INCLUSIVE PRIVACY AND SECURITY

It’s Still Complicated

From Privacy-Invasive Parental Control to
Teen-Centric Solutions for Digital Resilience

Jinkyung Katie Park , Mamtaj Akter , and Pamela Wisniewski | Vanderbilt University
Karla Badillo-Urquiola | University of Notre Dame

We discuss the paradigm shift from restrictive approaches toward resilience-based solutions to promote
adolescents’ online safety and well-being. We describe how restrictive strategies induce a tradeoff
between teens’ privacy and online safety and present empirical studies that examine resilience-based
approaches.

A ccording to a Pew Research report on teens,

social media, and technology, 96% of U.S. teens
use the Internet daily; 46% of them are online almost
from fear-based media narratives has bolstered legisla-
tive efforts by U.S. Senators Blumenthal and Blackburn
in proposing the Kids Online Safety Act (KOSA),2
constantly. Most teens have access to digital devices, aimed at shielding children from online risks. While
such as smartphones (95%), desktop or laptop comput- this legislation has positive aspects, some advo-
ers (90%), and gaming consoles (83%).1 A significant cacy groups, such as those that support the rights of
majority of teens reported that being social online helps LGBTQ+ youth and freedom of speech, have expressed
them feel connected, creative, and supported. Nonethe- concerns regarding the heavy use of digital surveillance
less, recent research has associated prolonged screen impeding the privacy, safety, and access-to-information
time, cyberbullying, exposure to mature media con- rights of adolescents.
tent, and problematic Internet usage with mental health Adolescence represents a distinct developmental
issues and physical safety concerns, such as online sex- phase bridging childhood and adulthood, with a primary
ual grooming and sex trafficking. objective of growing toward independence and auton-
As a result, the news media and scholarly research omy. Adolescents are often described as “digital natives”
have disproportionately emphasized the necessity for who grow up with digital technologies and are natively
restrictive measures aimed at curtailing access to tech- tech savvy. However, digital natives might actually be bet-
nology to safeguard teens. The heightened attention ter termed digital naives because most teens are still form-
ing the critical knowledge of how personal information
Digital Object Identifier 10.1109/MSEC.2024.3417804
flows and how to look for accessible information in a net-
Date of publication 12 July 2024; date of current version: 13 September 2024. worked environment.3
This work is licensed under a Creative Commons
Attribution 4.0 License. For more information,
52 September/October 2024 Copublished by the IEEE Computer and Reliability Societies 
see https://creativecommons.org/licenses/by/4.0/
 In today’s digitized world, one of the most important legal frameworks intersect with adolescent online safety
developmental tasks for adolescents is to acquire profi- and rights. In addition, we introduce a socioecological
ciency in managing online interactions and safeguard- perspective to adolescent online safety, thereby contribut-
ing themselves against digital risks. Meanwhile, society ing to a more nuanced understanding of the multifaceted
has made assumptions that adolescents are at extreme nature of online safety and the diverse factors influencing
risk because of naive digital literacy and lack of privacy adolescents’ digital experiences. As such, we shed light on
awareness and that online risk is an epidemic that plagues the transition from privacy-invasive parental mediation
adolescents. As a result, paternalistic and restrictive methodologies toward teen-centric strategies inclusive of
strategies (e.g., parental control apps) have been imple- vulnerable, marginalized, or at-risk adolescents aimed at
mented as a means to protect adolescents from online enhancing their online privacy and safety.
risk. The existing literature indicates that teens perceive
such restrictive strategies as privacy invasive.4 In addition, Related Work
such restrictive approaches may hinder opportunities for Adolescence is a unique developmental stage in which
adolescents’ healthy development. In 2014, in the book the primary developmental objective is to successfully
It’s Complicated: The Social Lives of Networked Teens, Boyd grow toward independence and autonomy. Developmen-
cautioned scholars and society at large against restrictive tally, adolescents are characterized as those between the
strategies for adolescent online safety: ages of 10 and 19. In the digital privacy literature in the
U.S. context, however, the age range for adolescents is
As a society, we often spend so much time worrying often described as between the ages of 13 and 17, focusing
about young people that we fail to account for how our on the legal implications of being a minor in the United
paternalism and protectionism hinders teens’ ability States. (The U.S. Children’s Online Privacy Protection Act
to become informed, thoughtful, and engaged adults. legally protects children under the age of 13 from unfair or
Regardless of the stories in the media, most young deceptive collection, use, and/or disclosure of their per-
people often find ways to push through the restrictions sonal information by online service providers, while age
and develop a sense of who they are and how they want 18 is the legal definition for adulthood.)
to engage in the world.3 During adolescence, teens need autonomy to indi-
viduate themselves from their parents. As they become
Over the past decade, scholars have explored how more social than younger children, they appreci-
restriction falls short in mitigating adolescent online risk ate online engagement. Some level of risk-taking and
and shifted the narratives to empowering teens through dig- autonomy-seeking is a natural and necessary part of ado-
ital resilience. In this article, we provide a brief overview of lescence, and preventing such experiences may impede
this paradigm shift that moves away from privacy-invasive their developmental growth to individuate themselves
and restrictive strategies toward teen-centric solutions for from their parents. From a developmental perspective,
adolescent digital privacy and resilience. Specifically, this adolescents are aware of online privacy risks; hence, they
article highlights the following: make careful decisions about information disclosure and
balance their desire to protect themselves with the desire
■ a critical shift from restrictive parental control mea- to socialize online.5 Although there is little evidence that
sures to resilience-based, teen-centric approaches, online technology creates more harm than benefits for
acknowledging the evolving digital autonomy of ado- teens, mounting concerns around how social media and
lescents and emphasizing the importance of empow- the increased use of personal digital devices negatively
ering them to manage online risks effectively impact adolescent development and mental health have
■ an overview of research that focuses on the effectiveness led to a moral panic. This has led to restrictive approaches
and implications of teen-centric and resilience-based that aim to shield adolescents from online experiences
approaches, which offers evidence-based insights for rather than teaching and empowering them to be resilient
parents, practitioners, and policymakers against these new online challenges.
■ key design implications for parents, designers, prac- This trend toward paternalistic approaches to pro-
titioners, policymakers, and researchers in the space tect youth online is evidenced by state-level legislation
of privacy and adolescent online safety for building to ban TikTok and social media use for younger teens;
privacy-protective and resilience-promoting online civil mass tort lawsuits against social media platforms;
safety solutions. and national legislation, such as the KOSA in the United
States, a comprehensive bipartisan legislation proposed
In doing so, we discuss recent legislative efforts and by U.S. senators in 2022.2 This proposed legislation
their potential impacts on adolescent privacy and auton- mandates that commercial platforms, including but
omy, hence contributing to the critical analysis of how not limited to social media platforms, take proactive

www.computer.org/security 53
INCLUSIVE PRIVACY AND SECURITY

measures to mitigate harm to minors, such as address- Restriction as a Means to Protect

ing issues related to the promotion of self-harm, suicide, Adolescents From Online Risk
and sexual exploitation. Furthermore, it necessitates The landscape of adolescent online safety is complex,
independent audits and encourages public scrutiny with evolving strategies to mitigate risks and foster re-
from experts and academic researchers to ensure that sponsible digital behavior. Parental mediation, ranging
these platforms are effectively undertaking meaningful from monitoring to active engagement, significantly in-
actions to address risks faced by teens. fluences adolescents’ online experiences. While restric-
All of these may have good intentions but, to some ex- tive mediation approaches monitor and regulate online
tent, may ignore or dismiss adolescents’ agency as well as activities, active mediation strategies prompt discussions
their rights to information, freedom of expression, digital on balancing protection with autonomy as teens mature.
technology, and civic Concurrently, socio-
engagement. For in- technical interventions,
stance, teen privacy ad- like age verification and
vocates are concerned risk detection, aim to
that the enactment of Adolescence is a unique developmental enhance safety by re-
KOSA may incentivize stage in which the primary developmental stricting access to inap-
social media platforms objective is to successfully grow toward propriate content and
to gather even more identifying threats in
data about children to independence and autonomy. real time. However, con-
prevent a specific set of cerns about privacy, sur-
harms to minors. Un- veillance, and adolescent
intentionally, KOSA autonomy emphasize
could lead social media the need for nuanced
platforms to use broad content filtering measures, limit- approaches to empowering teens to manage their online
ing minors’ access to certain online content, such as sex risks. This section explores parental control, sociotechni-
education tailored for LGBTQ youth, which schools cal interventions, and regulatory measures in adolescent
had previously implemented in response to earlier leg- online safety, revealing the challenges and overlapping in-
islation. As such, while restrictive approaches to adoles- terests involved.
cent online safety may offer protection from online risks,
they may also come at the expense of the digital privacy Parental Mediation for Adolescent
rights of teens and opportunities for teens to access Online Safety
valuable online resources and support, particularly Parental mediation encompasses a spectrum of strate-
salient for vulnerable teens who do not have support gies, ranging from restrictive mediation and monitor-
systems. Therefore, taking a fear-based and controlling ing to active mediation. Restrictive mediation, such as
approach disproportionately focused on adolescent parental control apps, involves parents limiting their
vulnerability does not prepare teens for future online children’s access to social media or establishing rules
adversity, nor does it productively advance the field. regarding appropriate media content and exposure.
What is needed, then, involves new insights from em- Parental control applications are frequently employed
pirical study and a multidimensional interpretation of to monitor teens’ online activities, providing parents
the context surrounding adolescent behaviors and ex- direct access to teens’ online content, such as visited
periences online. websites, geolocation data, text messages, call logs, and
Over the past decade, Dr. Pamela Wisniewski mobile app usage (e.g., the Life360 location-sharing app
and colleagues have examined evidence-based and and the Bark parental control app). Such approaches are
teen-centered approaches that empower adolescents by particularly pertinent for younger children and ado-
enhancing risk-coping, resilience, and self-regulatory lescents (aged eight 12), aiming to shield them from
behaviors so that they can learn to protect themselves premature exposure to adult media content. How-
more effectively from online risks. In this article, we ever, teens mostly find parental control tools invasive
summarize the concepts and outcomes from collabora- and damaging to their relationship with their parents.
tive work that shift the narratives from restriction toward Therefore, instead of restricting and stalking their chil-
evidence-based and teen-centered online safety solu- dren, parents will have to use active measures to educate
tions for digital resilience. As such, this article provides children about the security and privacy threats online.4
implications for parents, designers, practitioners, policy- As adolescents mature, they require opportunities
makers, and researchers in the space of privacy and ado- to develop skills in risk assessment, problem-solving,
lescent online safety. and seeking help to independently manage potential

54 IEEE Security & Privacy September/October 2024

online risks. Additionally, relying solely on restric- Another trend is the use of artificial intelligence-based
tive approaches to online safety may be ineffective in tools to detect a wide variety of harmful online content,
protecting adolescents from online risks, as it limits largely within big technology companies. Given the mag-
the potential opportunities for youth to interact with nitude of the online content under scrutiny, the adoption
others online. Therefore, active digital parenting prac- of automated detection mechanisms is gaining momen-
tices, such as open communication about online risks, tum, as the human-based alternative is deemed largely
the joint use of digital technologies with teens, and the unfeasible. The underlying premise of data-driven risk
facilitation of access to beneficial online content, are detection technology posits that the systematic collection
important, as they foster youth development toward of personal data enables the identification of emerging
safe and autonomous online engagement. Such active threats, facilitating targeted and proactive interventions.
mediation is effective, as it involves parents having dis- However, the compilation of datasets to train machine
cussions with their children regarding the undesirable learning (ML) algorithms introduces additional privacy
aspects of media consumption and advising them on and surveillance concerns, as it necessitates the utiliza-
appropriate ways to engage with media content. tion of data pertaining to adolescents’ intimate and risky
However, parent- and family-centric approaches to behavioral interactions (e.g., instances of sexual groom-
adolescent online safety often assume a significant level ing), which often transpire through private channels.
of privilege, as they require considerable parental time
and attention, and they may be even influenced by other Privacy-Preserving and Resilience-Based
aspects of the parent–child relationship dynamic. More- Approaches to Adolescent Online Safety
over, communication about online risks with teens is often The majority of teens perceive the aforementioned
challenging, as parents may react judgmentally or exces- restrictive measures as excessively intrusive and constrain-
sively when teens disclose their online experiences, exac- ing.7 In response to these perceived conflicts, adolescent
erbating rather than mitigating the issue. Consequently, online safety researchers have called for teen-centered
it can erode trust between parents and teens as well as approaches where teens have some level of privacy and
undermine positive family dynamics. What is worse is autonomy in making their own online safety decisions.
that the teens most vulnerable to online risks, such as The key idea around this approach is the shift from an
those in foster care, often lack parental support to actively authoritarian view of protecting teens to more support-
ensure their online safety. Hence, scholars advocate for ive frameworks that can empower teens to self-regulate
sociotechnical solutions that shift away from relying solely and manage online risks meaningfully.5,7 This under-
on parental mediation toward empowering adolescents to scores the necessity for the adoption of strength-based
self-manage their online risks to be resilient.5 design practices that can empower teens and parents to
manage online risks in meaningful ways. In this section,
Age Verification and Online Risk Detection we summarize research that moves beyond traditional
In recent years, several sociotechnical interventions aimed approaches, which rely on restrictive and privacy-invasive
at bolstering adolescent online safety have been examined, mechanisms, toward resiliency and autonomy-based
including age verification and automated online risk detec- design that can empower teens to utilize their knowledge
tion. Age assurance entails technical measures designed to to self-regulate and cope in the face of online risks.
ascertain the age or age range of users, employing various
methods with differing degrees of certainty (e.g., through Intentional and Meaningful Media Use
ID checks or face recognition-based age estimation) and Amid the proliferation of engagement features, such as
within the context of varying levels of online risk. A range of autoplay and recommendation algorithms, across social
age assurance measures is commonly utilized to limit teens’ media platforms, researchers are actively investigating
access to goods, services, and digital content, although such strategies to alleviate adolescents’ challenges with addic-
measures are susceptible to circumvention or offer limited tive media consumption and time management. This
protection to teens in high-risk environments. As high- arises from the notable gap between adolescents’ height-
lighted in the euConsent report, teens can readily bypass ened sensitivity to social stimuli and their self-regulation
these measures, for instance, by utilizing their parents’ IDs. skills. Developmentally, skills pertaining to self-regulation,
Third-party age verification methods (e.g., digital IDs) tend including reflection, strategic planning, goal-setting, and
to be more effective, although they may engender safety or self-assessment, are relatively underdeveloped during ado-
privacy concerns, such as online fraud. Furthermore, par- lescence. Consequently, there has been an effort to design
ents seek the autonomy to make informed decisions regard- interventions aimed at facilitating adolescents’ intentional
ing the content and services their teens access based on and planned use of digital media.
their decisions of what is appropriate for their teens rather For instance, Davis et al.8 designed and developed a
than on general age restrictions.6 mobile application called Locus that prompts adolescents

www.computer.org/security 55
INCLUSIVE PRIVACY AND SECURITY

to reflect on their social media usage throughout the the foundation of the design of ML-based sociotechnical
day and establish goals for the following day. Locus is systems to support them. In an effort to build teen-centric
a wrapper application that allows users to open social ML systems, researchers explored ways to work with teens
media apps directly through the Locus app. After open- to collect ecologically valid online risk data. For instance,
ing the Locus app, users can view the list of all social Razi et al.9 built an online system to collect youth-donated
media apps installed on their devices. When users select Instagram data. Researchers created a secure website
a specific social media app, they are shown a text-based where youth participants could fill out a survey about
reflective prompt before being taken to the desired their social media usage and unsafe experiences, upload
app asking, “What would make you feel good about their Instagram data, and annotate their own data (e.g.,
your time on Twitter today?” Responding to this entry conversation) as “safe” or “unsafe.” If unsafe, they anno-
prompt is optional and be done via text or speech input. tated for risk type and risk level, the context for each con-
Locus also sends a general notification once per day at versation around why it made them feel unsafe, and the
9 p.m. asking, “How do you think you’ll use social media relationships between conversation partners.
tomorrow?” Through a two-week experimental study The dataset resulted in building automated systems
involving pre- and postsurveys and exit interviews with to identify risky media, sexual conversation, and suicide
adolescents aged 14–18, Davis et al. found that adoles- ideation with high accuracy. It also allowed researchers
cents exhibited enhanced self-control and autonomy in to provide valuable insights into understanding the con-
managing their social media consumption, coupled with text and multidimensionality of online risk teens experi-
reduced instances of unintentional usage. Teens shared ence in private settings, as these are pivotal for designing
that they felt a heightened sense of purpose and empow- youth-centric and customized risk prevention strate-
erment in their interactions on social media platforms. gies to promote youth resilience from online risk. For
As such, intentional and planned media usage has instance, using the youth-provided labels for the level of
long been recognized as an effective means of fostering risk (i.e., high risk versus low risk), researchers were able
self-regulation, particularly from early childhood. With to build ML algorithms to prioritize identifying high-risk
initial guidance from parents, adolescents are capable of cases for prompt risk mitigation, while the algorithms
acquiring intentionality and making goal-oriented deci- take more time to take into account the conversation con-
sions as part of planned usage, which serves as a catalyst text for a more accurate understanding of the risk context
for self-regulatory development. By allowing adolescents for low-risk cases. The idea of building customized algo-
to establish their own healthy boundaries, intentional rithms for differing levels of online risk is that there are
and preplanned media use can alleviate privacy tensions cases where rapid responses are critical to prevent immi-
between parents and teens, especially those who strug- nent risk (e.g., suicide), while there are other cases where
gle with negotiating conflicting boundaries. At the same an accurate understanding of conversation context is
time, Davis et al. observed considerable individual varia- needed to avoid false alarms (e.g., content moderation).
tion among adolescents in the “just right” level of support As such, by taking human-in-the-loop approaches (i.e.,
for their self-regulation behaviors on social media.8 This working with youth to share their risk data and annotate
indicates the need for designing interventions considering for risk experience themselves) to design automated risk
factors such as gender, age, socioeconomic status, and race detection algorithms, researchers have been able to move
as well as the role of individual characteristics and motiva- toward youth-centered and context-aware “real-time” risk
tion to change one’s social media use. In addition, adoles- detection models as “just-in-time” interventions to miti-
cents’ engagement with social media could be varied for gate their online risk experience.
social media platforms with different affordances. There- In the meantime, building risk detection with data
fore, how to tailor interventions to cater to adolescents donation approaches could face challenges, rang-
with different needs and expectations as well as differing ing from the technical issues of dealing with gather-
social media environments is a crucial design consider- ing a sensitive dataset to ethical considerations. One
ation that warrants further investigation. major technical challenge, as noted by Razi et al., was
the compatibility between Instagram’s data and the
Youth-Centered Risk Detection data collection systems. Instagram frequently changes
From a human-centered perspective, collecting ground- how it organizes and formats user data, necessitat-
truth annotations from those who experience the risk ing continuous technical updates to the system. More
ensures that the training risk detection models reflect importantly, collecting online risk data from minors
real-world experiences and accurately represent the risks requires increased precautions, considering the com-
users face online. Risk perceptions are highly subjective; plexity and sensitive nature of private data. Therefore,
therefore, understanding the risk perceptions of people a series of additional measures beyond the institutional
who experienced the risk (i.e., adolescents in our case) is review (e.g., National Institutes of Health Certificate of

56 IEEE Security & Privacy September/October 2024

Confidentiality, risk mitigation documents, and man- could be shared with whom. These insights, collectively,
dated reporting protocols) are needed to ensure the pri- underscore the inadequacy of one-size-fits-all solutions
vacy, confidentiality, and safety of participants. in fostering online safety for teens with distinct aspira-
tions and objectives. Instead, a nuanced understanding
Co-designing Online Safety Solutions of teens’ individual motivations and perspectives on
Co-design methodologies have been applied in adoles- social media usage as well as their privacy perceptions
cent online safety research to integrate the unique per- is crucial for tailoring customized support systems to
spectives of teens in the development of teen-centric facilitate safer online experiences.
online safety solutions. One notable initiative is However, engaging in remote settings made it dif-
the establishment of a youth advisory board (YAB) ficult for teens to establish rapport and trusted connec-
program, which represents a long-term co-design tions with researchers and other teens. For instance, teens
endeavor aimed at involving teens in the design of from the work by Ali et al.10 shared that there was a lack
their own online safety and privacy solutions. Over of peer-to-peer interactions, which hindered their partici-
the course of a year, researchers engaged with a cohort pation and the development of long-term connections. In
of seven teens, aged 15 to 17, with the objectives of addition, they faced this issue in the ARC environment
1) imparting user experience (UX) design skills and (i.e., Discord), as teens took part in the activities at their
familiarity with industry-standard tools, along with own discretion, and their timings varied inconsistently.
offering career development guidance; 2) soliciting This led to irregular and fragmented interactions with
direct feedback on research protocols related to ado- other teens and researchers, inhibiting good peer-to-peer
lescent online safety and involving them in research relationships to work together effectively.
studies; and 3) involving them in co-design activities Therefore, building rapport with teens and accom-
tailored to their interests.10 modating teen participants with diverse needs and skill
As part of the YAB, researchers explored method- sets could be keys to tackling challenges associated with
ological approaches, such as the asynchronous research co-design approaches. Balancing between synchronous
community (ARC) environment in which asynchronous and asynchronous modes is also important to promote
weekly discussions were facilitated on Discord, along flexibility and encourage individual contributions from
with synchronous design sessions conducted on Zoom. quieter teens. Invest time and effort to share common
Asynchronous activities were conducted through text ground and interests. Office hours, co-design, and
responses and screenshots, while design activities were in-person meetings (if possible) can help better rapport
conducted using Figma, where teens created their own and team building, with more opportunities to build
design solutions for new online safety features. In syn- trusting relationships. Finally, provide opportunities for
chronous meetings, researchers worked in longer sessions group activities and interactions to help teens develop
with teens to co-design and conceptualize their online peer-to-peer connections, build networks, and increase
safety ideas. Asynchronous follow-up discussions were motivation for participation.
done on Discord, where all members could give feedback
and suggestions on their continuing design work. Evaluating Nudge-Based Intervention
Over the eight-week period of ARC activities, research- Real-time or “just-in-time” nudge-based interventions
ers identified that teens perceived different social media are also proposed to support teens at the moment when
platforms as a spectrum of privacy levels, such as private they experience risks online. Nudges, defined as subtle
platforms, public platforms, and semipublic platforms. cues intended to influence behavior, are being investi-
Teens exhibited a conscious decision-making process in gated as effective means of guiding adolescents’ actions
selecting social media platforms based on their goals and without removing their autonomy. For instance, Agha
preferences, demonstrating awareness of potential privacy et al.11 co-designed online safety nudges with teens as
risks. For instance, teens preferred more private platforms part of their UX Bootcamp study, where teens created
for one-to-one interaction but switched to more public plat- storyboards regarding their past online risk experiences.
forms when viewing or sharing content. This suggests that Their risk experiences guided the creation of the pub-
teens are well aware of the privacy risks they may encounter lic cyberbullying nudge that filtered a risky comment
on social media platforms. Consequently, to achieve a bal- and highlighted community guidelines while giving
ance between meeting their objectives and mitigating pri- options to view, delete, or report the risk. The private
vacy concerns, teens employed diverse strategies to regulate information breaching nudge warned users of requests
their privacy settings according to the intended audience. for location-revealing sensitive information, allowing
Accordingly, their design ideas for privacy features them to continue, ignore, or block. The private preda-
centered on aiding them with more granular control tory risk nudge warned about inappropriate messages
over determining what information on their accounts from a stranger, with options to continue, leave, or block

www.computer.org/security 57
INCLUSIVE PRIVACY AND SECURITY

the sender. The private scam and explicit content nudge Moreover, as nudges influence one’s behaviors, the
used filters to censor the risk, with choices to view, most prominent ethical concern related to nudging is
delete, and inform others. that it could compromise adolescent autonomy. In the
With these real-time nudges designed with teens, context of adolescent online safety, risk prevention re-
Agha et al. moved forward with co-designing social me- quires content moderation and censorship, which are
dia situation platforms to evaluate online safety nudges considered a breach of freedom of speech in many con-
with teens. The rationale behind employing simulated texts. However, teen participants in the study by Aga et
environments lies in al. perceived that con-
the endeavor to assess trolled and personalized
the impact of nudges ways of filtering unsafe
on promoting safe on- content respected their
line decision-making Nudges, defined as subtle cues intended to decision-making auton-
among adolescents, influence behavior, are being investigated omy. In addition, teens
all within settings that believed that moder-
closely mirror real-life
as effective means of guiding adolescents’ ating harmful content
scenarios while safe- actions without removing their autonomy. was necessary and that
guarding teens from compromising an in-
real risks. Therefore, dividual’s freedom of
Agha et al. risk scenar- speech was reasonable
ios and nudge designs if it protected minors
to a cohort of 20 teens to refine the designs. Teens were from online harm.11 Therefore, nudges that prompt
asked to redesign at least one or more of the risk scenarios the perpetrator to reconsider their actions, along with
and nudges with high-level feedback to make them more the freedom to continue—but not without conse-
realistic and effective. Feedback was provided through de- quences—should be carefully designed.
sign annotations on Fig Jam, along with verbal discussions.
They found that teens co-designed risk scenarios that Socioecological Approaches to
were subtle and higher in risk to be believable, perpetu- Adolescent Online Safety
ated by risky personas that tricked the teen by establish- The landscape of adolescent online safety has shifted
ing trust or a shared context. Teens recommended nudges toward collaborative family-based approaches, fostering
for risk prevention through personalized sensitivity fil- communication, privacy, and autonomy within digital fam-
ters, with the autonomy to view the risk. Moreover, teens ily contexts. Recent studies have investigated joint family
expressed a desire for proactive coping mechanisms, oversight mechanisms, enabling parents and teens to make
measures to hold perpetrators accountable, and educa- decisions together and providing teens the autonomy to
tional community guidelines. In terms of evaluating these support themselves and their families in online risk man-
nudges, the majority of participants expressed a prefer- agement. These innovations signal a move toward col-
ence for simulated social media environments wherein laborative models, recognizing the varied needs within
they could observe tangible behavioral changes without families. However, while family-centric strategies remain
exposure to actual risks. Concurrently, teens emphasized prevalent in industry and policy discourse, there is a grow-
the importance of transparency regarding the collection ing recognition of the limitations of solely relying on
and recording of data to address any privacy concerns parental mediation, particularly for vulnerable youth with-
stemming from their involvement in the study. out robust familial support systems. This section lays the
Meanwhile, we recognize that the implementation of groundwork for examining the socioecological framework,
real-time online safety nudges is not simple, as they rely which integrates digital parenting with broader social sys-
on the accurate detection of risk at the right moment. tems to promote resilience and community-based support
Although the just-in-time behavioral interventions dis- in adolescent online safety.
cussed can be effective in adolescents’ decisions toward
their online safety, they cannot cater to all adolescents Family-Based Collaborative Approaches
with different digital experiences and needs. For the In recent years, researchers have explored the imple-
interventions to be effective, they need to be context mentation of collaborative family-centric approaches
aware, which, in many cases, relies on techniques such as to address adolescent online safety concerns. These
ML-based risk detection. Therefore, collaborative efforts approaches aim to facilitate open discussions within
bridging the design space and technical implementation families while respecting teens’ privacy and autonomy
of the designed systems are crucial to moving toward pro- in making not only their own online safety decisions but
viding personalized nudge-based intervention. also decisions related to their families’ mobile privacy

58 IEEE Security & Privacy September/October 2024

and security. Taking a joint approach focused on teens’ collaborative family-based solutions in adolescent
online safety, Akter et al.12 designed and developed a online safety to enhance joint learning in families.
joint family oversight application, Community Over-
sight for Privacy and Security (CO-oPS), that allowed Beyond Family-Based Approaches
parents and teens to have an equal footing in monitor- Parent- and family-focused technology mediation
ing one another’s mobile app usage and permission set- approaches (e.g., parental control applications) con-
tings as well as providing feedback. The CO-oPS app tinue to be the most widely recommended strategies by
allowed family members to review each other’s installed industry and policymakers. However, this perspective
apps and the privacy permissions granted or denied, on online safety overlooks the reality that the most vul-
facilitating direct knowledge exchange between parents nerable youth to online risks, e.g., youth in foster care,
and teens and enhancing communication. They also often do not have engaged parents or family members
had the ability to hide some of their installed apps from who can actively employ these strategies. Furthermore,
one another, ensuring equal levels of personal privacy research by Badillo-Urquiola et al.13 with foster parents
for both parents and teens. and caseworkers demonstrates that even those respon-
Through a lab-based user study with 19 parent– sible for the well-being of these youth receive little to
teen dyads, Akter et al. explored the applicability of this no support and struggle with keeping them safe online.
approach in helping teens and their parents collaboratively Caseworkers are often overworked, with limited avail-
manage their mobile online safety, security, and privacy. ability to address online safety concerns, while foster
They found that, while teens were the primary providers parents are overly stressed, with so many responsibili-
of technical support within the household, parents often ties that they are desperate for solutions.
resorted to manual inspections of their teens’ phones or Therefore, recent efforts in adolescent online safety
employed parental control apps to restrict the installation advocate for approaches that leverage the socioecological
of new applications. When evaluating the CO-oPS app, support systems of youth, that is, the different people and
both parents and teens saw value in the ability to review factors that influence a youth’s online experience. These
each other’s apps and permissions, as it enhanced trans- individuals and factors can be defined at different levels,
parency regarding app usage within the family and facili- such as the individual level, relationship level (family
tated discussions surrounding apps and permissions. and peers), and community level (school). For instance,
When they reviewed one another’s apps and permissions, Badillo-Urquiola et al. observed tensions between case-
parents showed more concerns regarding their teens’ app workers and foster parents that could be alleviated by
usage, perceiving it as a potential gateway for outside indi- working together to manage the online safety challenges
viduals to connect with their teens online. Conversely, of foster youth. They recommended developing col-
teens primarily focused on identifying risky permissions laborative sociotechnical systems that could bring case-
granted on their parents’ devices, demonstrating a height- workers and foster parents into partnership with one
ened awareness of the malicious intentions of third-party another. In this sense, a sociotechnical system can act as
mobile applications. an interpersonal-level system that connects caseworkers,
Overall, Akter et al. highlighted how parents and foster parents, and foster youth to increase support.13 In
teens conceptualized mobile privacy, security, and our proposed conceptual model (see Figure 1), the social
online safety differently and how joint family oversight ecologies of the adolescent resilience framework are
can potentially benefit in enhancing both parents’ and combined with digital parenting practices across the ado-
teens’ learning of mobile privacy, security, and online lescent life span to promote the shift between restrictive
safety through fostering comonitoring and communica- parental mediation in early childhood to self-regulation
tion. However, these advantages would rely heavily on supported by social ecologies in adolescence. This frame-
both parent and teen buy-in to recognize their mutual work helps change the online safety narrative from one
responsibility for each other’s online well-being, neces- focused on parental control to one that considers the
sitating a paradigm shift from prevailing approaches to range of mediation strategies that promote social connec-
adolescent online safety, such as parental control, to tions and leverage community-based supports.
more collaborative joint family approaches.
In sum, collaborative joint family approaches showed Beyond “One-Size-Fits-All” Approaches
potential in adolescent online safety. These approaches While privacy-preserving and resilience-based online
promoted transparency, privacy, and autonomy and safety solutions show positive trends toward promoting
facilitated discussions on mobile privacy and security the digital well-being of teens, we must acknowledge
within families. Through these approaches, parents and how different factors (e.g., socioeconomic status, cul-
teens exhibited differing perceptions of mobile online tural background, and digital access) affect adolescents’
safety, privacy, and security, highlighting the need for online experiences and risks and how teen-centric

www.computer.org/security 59
 INCLUSIVE PRIVACY AND SECURITY

solutions can be adaptable to diverse needs and con- strategies could be different among cultures. Therefore,
texts. For instance, teens in foster care are even more future work should explore resilience-based adoles-
susceptible to higher levels of online risk, such as sex cent online safety solutions from a global perspective
trafficking. However, foster parents often lack the tech- to extend the discussion on adolescent online safety,
nology expertise to effectively manage teens’ user of considering different cultural, legal, and social contexts.
technology. As a result, they resorted to restrictive prac- This way, teen-centered online safety solutions would be
tices.13 Online safety technologies in which the power is applicable to a wider audience and contribute to a more
balanced between the stakeholders of the foster youth’s comprehensive understanding of the issues at hand.
support system and the foster youth are needed to One way to account for these important contextual
empower them to make their own decisions and learn. differences is through teen-centered design that puts
However, few evidence-based interventions to empower teens as the primary stakeholders and authority of their
foster youth self-regulation and online safety have been lived digital experiences. By shifting the power dynamic
developed. Therefore, the new systems should be devel- from focusing on the needs and perspectives of parents
oped for and with foster youth with input from foster and adults, amplifying adolescent voices can empower
parents and caseworkers. them to learn how to self-regulate their online behaviors
Moreover, much of the discourse around online in ways that promote resilience, autonomy, and safety.
safety currently emerges from the Global North (e.g., Further, engaging teens as co-designers and researchers
North America, Europe, and East Asia); however, can lead to novel design patterns and solutions that will
research evidence shows that cultural factors may con- transform the current technology landscape into one that
tribute to different parental mediation strategies. For promotes the digital inclusion of teens in the shaping of
example, Western European parents take more protec- the platforms in which they engage and the policies put
tive approaches, even if it might cost the children online forth to protect them online. Finally, we recognize that
opportunities, while parents of Nordic and northern resilience-based online safety solutions cannot be con-
European countries favor children’s rights and freedoms sidered effective until they have been built, implemented,
in online environments, even if this may put children at and evaluated in real-world settings. Therefore, future
risk.14 As such, the effectiveness of parental mediation work to implement the suggested solutions and evaluate
them with adolescents in realistic settings is essential. As
Social Ecologies of Adolescent Resilience Framework we do future research with and for adolescents, we must
Nested Social Systems That Contribute to Adolescents’ consider ethical responsibilities.
Well-Being Under Risky Circumstances

Community
Conducting Ethical and Privacy-
Preserving Research With and
School for Adolescents
Several challenges and ethical considerations surface
Peers
when conducting online safety and privacy-related
Family
research with adolescents. We must ensure that con-
ducting privacy-related research with adolescents does
Adolescents not violate their privacy. For example, power imbal-
ances related to informed consent, data collection,
and other aspects of the research process can surface
Ages <8–12

Ages 13–15

Ages 16–18

Set up and use Teach how to Support

parental controls navigate adolescents to between researchers and adolescents. Since teens are in
when first giving potentially risky make good
the child access situations. decisions on their
a developmental stage of transitioning from childhood
to technology. own. into adulthood, they are still navigating many physical,
Focus on risk
Place rules and coping skills and Let them know
cognitive, social, and emotional changes in their bod-
limits on the child’s give them exit you are there to ies. This results in teens being classified as a vulnerable
online activities. strategies to be help if they need. group, requiring several additional protections (e.g.,
resilient. parental consent). However, teens desire individuality,
often seeking independence and privacy.
Restrictive Parental Active Parental Teen Self-Regulation With
Therefore, Badillo-Urquiola et al.15 developed a list
Mediation Mediation Social Ecological Support of heuristic guidelines for conducting risky research with
Digital Parenting Across Developmental Stages adolescents. These guidelines prioritize the teens’ benefi-
cence, autonomy, and privacy, recommending research-
Figure 1. A social–ecological approach to digital parenting across the adolescent
ers provide teens as much control as possible over
life span.
how, when, and what types of personal data should be

60 IEEE Security & Privacy September/October 2024

collected. They also encourage the use of help resources, ■ How can we design online safety solutions for the diver-
warnings, and disclaimers to support teens before, dur- sity of adolescents, considering differences in psycho-
ing, and after participating in a risk-based research study. logical (e.g., child development) and socioecological
Legal obligations (e.g., child-mandated abuse reporting) factors (e.g., family context and cultural norms)?
must be clearly communicated to teens in a way that is ■ How can we implement a comprehensive online protec-
comprehensible, and expectations of not monitoring data tion policy that is respectful of adolescents’ digital rights?
in real time for risk reporting should be clearly stated.
To guide researchers in the United States on best Before concluding, we call on a whole village of parents,
practices for addressing risk mitigation for the protec- caregivers, researchers, technology designers/develop-
tion of youth, Badillo-Urquiola et al. also provided a ers, clinicians, educators, and policymakers to put efforts
risk mitigation plan that outlines the ethical consid- toward positive media parenting and resilience-based
erations and protocols for engaging youth in sensitive approaches to promote the digital well-being of adoles-
and risk-based research. This guide includes ethical cents. Adolescents need guidance from adult actors while
considerations beyond the typical U.S. Food and Drug they develop a sense of digital autonomy and risk resil-
Administration regulations for human subjects research ience. Hence, an active dialogue between adolescents
enforced by institutional review boards. For example, and supportive adults concerning technology use is key
it provides guidance on obtaining a Certificate of Con- to promoting their digital well-being. Clinicians, educa-
fidentiality from the National Institutes of Health as tors, and service providers need to support adolescents
well as procedures for reporting suspected child abuse and caregivers to have healthy conversations about devel-
or neglect situations. Overall, while we recognize the opmentally appropriate parental involvement in their
importance of engaging with teens to design online online technology use, focusing on the development of
safety solutions for them, we cannot afford to put their digital autonomy and resilience. Technology design
them in more danger. Hence, researchers need to pri- and development should be evidence based, inclusive,
oritize the well-being of teens in conjunction with more and informed directly by adolescents to ensure that
research efforts toward establishing best practices and academic research translates into real-world solutions.
standards for conducting ethical and privacy-preserving Finally, comprehensive legislation and policy should be
research with diverse teens. discussed with various stakeholders, including as part of
a larger agenda. Adolescent digital privacy needs to be
protected as a right, and robust data protection laws for

I n this article, we highlighted a paradigm shift that

moves away from restrictive and privacy-invasive strat-
egies toward resilience-based and privacy-preserving
adolescents should be enacted and translated into prac-
tice. As such, we call for new practices that push beyond
surveillance and restriction toward teen-centric solutions
solutions to promote adolescent online safety. We also that can best support adolescents’ healthy development
provided an overview of empirical studies that concep- into digital citizens of the future.
tualized and examined various approaches to promoting
the digital well-being of teens in a way that empowers Acknowledgment
teens to be resilient in digital settings. We highlighted The work of Dr. Wisniewski was supported by the U.S.
a key trend in the emerging literature: teen-centered National Science Foundation under Grant IIP-2329976,
approaches to promoting digital well-being while sup- Grant IIS-2333207, and Grant CNS-2326901 and by
porting the healthy development of adolescents. Empiri- the William T. Grant Foundation Grant 187941. Any
cal evidence increasingly emphasizes that, when it comes opinions, findings, conclusions, or recommendations
to adolescent online safety solutions, the one-size-fits-all expressed in this material are those of the authors and do
approach does not apply. Factors such as age, family con- not necessarily reflect the views of the research sponsors.
text, and culture must be taken into account for online
safety solutions that can cater to adolescents with diverse References
digital experiences and needs. Therefore, we must take 1. M. Anderson, M. Faverio, and J. Gottfried, “Teens, social media
a nuanced and contextualized approach to setting a and technology 2023.” Pewresearch.org. Accessed: Jan. 31,
research agenda for the future. Some of the open ques- 2024. [Online]. Available: https://www.pewresearch.org/inter
tions for further exploration around the promotion of net/2023/12/11/teens-social-media-and-technology-2023/
adolescents’ digital well-being include the following: 2. “S.3663 - Kids Online Safety Act.” Congress.gov. Accessed:
Jan. 31, 2024. [Online]. Available: https://www.congress.
■ How can we design online safety solutions that can gov/bill/117th-congress/senate-bill/3663/text
balance protection and support for adolescents’ 3. d.boyd, It’s Complicated: The Social Lives of Networked
healthy development? Teens. New Haven, CT, USA: Yale Univ. Press, 2014.

www.computer.org/security 61
INCLUSIVE PRIVACY AND SECURITY

4. Z. Iftikhar et al., “Designing parental monitoring and Co-designing for the ethical treatment and protection of
control technology: A systematic review,” in Proc. adolescents,” in Proc. ACM Hum.-Comput. Interaction, vol.
Human-Comput. Interaction–INTERACT 2021: 18th IFIP 4, 2021, pp. 1–46, doi: 10.1145/3432930.
TC 13 Int. Conf., Bari, Italy. Cham, Switzerland: Springer
International Publishing, 2021, pp. 676–700. Jinkyung Katie Park is a postdoctoral scholar in com-
5. P. J. Wisniewski, J. Vitak, and H. Hartikainen, “Privacy in puter science at Vanderbilt University, Nashville, TN
adolescence,” in Modern Socio Technical Perspectives on Pri- 37235 USA; she will join the School of Computing
vacy, B. P. Knijnenburg, X. Page, P. J. Wisniewski, H. R. at Clemson University as an assistant professor in
Lipford, N. Proferes, J. Romano, eds. Cham, Switzerland: fall 2024. Her research interests include human–
Springer International Publishing, 2022, pp. 315–336. computer interaction, adolescent online safety,
6. S. Smirnova, S. Livingstone, and M. Stoilova, Understanding of and human-centered artificial intelligence. Park
User Needs and Problems: A Rapid Evidence Review of Age Assur- received a Ph.D. in information science from Rut-
ance and Parental Controls. euConsent. Accessed: May 15, gers University. She is an active member of the
2024. [Online]. Available: https://eprints.lse.ac.uk/112559/ Association for Computing Machinery Special
7. A. K. Ghosh, K. Badillo-Urquiola, S. Guha, J. J. LaViola, Jr, and Interest Group on Computer–Human Interaction,
P. J. Wisniewski, “Safety vs. surveillance: What children have to iSchool, and Association for Information Sci-
say about mobile apps for parental control,” in Proc. CHI Conf. ence and Technology communities. Contact her at
Human Factors Comput. Syst. (CHI), 2018, pp. 1–14. jinkyung.park@vanderbilt.edu.
8. K. Davis et al., “Supporting Teens’ intentional social
media use through interaction design: An exploratory Mamtaj Akter is an incoming assistant professor at
proof-of-concept study,” in Proc. 22nd Annu. Conf. ACM the New York Institute of Technology, Manhattan,
Interaction Design Children Conf., 2023, pp. 322–334. Manhattan, NY 10023 USA. Her research interests
9. A. Razi et al., “Instagram data donation: A case study on include human–computer interaction, adolescent
collecting ecologically valid social media data for the pur- online safety, and usable privacy and security. Akter
pose of adolescent online risk detection,” in Proc. CHI received a Ph.D. in computer science from Vanderbilt
Conf. Human Factors Comput. Syst. Extended Abstract (CHI University. She is an active member of the Associa-
EA), 2022, pp. 1–9, doi: 10.1145/3491101.3503569. tion for Computing Machinery SIGCHI. Contact her
10. N. S. Ali, Z. Agha, N. Chatlani, J. Park, and P. J. Wisniewski, “A at mamtaj.akter@vanderbilt.edu.
case study on facilitating a long-term youth advisory board to
involve youth in adolescent online safety research,” in Proc. Pamela Wisniewski is an associate professor and a Flow-
CHI Conf. Human Factors Comput. Syst. Extended Abstract ers Family Chancellor Faculty Fellow of Computer
(CHI EA), 2024, pp. 1–8, doi: 10.1145/3613905.3637121. Science at Vanderbilt University, Nashville, TN 37235
11. Z. Agha et al., “Tricky vs. transparent: Towards an ecologically USA. Her research interests include human–com-
valid and safe approach for evaluating online safety nudges puter interaction, social computing, and adolescent
for teens,” in Proc. CHI Conf. Human Factors Comput. Syst. online safety. Wisniewski received a Ph.D. in com-
(CHI), 2024, pp. 1–20, doi: 10.1145/3613904.3642313. puter and information systems from the University of
12. M. Akter, A. J. Godfrey, J. Kropczynski, H. R. Lipford, and P. North Carolina at Charlotte. She is an Association for
J. Wisniewski, “From parental control to joint family over- Computing Machinery senior member. Contact her
sight: Can parents and teens manage mobile online safety at pam.wisniewski@vanderbilt.edu.
and privacy as equals?,” in Proc. ACM Human-Comput.
Interaction, vol. 6, 2022, pp. 1–28, doi: 10.1145/3512904. Karla Badillo-Urquiola is a Clare Boothe Luce Assis-
13. K. Badillo-Urquiola, Z. Agha, D. Abaquita, S. B. Harpin, tant Professor of Computer Science and Engineer-
and P. J. Wisniewski, “Towards a social ecological approach ing at the University of Notre Dame, Notre Dame, IN
to supporting caseworkers in promoting the online safety 46556 USA. Her current research interests include
of youth in foster care,” in Proc. ACM Hum.-Comput. Inter- human–computer interaction, social computing,
action, vol. 8, 2024, pp. 135–28, doi: 10.1145/3637412. adolescent online safety, and vulnerable/marginal-
14. D. Smahel et al. “EU Kids Online 2020: Survey results from ized populations. Badillo-Urquiola received a Ph.D. in
19 countries.” EU KIDS ONLINE. Accessed: May 15, 2024. modeling and simulation from the University of Cen-
[Online]. Available: https://eprints.lse.ac.uk/103294/ tral Florida. She is an active member of the Associa-
15. K. Badillo-Urquiola, Z. Shea, Z. Agha, I. Lediaeva, and tion for Computing Machinery SIGCHI community.
P. J. Wisniewski, “Conducting risky research with teens: Contact her at kbadillou@nd.edu.

62 IEEE Security & Privacy September/October 2024