the CRC, which prohibits the arbitrary or unlawful interference with children’s privacy or correspondence. ¹⁹⁶ The protection of the right to privacy under the CRC is identical to that under the International Covenant on Civil and Political Rights, with the exception of the introduction of the word “child”, indicating an equivalent protection for the privacy of children as for adults.

The right to privacy plays an important role in children’s development. The Committee has stated that “[p]rivacy is vital to children’s agency [and] dignity.” ¹⁹⁷ The right to respect for private and family life under the European Convention on Human Rights, for example, has been interpreted as protecting “the right to personal development, whether in terms of personality or of personal autonomy.” ¹⁹⁸ It also includes “the right for each individual to approach others in order to establish and develop relationships with them and with the outside world, that is, the right to a ‘private social life’.” ¹⁹⁹

Privacy and protection

As the Committee has recognised, privacy enables the “exercise of [children’s] rights”. Sometimes referred to as an “enabling” or “gatekeeper” right,²⁰⁰ privacy facilitates the enjoyment of other rights including freedom of expression and information, freedom of association, freedom of thought, conscience and religion, right to health and non-discrimination.

The Committee has also acknowledged that privacy is vital to children’s dignity, safety and the exercise of their rights. ²⁰¹ Therefore the Committee recognised that privacy is not opposed to the protection of children from violence — instead, privacy has a protection element to it. Indeed, violations of the right to privacy can have very serious consequences, including physical or psychological harm. This is particularly true for children from disadvantaged and marginalised groups, as discussed below.

Restrictions

The right to privacy is qualified, not absolute, so it may be restricted in certain circumstances.

As the Committee has explained, this means that any interference with children’s privacy should be “provided for by law, intended to serve a legitimate purpose, uphold the principle of data minimisation, be proportionate and designed to observe the best interests of the child and must not conflict with the provisions, aims or objectives of the Convention”. ²⁰² According to the UN Human Rights Committee, restrictions on privacy cannot “impair the essence” of the right. ²⁰³

Regarding encryption specifically, the Committee on the Rights of the Child has stated that, “[w]here encryption is considered an appropriate means, States parties should consider appropriate measures enabling the detection and reporting of child sexual exploitation and abuse or child sexual abuse material”. ²⁰⁴ It reaffirmed the boundaries of permissible limitations under international human rights law, adding that the measures “must be strictly limited according to the principles of legality, necessity and proportionality”. ²⁰⁵

The Committee has suggested that routine and indiscriminate measures are not necessary and proportionate. For example, the Committee has highlighted that practices like automated data processing, mandatory identity verification, information filtering and mass surveillance are “becoming routine [emphasis added]” and “may lead to arbitrary or unlawful interference with children’s privacy”, which could continue to affect them later in life. ²⁰⁶ Therefore it has stated that digital surveillance and associated automated data processing should respect children’s privacy and “should not be conducted routinely, indiscriminately [emphasis added] or without the child’s knowledge”. It also emphasised that “consideration should always be given to the least privacy-intrusive means available to fulfil the desired purpose.” ²⁰⁷

The UN High Commissioner for Human Rights has used similar language, warning that a “widespread and indiscriminate impact [on the right to privacy] is not compatible with the principle of proportionality”. ²⁰⁸ The Commissioner observed that “most encryption restrictions on [privacy and associated rights] are disproportionate, often affecting not only the targeted individuals but the general population”. ²⁰⁹ The Commissioner then cautioned against “all direct, or indirect, general and indiscriminate restrictions” on the use of encryption. ²¹⁰

Regional courts have also used comparable language in judgments. Regarding persons suspected, but not convicted of offences, the European Court of Human Rights, for example, held that “the blanket and indiscriminate nature of [retention of fingerprints and DNA]” did not strike “a fair balance between the competing public and private interests”, and therefore was not a necessary and proportionate interference with the right to respect for private life. ²¹¹ Regarding traffic and location data, the Court of Justice of the European Union held that the only instance when “the general and indiscriminate retention” and “the automated analysis” of this data can be proportionate is when the duration of the retention is strictly necessary to respond to a serious, genuine, present or foreseeable threat to national security. ²¹² Regarding the content of electronic communications, the Court used even stronger language, indicating that laws which allow public authorities “access on a generalised basis” to content data compromise the essence of the right to respect for private life. ²¹³

The role of business

Private companies play a crucial role in the debate on encryption and children’s rights due to their key place in the digital environment. While the Convention sets out the obligations of States with regard to children’s rights, the Committee has recognised that duties and responsibilities to respect those rights also extend in practice to businesses.²¹⁴

The Committee has acknowledged the relevance of the UN “Protect, Respect and Remedy” (“PRR”) Framework and the Guiding Principles on Business and Human Rights, as well as the Children’s Rights and Business Principles. ²¹⁵ The PRR Framework ²¹⁶ sets out three principles: (1) the State duty to protect against human rights abuses by third parties, including business; (2) the corporate responsibility to respect human rights; and (3) the need for more effective access to remedies. The UN Guiding Principles on Business and Human Rights ²¹⁷ are a set of principles to assist States and businesses in implementing the PRR Framework. Regarding businesses, the principles rest on two elements: a policy commitment to respect human rights, and a human rights due diligence process. The Children’s Rights and Business Principles ²¹⁸ set out business actions to respect and support children’s rights. The Committee has stated that “all businesses must meet their responsibilities regarding children’s rights and States must ensure they do so.” ²¹⁹

Regarding the digital environment specifically, the Committee has affirmed that “[b]usinesses should respect children’s rights and prevent and remedy abuse of their rights in relation to the digital environment”, while States “have the obligation to ensure that businesses meet those responsibilities.” ²²⁰ The Committee has recognised that “[a]lthough businesses may not be directly involved in perpetrating harmful acts, they can cause or contribute to violations of children’s right to freedom from violence, including through the design and operation of digital services”. It has also stated that “[States] should require [businesses] to implement regulatory frameworks, industry codes and terms of services that adhere to the highest standards of ethics, privacy and safety in relation to the design, engineering, development, operation, distribution and marketing of their products and services.” ²²¹

Beyond the “privacy versus protection” paradigm: some scenarios

The full range of children’s rights interact across the debate on encryption, beyond any analysis built exclusively on privacy versus protection. The following scenarios explore various ways in which encryption impacts children’s rights, especially where those children belong to disadvantaged or marginalised groups. This section does not aim to provide an exhaustive discussion of the ways in which encryption might be relevant to them. Instead, it seeks to present situations that give a flavour of the breadth and complexity of the ethical, legal and practical issues at stake. These scenarios are intended to open up the discussion beyond the paradigm of encryption as a question of privacy or protection. The aim is to showcase children’s agency - their ability to make decisions and exercise their rights in a variety of public and private settings, and in relation to others, such as the State, their family and community, and of course businesses like social media platforms.

Encryption, children and the State

Children who live under repressive regimes, whistleblowers and activists

In relation to the State, encryption plays a crucial role in securing the communications of children who would be targeted and subjected to violence by the government if the content of their searches or exchanges was revealed. This is particularly true for children who want to exercise their civil and political rights under repressive regimes, as the first scenario shows.

While this scenario is inspired by the 2022 Iranian protests which saw children being intimidated, arrested and killed,²²³ impermissible restrictions on children’s freedom of assembly have long been documented. In the wake of the Arab Spring, children who protested in Egypt have been jailed, tortured and murdered.²²⁴ In Bahrain they were beaten and threatened with rape and electric shocks.²²⁵ In Indonesia child protesters were arrested,²²⁶ and in Thailand they were fired at.²²⁷ In Myanmar they were met with brutal crackdowns.²²⁸ Intimidations have been reported even in countries with generally strong protection of political rights and civil liberties²²⁹ - in the UK, for example, police were accused of deploying tactics meant to deter children from protesting against climate change.²³⁰

These examples show that children can be at serious risk of physical harm from the State if they do not have the means to communicate securely in order to exercise their rights. In these cases, the privacy afforded by encryption also serves children’s right to protection from violence.

Encryption also has disproportionate benefits for children who might not be directly at risk of physical violence, but whose rights are threatened by regimes which practise surveillance and censorship.

This scenario shows how the lack of encryption can put at risk children’s right to seek, receive and share information, as well as express themselves on a variety of topics of concern to them. Some States, such as China through its Great Firewall,²³³ have created complex systems of online censorship, which directly threaten children’s rights. A field experiment with Chinese university students on the effects of providing access to an uncensored Internet found that “modest and temporary incentives to visit Western news outlets led to a persistent increase in students’ acquisition of politically sensitive information”, and that the “acquisition of politically sensitive information brings broad, substantial and persistent changes to students’ knowledge, beliefs, attitudes and intended behaviours”, for example discussing political topics with others.²³⁴

Freedom of expression and information is particularly important in the current political context, where authoritarianism is on the rise. Some experts fear that “the global order is nearing a tipping point” and that if freedom is not guaranteed, “the authoritarian model will prevail”.²³⁵ And “freedom of expression is the first right authoritarian leaders attack as they move to undermine democracy” because “the defining battle for power is a battle to control the narrative.”²³⁶ The importance of encryption becomes apparent in a world where over a third of the population live in countries which are “not free”²³⁷ or where freedom of expression is “in crisis”.²³⁸

Regarding children who are part of specific groups, encryption is important for protecting their safety where belonging to disadvantaged or marginalised communities exposes them to state violence, as the following scenario shows.

Encryption poses particular benefits to LGBT+ young people from countries (for example, the United Arab Emirates) which criminalise homosexuality, block LGBT-related content, and monitor chat rooms, instant messages, and blogs²⁴⁰. At the same time, child protection advocates have emphasised that evidence suggests that children who identify as LGBT+ and/or disabled are more likely to experience online sexual harms during childhood²⁴¹, with LGBT+ young people being pressured into sharing sexual images more than their heterosexual peers²⁴².

Where children from disadvantaged or marginalised groups want to blow the whistle on the systemic abuse they are subjected to, encryption can play a relevant role, as the next scenario shows.

Digital privacy advocates²⁴⁴ and providers of end-to-end encrypted services²⁴⁵ have warned that traceability provisions undermine the privacy and security guarantees of end-to-end encryption. They argue that, since it is not possible to know in advance which messages governments would want to trace, traceability provisions in effect mandate that messaging services, through logs of metadata, keep track of who sent something to whom and when for every message. They also caution that these provisions are not effective, since the originator and the creator of content might not be the same person - for example, if a person simply downloads an image and then shares it, they would be considered an originator of that image²⁴⁶.

But end-to-end encryption remains critical for children who want to expose injustice. As Edward Snowden put it simply, “It would have been impossible for me to whistleblow without encryption”²⁴⁷.

Children who make decisions about their own body

Even where children do not take part in activism but simply want to make decisions regarding their own body, for instance, the State can interfere in ways that put many of their rights at risk. Encryption therefore becomes relevant to protect those rights, as the next example shows.

The debate on abortion rights has at its core the principle of bodily integrity. It is the idea that everyone, including children, has the right to autonomy and self-determination over their own body²⁴⁸. This principle is being disproportionately infringed in the case of children, who are more often than adults subjected to practices regarding their body which they do not consent to²⁴⁹. Unreasonable restrictions on abortion violate bodily integrity, and they also put at risk the general principles underpinning the CRC, from non-discrimination and best interests of pregnant children to their right to life and right to be heard in the matters which affect them. These restrictions also threaten a range of other children’s rights, such as the right to health, freedom of information, privacy, freedom of thought, and the right to be free from mental violence²⁵⁰.

Although the Committee has urged States to decriminalise abortion to ensure that girls have access to safe abortion and post-abortion services²⁵¹, abortion remains illegal or restricted in a number of countries around the world²⁵². Encryption is therefore particularly important for pregnant under-18s who want to understand what options are available to them in order to exercise their right to make decisions over their own body, without fearing repercussions.

That encryption has very practical implications for pregnant children is proved by a case from the US, where it was reported that Facebook contributed evidence in an abortion prosecution, by handing over to the police unencrypted messages between a pregnant 17-year-old from Nebraska and her mother discussing abortion pills²⁵³. Especially in light of the decision by the US Supreme Court to overturn after almost 50 years the constitutional protection for abortion in Roe v. Wade²⁵⁴, many technology experts in the US and elsewhere have called on companies to limit the extent of data they collect and retain which might be used to ascertain information about users’ reproductive health²⁵⁵. One of the ways platforms can minimise the amount of data they gather is by expanding end-to-end encryption.

Children disproportionately affected by general rights limitations under the law

More generally, the debate on encryption, children and the State should also include a discussion of the restrictions on human rights that governments can place under international law and how the contours of these limitations might disproportionately affect children from particular communities, including in countries which do not necessarily bear the marks of authoritarianism.

Children’s rights can be restricted under states of emergency. For example, the International Covenant on Civil and Political Rights provides that States can derogate from their human rights obligations if this is “strictly required” during an officially proclaimed “public emergency which threatens the life of the nation”²⁵⁶. The COVID-19 crisis has already shown the dangers of States misusing emergency decrees to go beyond what is required to contain the spread of the pandemic and therefore permissible under law²⁵⁷.

Crucially, the derogations must not “involve discrimination solely on the ground of race, colour, sex, language, religion or social origin”²⁵⁸. Therefore, where governments limit the use of encryption in the context of a state of emergency, the question of whether this discriminates against children from ethnic and linguistic minorities, for example, should be examined carefully, as the next scenario shows.

Even where the situation does not rise to the level of state of emergency, the role of encryption should be discussed in the wider context of other State measures which limit fundamental freedoms. These restrictions might still threaten children’s rights, for example freedom of information, and disproportionately affect those from particular communities, such as religious minorities, as the next scenario shows.

One of the legitimate aims for which States can restrict some children’s rights is the “protection of national security”²⁶⁰, but this provision is susceptible to abuse by governments. In the UK, for instance, with regard to terrorism prevention, guidance provides for the monitoring of children’s online searches, but says little about the protection of their privacy. If they are wrongly identified to be “at risk of radicalisation”, children are referred to Prevent, a counter-terrorism programme which disproportionately targets Muslim children and poses serious risks to children’s fundamental freedoms, some of its practices having been found to infringe their privacy and data rights²⁶¹. Encrypted searches could therefore be one way of upholding the rights of children from religious minorities. At the same time, individuals and groups attempting to groom children and organise political violence use encrypted channels to do so. Policy discussions around the benefits and risks of encryption for children’s rights need to take such specificities into account.

Encryption, children and their family

In the case of children and their family, the debate on the role of encryption should take into account at least two contexts which have received little attention so far: the case of children whose interests or views diverge from those of their parents, and that of children who might be put at a disadvantage due to the status of their parents.

The Committee has recognised that “[t]he digital environment presents particular problems for parents and caregivers in respecting children’s right to privacy” and has specifically mentioned the risks posed by “[t]echnologies that monitor online activities for safety purposes”²⁶².

It has also acknowledged that “[p]rotecting a child’s privacy in the digital environment may be vital in circumstances where parents or caregivers themselves pose a threat to the child’s safety”²⁶³. The encryption debate should take this into account. As the next scenario shows, for example in cases of domestic violence, monitoring technologies can place children at risk.

This example highlights how children who are victims of domestic violence could be put at risk by initiatives to scan the content on their phones for sexual abuse or signs of grooming, and then notify the parents. The automatic detection process might be overinclusive, because the necessary context, which would be more apparent to a human reviewer, is missing. Images could be flagged which might be evidence of violence, but which do not in fact indicate sexual abuse or grooming. Therefore the abusive parents might be alerted when children try to seek help and send evidence. This would put children at further risk of violence due to the potential for retaliation.

So secure communication is particularly important for children who are victims of domestic violence because it allows them to communicate securely with people outside the home whom they trust, for example in order to seek help. If children store and send evidence of abuse using encryption, the abusers cannot intercept it and tamper with it. This upholds children’s privacy and protects them from physical and mental violence perpetrated by the abusers.²⁶⁴

Even if the parents do not necessarily represent a threat to their children, monitoring technologies can create difficulties for children, particularly if they start to develop views which are different from those of their parents, as the following scenario exemplifies.

The CRC states that parents have responsibilities, rights and duties to provide guidance to their children, “in a manner consistent with the evolving capacities of the child” (Art. 5). To the extent that children have the capacity to make decisions for themselves, these decisions must be respected. The Committee has specifically recognised that “[p]arents’ and caregivers’ monitoring of a child’s digital activity should be [...] in accordance with the child’s evolving capacities”.²⁶⁶

Technologies that monitor children’s communications place some children, for example those belonging to the LGBT+ community, in a difficult position. These technologies risk infringing children’s privacy by outing them to their parents when they are not ready or willing to discuss their sexual orientation or gender identity. These children are also at heightened risk of violence and abuse, for example being kicked out of the home, if their parents are not accepting of their identity.²⁶⁷ As with victims of domestic violence, end-to-end encrypted communication is therefore particularly important for LGBT+ children.

The debate on encryption and children’s rights should also highlight a group of children that have received little attention so far: those who might suffer discrimination on the basis of who their parents are, as the following scenario explores.

The CRC recognises that children are in a particular position because their status is often associated with that of their parents. Art. 2 of the CRC prohibits discrimination on the basis of “the child’s or his or her parent’s or legal guardian’s [emphasis added] race, colour, sex, language, religion, political or other opinion, national, ethnic or social origin, property, disability, birth or other status”. It also requires that the child be protected against “discrimination or punishment on the basis of the status [emphasis added], activities, expressed opinions, or beliefs of the child’s parents, legal guardians, or family members”.

The children of HIV-positive parents often face stigmatisation, discrimination and “are denied access to information, education, health or social care services or community life”.²⁶⁹ Therefore, they are at particular risk if the HIV-positive status of the parents is revealed when the parents are not able to use encryption to communicate securely.

Encryption, children and businesses

The debate on encryption and children’s rights brings to the fore the importance of businesses like social media platforms and must take into account the contexts in which they play a disproportionate role. As the scenario below shows, for example, end-to-end encryption can pose serious risks to children’s right to be protected from violence where influential encrypted platforms are being used to incite violence offline.

Businesses play a crucial part in the digital environment, but there are some political, social and economic contexts in which their influence is so significant that whether they are encrypted or not disproportionately engages children’s rights. One of the best-known examples is the role of Facebook in Myanmar. Many saw Facebook as “the internet in Myanmar”²⁷⁰, because of its primacy as a source of information and a way for the authorities to communicate with the public. However, in light of the violence which broke out against the minority Rohingya Muslims, a report by the independent international fact-finding mission on Myanmar, established by the UN Human Rights Council, found that Facebook has been “a useful instrument for those seeking to spread hate”, and that its response has been “slow and ineffective”²⁷¹. A £150 billion class action suit by the Rohingya against the company alleges that its algorithms amplified hate speech against the minority group and there was a lack of investment in local content moderators who would understand the language and cultural context. It also accuses Facebook of failing to take down specific posts inciting violence, and failing to shut down accounts, groups and pages that were fomenting tension²⁷².

It is worth underlining that all these problems were present in an environment that was not end-to-end encrypted. End-to-end encryption would make these issues even harder to tackle, as it removes platforms’ ability to detect problematic content. This shows the disproportionate impact that encrypting influential platforms has on children’s rights, especially where they belong to minority groups.

So far the main focus in the debate on encryption and children’s rights has been on the content of the communications, rather than other data, such as children’s current location, address, records of calls and texts, etc.²⁷³ But access to metadata also requires attention, particularly in the context of business activities and children’s rights. This is because, even if the content of the child’s communications is end-to-end encrypted, companies can collect this data about children, use it and share it for profit.²⁷⁴

Beyond the business context, in any case, metadata too can be revealing, as was argued in the discussion about traceability provisions. As the scenario below shows, for example, it could be also used by perpetrators in a way that puts children at risk of violence.

The terms of the debate on encryption and children’s rights should therefore be widened to take into account not just the encryption of content, but also the encryption of metadata, and consider its implications in diverse contexts.

Footnotes