Digital Privacy for Teens: Why Is Your Privacy Valuable and How Does the Law Protect It?
“A private conversation does not automatically become public property just because it can be screenshotted.”
A private conversation does not automatically become public property simply because someone can take a screenshot of it.
01 — DIGITAL REALITY: WHY IS YOUR PRIVACY VALUABLE?
In today's digital world, teenagers' lives are closely connected to online spaces. From sharing personal stories in WhatsApp groups and posting everyday moments on Instagram to playing online games with friends, digital interaction has become part of daily life. Without realizing it, every interaction leaves a digital footprint that may contain personal data.
For teenagers, digital spaces are often considered safe places for self-expression. However, legal issues can arise when the boundaries between the private domain and the public domain become unclear.
Some common situations in schools and teenage communities include:
- Sharing Screenshots (Chat Leaks): Sharing private WhatsApp conversations in public groups or on social media without the sender's consent.
- Using Photographs as Stickers: Taking a friend's facial photograph, editing it into a sticker, and adding degrading words.
- Defamatory Social Media Posts: Uploading screenshots of someone's account with insulting statements until the content goes viral.
The development of social media, educational applications, and digital platforms has led children and teenagers to share personal information online more frequently. Information such as names, photographs, locations, telephone numbers, and digital identities can be used for various purposes, making their protection an important legal issue.
This article compares Indonesia's Law No. 27 of 2022 on Personal Data Protection with the Children's Online Privacy Protection Act (COPPA) in the United States.
The comparison uses a normative legal approach by examining the scope of protection, parental consent, the obligations of digital service providers, and rights concerning personal information.
This article shows that the two legal frameworks have different focuses. Indonesia's Personal Data Protection Law broadly regulates the processing of personal data, while COPPA specifically regulates the collection and use of personal information from children under the age of 13 by covered online services.
These differences provide a basis for evaluating how digital privacy protection can be effectively implemented for children and teenagers.
02 — LEGAL ISSUE: IS PRIVACY PROTECTED BY LAW?
Have you ever created an account on an application by entering your date of birth, uploading a photograph, or allowing the application to access your location?
These activities may seem ordinary, but every piece of information provided raises questions about who collects the data, how it is used, and whether the information is shared with other parties.
Children and teenagers require special protection because they may not fully understand all the consequences of how their personal data is used.
These risks do not arise only when someone hacks an account. They can also occur when information is collected excessively, used beyond its original purpose, or shared without adequate protection.
Indonesia has Law No. 27 of 2022 on Personal Data Protection as one of the legal foundations regulating personal data processing, including children's data.
In the United States, COPPA provides specific protection for the personal information of children under the age of 13 in online services covered by the law.
The main question of this article is: How do Indonesia and the United States protect children's personal data, and what can be learned from the differences between their approaches?
Many people consider the actions mentioned above to be merely "jokes." However, Indonesian law contains clear provisions concerning the protection of privacy and personal data in digital spaces.
The main questions that need to be examined from a legal perspective are:
- Do photographs and the contents of private messages qualify as personal data?
- Does the recipient of a message or the person who possesses a photograph have the right to share it with other parties?
- When does a social media post cross the boundaries of freedom of expression and become a criminal offense?
03 — RELEVANT LEGAL FRAMEWORK IN INDONESIA: PERSONAL DATA PROTECTION LAW
To understand how the law protects teenagers in digital environments, there are four main legal foundations that need to be understood.
1. Law No. 27 of 2022 on Personal Data Protection (PDP Law)
Law No. 27 of 2022 on Personal Data Protection regulates the rights of personal data subjects and the obligations of parties that process personal data.
This law is not only relevant to technology companies. It may also apply to schools, organizations, and other service providers when they process personal data within the scope of the PDP Law.
- Definition of Personal Data: Data concerning an identified or identifiable individual, either directly or indirectly. Facial photographs, telephone numbers, names, and biometric data are considered personal data.
- Lawful Basis for Processing (Consent): Every activity involving the collection, storage, editing, or distribution of personal data must have a lawful basis for processing, one of which is consent from the data subject.
- Article 25: This provision specifically regulates the processing of children's personal data. It requires children's personal data to be processed under special arrangements and requires the consent of parents and/or guardians in accordance with applicable laws and regulations.
- Importance of Children's Data Protection: Information about children should not be treated as information that can be used freely. For example, collecting data for school administration does not automatically mean that the information may be published to the general public.
- Legal Assessment of Data Processing: In practice, the legality of processing must be assessed according to its purpose, lawful basis, type of data, and other relevant provisions. Consent is not the only consideration in every processing activity. The responsibilities of data controllers and the rights of data subjects must also be considered.
04 — THE UNITED STATES LEGAL FRAMEWORK: COPPA (CHILDREN'S ONLINE PRIVACY PROTECTION ACT)
The Children's Online Privacy Protection Act (COPPA) is a United States federal law enacted in 1998. Its implementing regulations are established by the Federal Trade Commission (FTC).
COPPA primarily applies to operators of websites or online services directed toward children under the age of 13, as well as certain services that have knowledge that they are collecting personal information from children under that age.
In general, COPPA requires covered operators to provide notice regarding their data collection practices and obtain verifiable parental consent before collecting children's personal information, unless a specified exception applies.
COPPA also includes provisions concerning parental access, information security, and limitations on data retention.
For example, an online service covered by COPPA cannot assume that children's personal information may be collected freely simply because a child completes a registration form.
The operator must assess the applicable notice and consent requirements.
However, COPPA is not a general privacy law covering all teenagers.
Because its primary scope concerns children under the age of 13, privacy protection for older teenagers must be analyzed under other applicable laws.
05 — COMPARISON BETWEEN INDONESIA'S PDP LAW AND COPPA
First, the Scope of Protection
Indonesia's PDP Law has a broad scope concerning the processing of personal data, including children's data.
COPPA specifically focuses on the collection and use of personal information from children under the age of 13 by covered online services.
Second, Parental Consent
Article 25 of Indonesia's PDP Law requires parental and/or guardian consent for processing children's personal data in accordance with applicable laws and regulations.
COPPA generally requires verifiable parental consent before collecting children's personal information, subject to certain exceptions.
Third, the Obligations of Service Providers
Indonesia's PDP Law regulates the obligations of data controllers and processors, as well as the rights of personal data subjects.
COPPA establishes specific requirements for online service operators that fall within its scope.
Fourth, Age Groups
Indonesia's PDP Law does not limit the category of children's data exclusively to children under the age of 13.
In contrast, COPPA defines the relevant age threshold as children under 13.
This difference is important when discussing the protection needs of users aged 13–17.
Therefore, the two legal systems cannot be compared based on a single indicator.
Their scope, legal obligations, implementation mechanisms, and the specific circumstances faced by children must all be considered.
06 — ILLUSTRATIVE CASE STUDY: LEARNING APPLICATIONS AND STUDENT DATA
Imagine a learning application requesting a student's full name, date of birth, photograph, location, and telephone number during registration.
The application then wants to use that information for another purpose, such as personalized advertising.
From the Indonesian legal perspective, the analysis must examine whether the processing has a lawful basis, whether the special requirements concerning children's data have been fulfilled, and whether the use of the data complies with the relevant purposes and obligations.
From the United States legal perspective, if the service and processing fall within COPPA's scope and the user is under the age of 13, the operator must assess the applicable notice and parental consent requirements.
COPPA also distinguishes consent for the collection and use of data from consent for certain disclosures to third parties.
This case is illustrative and does not represent a court judgment.
Its purpose is to demonstrate that providing data for one purpose does not automatically mean the information may be used for every other purpose.
07 — SCENARIO ANALYSIS: DISTINGUISHING ETHICAL CONDUCT FROM LEGAL VIOLATIONS
To develop legal reasoning skills, let us examine three scenarios from teenagers' everyday lives.
Scenario A: Sharing Private Chats to Humiliate Someone
Action: Sharing screenshots of a friend's personal messages in a school group chat so that others will laugh at them.
Analysis: This violates privacy and the PDP Law because it is done without permission and is inconsistent with a lawful basis for processing.
Scenario B: Sharing a Conversation to Report Threats or Cyberbullying
Action: Showing screenshots containing threats to a school guidance counselor or parents to seek help.
Analysis: This action is legally permissible because its purpose is to protect oneself and seek assistance from the relevant parties.
Scenario C: Criticizing School or Organizational Policies on Social Media
Action: Expressing an opinion about an unfair decision made during an activity.
Analysis: This constitutes an exercise of freedom of expression, provided that the criticism focuses on the decision, uses factual reasoning, and does not personally attack an individual.
08 — PRACTICAL LESSONS: THE ASK & THINK METHOD
Before uploading content, editing stickers, or sharing someone else's messages, use the following framework.
The ASK Method (Before Creating or Sharing Content)
A — Authorization (Permission)
Has the person whose face or message is being used given permission?
S — Source
Where was the content obtained? Was it obtained lawfully?
K — Kind of Use (Purpose)
What is the content being used for? Does its use show respect, or does it humiliate someone?
09 — LEXTEEN TAKEAWAY
1. Privacy Is a Shared Responsibility
Being the recipient of a message does not give someone the right to freely distribute its contents.
2. Context Is Extremely Important
Sharing evidence with the appropriate authorities to seek help is legally different from distributing the same information to humiliate someone.
3. Understand the Law Before Sharing
Having legal literacy does not mean being afraid to use social media. It means being able to use technology wisely, critically, and responsibly.
LEGAL BASIS AND REFERENCES
- Law No. 27 of 2022 on Personal Data Protection
https://peraturan.bpk.go.id/Details/229798/uu-no-27-tahun-2022 - COPPA (Children's Online Privacy Protection Act)
https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312
10 — CONCLUSION
Indonesia's PDP Law and the United States' COPPA both provide legal foundations for discussing the protection of children's personal information, but they have different scopes and mechanisms.
Indonesia's PDP Law broadly regulates personal data processing and establishes specific provisions concerning children's data.
COPPA focuses on the personal information of children under the age of 13 in online services covered by the law.
This comparison demonstrates that protecting digital privacy requires more than simply encouraging users to be careful.
Protection also depends on the obligations of service providers, data governance, and the ability of children and parents to understand their rights.
For teenagers, understanding privacy means recognizing that personal information has value and that its use must be accountable.
For policymakers and service providers, the challenge is to build digital environments that respect children's rights while allowing them to learn, communicate, and develop.
DISCLAIMER
This content is created purely for educational purposes and to share information with fellow students. It does NOT constitute official legal advice or consultation.
This article was prepared by LEXTEEN, a youth-led legal literacy initiative that aims to help students understand the law in a simpler, more critical, and more relevant way that connects with their everyday lives.
This content is intended for educational purposes and to share information with fellow students. It does not constitute legal advice, official legal consultation, or a determination that any individual has committed a legal violation.
The legal assessment of any incident must consider the relevant facts, evidence, applicable legal provisions, and relevant legal interpretations.