'No telling passcodes out because they're private': Understanding children's mental models of privacy and security online

Children under age 12 increasingly use Internet-connected devices to go online. And while Internet use exposes people to privacy and security risks, few studies examine how these children perceive and address such concerns. To fill this gap, we conducted a qualitative study of 18 U.S. families with children ages 5-11. We found that children recognized certain privacy and security components from the contextual integrity framework, but children ages 5-7 had gaps in their knowledge. Children developed some strategies to manage concerns but largely relied on parents for support. Parents primarily used passive strategies to mediate children's device use and largely deferred teaching children about these concerns to the future. We argue that helping children develop strong privacy and security practices at a young age will prepare them to manage their privacy and security as adolescents and adults. We offer recommendations to scaffold children's learning on privacy and security.