Required actions
- Obtain separate verifiable parental consent before disclosing children's data to third parties, including for targeted advertising - Biometric identifiers are personal information; data retention must be limited to the stated purpose - Maintain a written information security programme and disclose third-party recipients