Sharenting in an evolving digital world: Increasing online connection and consumer vulnerability

3.1 Parents and guardians

Sharenting is at minimum a two-person endeavor, requiring at least a parent or guardian (the sharer) and a child (the shared). Parents are legally responsible for the PII that is sharented, acknowledging that a child's data privacy may be interdependent with the parents' data privacy (Kamleitner & Mitchell, 2019), modeling to their children what is acceptable to share, and negotiating sharenting behaviors with their children (Steinberg, 2016). Sharenting parents are also the first generation to grow up with social media, which leads to certain vulnerabilities: while they are familiar with the technology, this closeness can create a false sense of trust, as they may be unaware of the full impact of sharenting. The pandemic exacerbated issues around sharenting by straining vulnerabilities experienced in the transition to and within parenthood.

Looking at specific groups for examples, parents of school-aged students have seen an increase in online systems for remote learning. Adopting technology to aid educational experiences may lead parents to analyze these technologies less critically. Next, parents of immunosuppressed children may feel more isolated without physical access to typical support, possibly altering their motives to sharent to connect with other like families (Boyd-Barrett, 2020). Moreover, adoptive families face unique situations related to sharenting motivations that have changed with the digital landscape such as online posting rights between biological and adoptive parents (Steinberg et al., 2022). Finally, given the pandemic's economic fluctuations, parents may be more likely to sharent to support trusted companies (see Figure 2a).

3.1.1 What is sharented and why?

Sharenting can occur at any stage, from expectant parenthood to parenting older children. It takes place on a spectrum of awareness (Figure 3), from active, intentional sharenting to instances where parents may not even recognize that they are sharing PII (“invisible sharenting”). Given the diversity of forms sharenting can take, the decision for parents and those studying the phenomenon is highly complex.

Even before the pandemic, sharenting included various types of content, such as photos of milestones (e.g., crawling), outings (e.g., birthday parties), daily life, and cute or funny moments (Brosch, 2016; Kumar & Schoenebeck, 2015). Other frequent topics include children's sleep, nutrition, discipline, and school (Davis et al., 2015). Parents may sharent to seek affirmation and advice, to share their pride in their children, to archive memories, to help other parents learn from their experiences, and to stay in touch (e.g., Blum-Ross & Livingstone, 2017; Wagner & Gasche, 2018). In turn, they receive feedback from other parents (McDaniel et al., 2012), which makes them feel supported. Sharenting is especially common among mothers, who may desire to portray being a “good mother” (Fox & Hoy, 2019; Lazard et al., 2019). Sharenting can empower mothers to make more informed decisions (Holtz et al., 2015), which is particularly important given the uncertainty of the evolving modern digital world. The literature points to sharenting as an opportunity to present children as a narration of parents' aspirations and abilities; however, parents' confidence may be undermined or overwhelmed by the variety of digital choices, leading to further opportunities for vulnerability.

3.2 Children

Social media platforms may use sharented content to create an information repository about users. Companies can use such information, some of which is provided in response to brands' social media engagement tactics (Fox & Hoy, 2019), to begin to track personally identifiable information in gestation and early infancy. Even third-party websites and applications can track intimate health and well-being details being offered by sharenting (Lupton & Williamson, 2017). However, because young children are not developmentally able to understand sharenting-related issues, they cannot be considered legally competent to provide (or refuse) informed consent (Nottingham, 2019). The digital footprint that their parents create can follow them into adulthood (Steinberg, 2020).

Findings from a study early in the pandemic suggested that children generally have negative feelings about sharenting, with kindergarten-aged children being the least receptive compared to older children (Sarkadi et al., 2020). For teens, sharenting may even seem hostile if it conflicts with their own identity formation or creates an opportunity for peer ridicule. Adolescents feel more negatively about sharenting when they perceive that their parents sought impression management rather than information archiving (Verswijvel et al., 2019).

Consumers in the transitional stage between childhood to young adulthood are also impacted by sharenting. The United Nations (UN) Convention on the Rights of the Child provides the international standard definition of an adult as someone above 18 years of age. These consumers are legally adults, but they may still be dependent on their parents for financial and/or emotional support. During the pandemic, over half of Americans aged 18–29 moved in with their parents, surpassing the previous peak from the Great Depression (Pew Research Center, 2021a). Since such consumers are cognizant of their digital identities, they are more prone to engage in conflicts with their parents if the digital images their parents create for them contradict their identities. They may also be more aware of the rights granted by related privacy regulations and thus more likely to use laws to defend themselves in sharenting conflicts (Schoeman, 1987).

3.3 Audience/community

Beyond the parent/child dyad, a variety of stakeholders must be considered that engage in indirect sharenting (i.e., encouraging parents to share) or direct sharenting (i.e., posting children's PII themselves). While it is commonly parents who authorize and become co-owners of their child's information, the community may play a role in sharenting as well. Specifically, those with access to children's PII may make such information publicly available.

For example, parents can feel pressure from other family members to share PII, which can then be reshared online out of their control. Schools' social media pages and websites may present information about children and their families, with parental consent forms giving parents confidence in the sharing (Cino & Vandini, 2020; see Figure 2b). Throughout the pandemic, schools have reached out to parents, encouraging them to film their families and tag themselves on social media (Bessant et al., 2020). This approach arguably has multiple benefits: enabling children to keep up with their peers, helping foster a sense of community with fellow pupils, and providing visible support for the school as an institution. However, some parents also raise concerns about teachers sharing information not only on school websites but also on their own social media (Figure 2). Similarly, parents may consent for the school to use a learning management app that then stores the child's PII and photos on a server, resulting in unrecognized, or “invisible,” sharenting. Digital sharing allows for greater opportunities for unauthorized individuals to become co-owners of the information compared to a physically limited context, such as a bulletin board in a school's hallway.

Nonprofit organizations also become (un)authorized co-owners of children's PII, which they may sharent. Places of worship and child-focused organizations, such as the Girl Scouts, post pictures of the children in their care to emphasize their activities and mission. Law enforcement agencies also use social media for community policing; to “humanize the badge,” agencies post pictures of officers engaging with children (Carter et al., 2020).

3.4 Commercial institutions

Seventy-eight percent of parents with a child younger than 12 years of age agree that children should be 12+ before using social media sites and apps (Auxier et al., 2020). Nevertheless, only a small subset (18%) use social media without sharenting. Commercial institutions are largely responsible for promoting parental sharenting. For example, many children's brands prompt parents to tag them on social media (Fox & Hoy, 2019; see Figure 2b). Some posts include PII, as defined by the US Children's Online Privacy Protection Act Rule (COPPA; e.g., photos with geotagged locations). The business model of online service providers also reflects commercial interests in sharented information. Third-party data brokers can also collect data from online user activity to create profiles or segments, which can be sold and used for a variety of marketing functions (e.g., ad personalization). Described as the “datafication of childhood,” information can be collected as soon as early gestation from ultrasound images and pregnancy apps (Mascheroni, 2020, p. 798). Children's data from commercial institutions has never been more accessible or widespread.

Researchers with the Kids Online Anonymity and Lifelong Autonomy (KOALA) project found that both parents and children failed to understand apps' data collection practices, which often include transmitting such data to third-party companies (Zhao, 2018) or storing personal information (Yao et al., 2017). A study of thousands of apps for children showed that 73% had potential COPPA violations where sensitive data was shared without parental consent (Reyes et al., 2018), increasing children's vulnerability online.

While technology has been positively used to teach children and trace contacts during the pandemic, NGOs point to children's vulnerability when content is not stored appropriately, or governments expose the identity of individuals being tracked for public health purposes (UNICEF, 2020). Recognizing the impact that the pandemic had on children's use of digital media for learning and entertainment, the Campaign for a Commercial-Free Childhood and Center for Digital Democracy have been advocating for the US Federal Trade Commission (FTC) to require big tech companies to reveal how they target children and what type of data they are collecting (Chester & Golin, 2020).

Finally, in response to growing concerns from parents and new regulations, tech companies are creating products and tools that divert some control back to parents. For example, Facebook announced plans to launch Instagram Kids, targeting children under 13 and granting substantial parental controls. The move was met with extensive criticism from legislators and parents concerned about children's vulnerability related to social media, and in September 2021, Facebook announced that it would pause the project amidst these concerns (Meta, 2021). But some welcomed the app as a first step to educate children about social media while under the wing of a parent; thus, it will be critical for Facebook (and other companies looking to release similar products) to demonstrate the value of a child-focused platform.

3.5 Policymakers

Next, we turn to laws and regulations that govern the use of children's information. Jurisprudence generally reflects an assumption that parents are the best people to make decisions for their children and that the state should be slow to intervene, even where some harm to the child may result from parental decision-making. As part of its mission to protect consumers against deceptive and unfair business practices, the FTC protects the online privacy of US children under 13 by enforcing the 1998 COPPA (FTC, 2013) and its 2013 revision (FTC, 2015).

In England, legal protection for children's information derives from either the common law (which affords protection to individuals' confidential and private information) or the Data Protection Act 2018 (DPA, 2018) and UK General Data Protection Regulation (UKGDPR). In addition, numerous regulatory codes govern the use of children's information by advertisers, broadcasters, and the media. COPPA provides explicit recognition of the need to offer greater protection to children than to the wider population. English courts have also recognized the special position of children and the importance of protecting their privacy (e.g., Weller v Associated Newspapers Limited, 2015 EWCA Civ 1176). The UKGDPR similarly recognizes the vulnerability of children; Recital 38 explicitly states that “children merit specific protection with regard to their personal data.” From September 2021, the ICO's Age Appropriate Design Code requires online services to meet certain standards designed to provide additional protection to children's data when children engage online.

The Better Business Bureau's Children's Advertising Review Unit provides guidelines to help companies comply with COPPA. Similarly, the U.K. Advertising Standards Authority sets out in the codes for media (CAP/BCAP codes) that certain rules must be followed by advertisements directed at or featuring children. The UKGDPR recommends that specific protection should be provided to children's personal data “for the purposes of marketing or creating personality or user profiles and when data is collected by children ‘using services offered directly to a child.’” Some academics have suggested a child might use the right to erasure/right to be forgotten to remove information (Rustad & Kulevska, 2015; Steinberg, 2017) regarding commercial activity. However, the analysis applies specifically to European countries; US law has not even begun to analyze how the right could apply in any context at all.

4.1 Parents

Parents are legally responsible for deciding which PII should be sharented and how. Recognizing parents' differences in sharenting preferences is important for working toward proposed solutions. Thus, we consider parents' active, passive, and invisible sharenting along the spectrum of awareness (Figure 3).

First, active sharenting is intentional and can occur in a variety of scenarios. While these parents are aware of their posting, they may or may not understand its implications. For example, parents may feel that they are familiar with the graphical user interface of a social media platform and therefore understand how it works. Yet, the complexities of how information is collected, stored, and reused, and the permanency by which this occurs, may elude them, especially in a parenting world that increasingly relies on many different technologies. Thus, parents who believe they are sharing information may actually be surrendering it (Walker, 2016), increasing their consumer vulnerability. On the other end of the spectrum, parents may decide not to sharent any information; because of the intentionality, this is considered an active sharenting-related decision as well. Again, they may make this decision out of basic awareness or full understanding, meaning that some parents who choose full protection may believe they are choosing not to share information when, in reality, they are choosing not to surrender it.

Next, passive sharenting occurs as a feeling of resignation, in that sharenting may be perceived as unavoidable in modern society. Although parents may understand that sharenting is occurring, the depth of their understanding may vary. The isolation of the pandemic results in parents seeking unique ways to keep themselves and their children tied to family, friends, and school/extracurricular opportunities. If online connections offer a feasible way to do this, parents may increasingly acquiesce or even become indifferent to sharenting, increasing passive sharenting and their own vulnerability.

Finally, we identify invisible sharenting as occurring when parents do not recognize their role in sharenting. This additional, covert layer of sharenting happens after a parent shares information; it is primarily initiated by commercial interests (authorized co-owners use it in unauthorized ways). For example, a parent shares photos of a child with family members via a cloud storage platform, not recognizing that the company is downloading the photos and sharing them on other websites. Parents also may not recognize that cloud storage may mean storing the content on third-party servers. The parents are not deliberately sharing the information so widely. Invisible sharenting is typically a byproduct of a company taking advantage of a parents' lack of digital literacy and prior sharenting activities.

4.2 Children

First, active sharenting implies parental intentionality and is likely to have the greatest awareness from the child. A child's desire to be sharented can change over their lifetime and as they gain more understanding about what it means and how it may impact their current and future interactions. Both passive and active sharenting may include unwanted attention from unintentional co-owners of PII, distribution of sensitive information, and potential peer pressure impacts. Although parents do not deliberately engage in passive sharenting, it may have similar impacts on the child, due to PII being distributed without the child's consent.

Finally, young children are least likely to identify invisible sharenting, because it is covert. Although parents may not seek to deliberately deceive, older children, such as young adults, may be aware of the risks of sharenting. Nevertheless, the impact is difficult to quantify, and children might accept it as an aspect of growing up in an increasingly digital community.

As sharenting becomes pervasive for online influencers, this additional socialization may shift the overall cultural understanding and acceptance from the child's perspective. For example, even if a child is not in a “mom-fluencer” family, if they grow up watching toy demonstration videos and vlogs from other families, they may begin to assume sharenting is an acceptable part of their own childhood experience.

4.3 Audience/community

A three-level visualization of household interaction is helpful to consider the “ripple effects” of sharenting to increasingly expansive circles (see Figure 4). Tier 1 includes a household's extended family and friends. Grand-sharenting is a common and relatable example: grandparents who experience the joy of a grandchild's arrival may enthusiastically repost information about that child with the assumption that this is their prerogative (e.g., Cino & Vandini, 2020). This first tier of community-based sharenting presents social complications, as the personal relationships between sharers can be impacted by prior family history, expectations, and more. While a child's healthcare information, for example, can be managed by parents without significant community interference, the control of other PII—including photos and videos—is more fraught.

Tier 2 includes social units with whom a household directly, and regularly, interacts. Schools, daycare providers, extracurricular groups, and churches are typical examples. Schools have a unique advantage in access to a child's information. In the United States, FERPA outlines how public schools can share students' information with third parties upon request and without parents' consent. Such “directory information” includes PII, such date of birth, home address, photos, and some medical data (e.g., height, weight). Sharenting via the digital platforms that have become more popular during the pandemic may put these regulations to the test.

Tier 3 includes the broader community, where a household's direct and/or regular interaction is not requisite. For example, the U.S. Kimberly-Clark brand Huggies advertised game-day newborns during the 2021 Super Bowl. An omnichannel marketing campaign shared a birthdate, picture, first name, time, and location for eight babies, albeit with parents' permission (Cision, 2021). Any Twitter user who browses the associated #WeGotYouBaby hashtag becomes an information co-owner in this broader sharenting community. Other members of that community can include social units with whom a household infrequently interacts, local media, social media followers, and service providers. Even in a healthcare setting, which generally holds that patients' images require the same privacy safeguards as the rest of the medical record, images used for treatment, payment, or healthcare operations may not require patients' or parents' authorization (Romig, 2018) outside the jurisdiction of the GDPR. Although institutions may have strict guidelines for disseminating a child's information, enforcement at the employee level can be challenging and infrequent, especially as members become increasingly accustomed to sharing via online technology and if they receive positive reinforcement from their audiences.

4.4 Commercial institutions

Businesses are another important stakeholder in the modern sharenting ecosystem, having access to and/or creating technologies that collect user PII. Information and behaviors represent a large portion of the data collected and often monetized. During the pandemic, remote learning environments increased access to children's data in new ways, including data breaches that compound privacy concerns; the average cost of a breach is estimated at $4.24 million USD in 2021 (IBM, 2021). Commercial stakeholders that collect and/or distribute children's data illustrate invisible sharenting. Such information is shared outside parents' control or without their knowledge. Data privacy advocates often recognize the potential for significant harm but are not commonly included in sharenting-related discussions. Questionable data collection/use may not be unlawful but can make data exploitable, increasing children's vulnerability. For example, educational apps that sell data to marketers may cause data to become misused, undermining educators' efforts to improve the quality of their teaching programs, reducing parents' trust and self-efficacy perceptions, and spurring policymakers to respond by creating regulatory interventions that may affect a business's bottom line.

Other commercial stakeholders who can encourage invisible sharenting include social media providers. For example, photo dumping (users take a selection of unrelated recent images from their device and “dump” them online simultaneously) is a recent trend (Cooper, 2021). However, as access to photos—including those of children—increases, so does their unintended use by other people (Besmer & Lipford, 2010) and the potential for invisible sharenting.

Social media providers suggest that users' information is protected—especially for children regarding exploitative content (Facebook, 2021). However, the design of many social media sites encourages third-party data collection to increase advertising revenue, which carries an inherent privacy risk that users are generally unaware of. For example, advertisers, app developers, and publishers can use The Meta Business Tools to develop user targeting and share user information collected on and off Facebook. Similarly, smartphones and other devices used by children often contain physical trackers that collect precise latitude, longitude, and timestamp data that third parties collect and sell to advertisers, retailers, and other commercial entities interested in consumer behavior (NY Times, 2019). This surveillance creates a location-based profile that can be used to identify a child without consent, leading to invisible sharenting.

4.5 Policymakers

Our conceptual framework is especially relevant for policymakers as they craft legislation designed to address problems created by sharenting in an evolving digital environment. While regulatory approaches vary significantly worldwide, policymakers are united by a common goal to create laws and regulations that benefit the public, although they may also be swayed by lobbyists from commercial interests. Acknowledging the many stakeholders in sharenting reveals a complex ecosystem that needs to be considered to develop and improve laws and regulations.

For example, COPPA focuses on data shared by children; it does not cover their parents. The FTC held a public workshop in 2019 examining “The Future of the COPPA Rule,” but dominant considerations remained protecting children who were personally online and thus either directly providing their data or having it indirectly collected (FTC, 2019). The EU GDPR does not currently address digital literacy, yet parents' likelihood to improve digital privacy practices is positively correlated with this important factor (e.g., Walker et al., 2016). Parents with low literacy may become more likely to opt out of GDPR-mandated disclosures—allowing for the commodification of their child's private information.

Several US initiatives have been suggested to improve the protections afforded to children's information: raising the COPPA age coverage to 16, enabling an individual over 13 or their parents to request that their PII be permanently deleted, and establishing a Youth Marketing and Privacy Division at the FTC (Markey, 2021a), the “Clean Slate for Kids Online Act of 2021” (Durbin, 2021), and the Children and Teens' Online Privacy Protection Act (Markey, 2021b). Legislation has been proposed to update COPPA (Castor, 2021) to give parents independent grounds to legally challenge unauthorized data collection (Steinberg, 2021). In England, while the draft Online Safety Bill (2021) evidences an increasing awareness of the potential for online harm to adults and children, it also focuses upon commercial entities. It only refers to children in the context of them accessing material that might cause them harm.

Different regulatory interpretations of the “significant harm” that may occur from all forms of sharenting (active, passive, and invisible) offer interesting policy implications. In most case law, a determination of significant harm usually warrants state or federal intervention. The likelihood of significant harm will need to be established, with risk management as a critical outcome. There are also implications from laws that empower parents, including those who want to stop others from sharenting. Citing the GDPR, a Dutch court required a grandmother to remove a child's images from Facebook and Pinterest (Roobeek & Picheta, 2020). However, similar rulings are unlikely in the United States because federal legislation regarding privacy is weaker than free speech regulations (Steinberg, 2020).