UNICEF - Child Rights Impact Assessments in Relation to the Digital Environment

APRIL 2024

Developing Global Guidance for Child Rights Impact Assessments in Relation to the Digital Environment Summary of Initial Project FindingsSummary of Initial Project Findings

APRIL 2024

The age of technology and the internet has brought tremendous benefits to society, including for children. Digital access provides opportunities for learning, communication, play, and social interaction, creating vast potential for realizing children’s rights. However, the spread of digital technologies also comes with a broad spectrum of risks and harms to which children can be particularly vulnerable. Under the UN Guiding Principles on Business and Human Rights (UNGPs) as well as the Children’s Rights and Business Principles (CRBPs), all companies including those developing, deploying, and using digital technologies have a responsibility to identify and address the adverse human rights impacts with which they are involved – both online and offline. This responsibility is particularly important in regard to children’s rights, as the impacts businesses have on children may be severe, long-lasting, and more likely to be irreversible.1 Background 1 Prof. John Ruggie, former Special Representative of the UN Secretary-General for Business and Human Rights and OECD, What is child vulnerability and how can it be overcome?, 2019.

© UNICEF/UN0221433

2 CHILD RIGHTS IMPACT ASSESSMENTSUnder the UNGPs and CRBPs, companies have a responsibility to 1) identify and assess actual or potential adverse impacts on children’s rights; 2) integrate findings and take appropriate actions to address, prevent or mitigate identified impacts; 3) monitor and track the effectiveness of their responses and; 4) communicate efforts to address their impacts. Why assess impacts on children’s rights? “States parties should require the business sector to undertake child rights due diligence, in particular to carry out child rights impact assessments and disclose them to the public” Committee on the Rights of the Child, 2021

should require the business sector to undertake child rights due diligence, in particular to carry out child rights impact assessments and disclose them to the public” Committee on the Rights of the Child, 2021 Child Rights Impact Assessments (CRIAs) are a critical tool in meeting this responsibility. A CRIA is a process by which companies evaluate the impact of business operations and products or services against children’s rights as defined in the Convention on the Rights of the Child (CRC), and other internationally accepted human rights and child rights instruments. CRIAs can complement existing human rights due diligence (HRDD) or human rights impact assessment (HRIA) processes, and enable early consideration of risks (and sometimes opportunities). CRIAs are foundational tools for businesses seeking to identify their most salient child rights impacts, especially when deploying new products, features or services. The requisite stakeholder engagement involved in CRIAs can reveal knowledge gaps and support the creation of effective mitigation actions.2 They can also help businesses fulfil their UNGP responsibilities and comply with increasing regulatory obligations. Furthermore, CRIAs are valuable opportunities for collaboration with civil society, academia and other non-industry stakeholders. Finally, the practice of sharing CRIA findings and mitigation commitments helps to normalize the practice of child rights due diligence with a view to broadly advancing respect for children’s rights. 2 For more background, see UNICEF and DIHR’s Child Rights in Impact Assessments Report (2013) 3 CHILD RIGHTS IMPACT ASSESSMENTSDespite the value of CRIAs, businesses face challenges in identifying and assessing child rights impacts associated with the digital environment. These challenges include: • The rapid pace of technological innovation and advancements; • Difficulties in collecting accurate information on children’s presence and vulnerability to risks online; • Variations in the type and severity of impacts that can occur; and • A lack of guidance on how to systematically assess and address

environment. These challenges include: • The rapid pace of technological innovation and advancements; • Difficulties in collecting accurate information on children’s presence and vulnerability to risks online; • Variations in the type and severity of impacts that can occur; and • A lack of guidance on how to systematically assess and address the full spectrum of child rights in the context of the digital environment. Guidance and additional resources on how to effectively assess child rights will be particularly important as the regulatory environment evolves. Several regulations – notably the EU Digital Services Act, UK Online Safety Act, and EU Corporate Sustainability Reporting Directive, amongst others – are shaping how the technology industry assesses risks, addresses adverse impacts, and discloses those risks to the public. While these regulations do not require the assessment against the full spectrum of child rights, they do identify specific rights that should be considered by business, especially in pursuit of the safety of children online. As a result of these regulatory requirements, businesses are consolidating resources and streamlining internal risk assessment processes. There is a timely opportunity to align and incorporate child rights considerations into risk assessment and due diligence processes.

© UNICEF/UNI218442

4 CHILD RIGHTS IMPACT ASSESSMENTSDeveloping Global Guidance on CRIAs in Relation to the Digital Environment UNICEF is working with BSR (a non-profit consulting organization) to develop global guidance that supports the robust integration of child rights within business efforts to identify their human rights impacts in relation to the digital environment. This project aims to clarify how and why to conduct CRIAs, build CRIA capacity among diverse sets of industry players, and promote the widespread adoption of CRIA processes in relation to the digital environment. The purpose of this document is to share insights gathered during the first phase of this project to stimulate further discussion and guide ongoing efforts. The insights documented below are based on: stakeholder interviews. virtual roundtables with participants from industry, civil society, academia, government and investors. relevant guidance documents, tools,

this project to stimulate further discussion and guide ongoing efforts. The insights documented below are based on: stakeholder interviews. virtual roundtables with participants from industry, civil society, academia, government and investors. relevant guidance documents, tools, and research outputs related to child rights in relation to the digital environment. A review of CRIAs focused on the digital environment. HRIAs with a child rights and digital environment component. 28 2 86 150 8 35 5 CHILD RIGHTS IMPACT ASSESSMENTS1. Companies seek to understand impacts on children in the digital environment but few use CRIAs to do so. Businesses are not legally obligated to conduct CRIAs, and in practice many incorporate child-related considerations into broader risk assessment processes or “child safety” programmes. Stakeholder engagement revealed that this often includes assessing risks to children through compliance exercises, materiality assessments, via product/review cycles and broader trust and safety processes, or human rights due diligence processes (including HRIAs).

2. Most approaches to understanding risks to children do not include a comprehensive review against the full list of child rights. In many cases, assessment methods are risk-based but not rights-based (e.g. not based on child rights frameworks).

Accordingly, known issues (e.g. child sexual abuse material, bullying, privacy, forced labor in the supply chain), or those explicitly mentioned within regulations (e.g. exposure to violent content) receive the most attention.

3. A range of factors or “triggers” may compel companies to undertake CRIAs. When companies do decide to undertake a CRIA, it is often “triggered” by other assessment processes or external pressure. Most commonly, CRIAs are triggered by HRDD or other risk assessment processes that identify child rights as a salient issue in need of further review. CRIAs may also be undertaken in response to shareholder resolutions, stakeholder or civil society pressure, regulatory requirements, or internal escalation processes.

HRDD or other risk assessment processes that identify child rights as a salient issue in need of further review. CRIAs may also be undertaken in response to shareholder resolutions, stakeholder or civil society pressure, regulatory requirements, or internal escalation processes. CRIA Practices Within Companies

© UNICEF/UNI306750

6 CHILD RIGHTS IMPACT ASSESSMENTS1. Knowledge and capacity constraints are often cited as barriers to the integration of CRIAs within existing due diligence and compliance efforts. This integration can be hampered by a lack of internal expertise on child rights or understanding of the relevance of child rights for the product, service, or business; lack of applicable guidance on integrating/ assessing child rights; and a lack of context-specific resources/ tools.

2. General guidance on CRIAs can be difficult to translate into actionable steps within a company. Companies appear to struggle with translating general CRIA guidance to their respective digital contexts or products, and have stated that they feel illequipped to adopt off-the-shelf tools without the support of external or third-party consultants or experts. The most utilized CRIA tools (notably, the MO-CRIA tool developed for mobile operators) have been developed for use by specific industries, based on their business model and core service offerings.

3. There is uncertainty on how to engage children. Companies expressed a desire to speak with children, however, many mentioned that they were unsure of how to do so effectively given resource and timing constraints. Some companies manage child focus groups and youth advisory panels, or surveys, but acknowledged that these are not active in all user geographies, or for all age-groups, which can make it challenging to gather insights relevant to all children using their services.

Barriers to Conducting CRIAs

© UNICEF/UNI209835

7 CHILD RIGHTS IMPACT ASSESSMENTS• Regulatory requirements are shifting company approaches to risk assessment. Emerging regulations require companies to conduct risk assessments on risks to people and the environment. Some companies noted that this draws resources away from other teams

© UNICEF/UNI209835

7 CHILD RIGHTS IMPACT ASSESSMENTS• Regulatory requirements are shifting company approaches to risk assessment. Emerging regulations require companies to conduct risk assessments on risks to people and the environment. Some companies noted that this draws resources away from other teams and may result in fewer resources and less capacity to undertake assessments that are not specifically required under law. Others indicated that this may lead to the streamlining of due diligence and risk assessment processes which could result in 1) a decrease in risk assessments (including voluntary CRIAs) outside of central compliance functions, and/or 2) an opportunity for the integration of child rights within centralized assessment processes. • Businesses struggle to identify and assess impacts to child rights across different age groups, developmental phases, socioeconomic status, location, and other variables. Companies broadly acknowledge that children are particularly vulnerable to harm, however, they can have difficulty identifying children on the platform, especially if the user is not required to have an account to use the product (among other scenarios). As such, impacts and mitigation measures identified and implemented may address issues known to impact one cohort of child users, but be less applicable and/or appropriate for some groups of children than others, due to age, location or other factors. • The ways in which children access and use digital technologies are rapidly evolving, leading to novel potential or actual impacts to their rights. Rapidly evolving technologies including generative AI generate new - or exacerbate existing - risks. Businesses reported difficulties in identifying and assessing the risks to children at the pace of technological advancement and adoption. Certain risks may not be possible to identify immediately, thus there is a need for ongoing assessment of child rights impacts. • Transparency is limited due to liability, reputational, and confidentiality concerns. Businesses are reluctant to publicly disclose full-length risk assessment reports and findings of CRIAs due to concerns about potential risks to their reputation and legal and/or regulatory liability. The limited transparency hinders external stakeholder understanding and assessment of business practices and

confidentiality concerns. Businesses are reluctant to publicly disclose full-length risk assessment reports and findings of CRIAs due to concerns about potential risks to their reputation and legal and/or regulatory liability. The limited transparency hinders external stakeholder understanding and assessment of business practices and reduces opportunities for collaboration. It also creates challenges with respect to industry exchange for scaling up effective solutions and continuous learning. Challenges Across the Technology Ecosystem 8 CHILD RIGHTS IMPACT ASSESSMENTSWhat’s Needed To realize the benefits of robust CRIAs and address the challenges identified above, stakeholders voiced a need for guidance that:

4. Gives examples of best practices: Case studies that demonstrate what success looks like. Including guidance on applying more granular analysis – including considerations of age, local contexts, etc.

5. Provides guidance on salient issues for each right: A list of specific risk statements that teams can reference to better understand the specific risks associated with each child right.

6. Summarizes key information and risks: Up-to-date guidance on emerging risks, societal trends etc. that companies should be aware of.

7. Provides guidance on engagement with children: Best practices for meaningful and rights-respecting consultation with children on risks related to the digital environment.

1. Makes the “business” case for child rights and CRIAs: A short deck or adaptable resource on child rights and the utility of CRIAs that can be used to socialize the issue with internal stakeholders and leadership.

2. Provides accessible guidance: Simple, platform-agnostic guidance that can be applied to a wide variety of products or services and is adaptable to various geographies and company maturity levels.

3. Maps to the business model: Presents child rights considerations and a risk taxonomy that aligns with the business model of the company, the product/ platform/services offerings, and the various functions/teams.

9

CHILD RIGHTS IMPACT ASSESSMENTSNext Steps

levels.

3. Maps to the business model: Presents child rights considerations and a risk taxonomy that aligns with the business model of the company, the product/ platform/services offerings, and the various functions/teams.

9 CHILD RIGHTS IMPACT ASSESSMENTSNext Steps To address the difficult challenges stakeholders have highlighted, UNICEF is prototyping a modular CRIA toolkit adapted to the digital environment. The goal of the toolkit is to improve the rigor and consistent adoption of CRIAs in the digital environment and support stakeholders in implementation. Toolkit planned contents include:

1. A Child Rights Overview Deck that provides authoritative overview of child rights, why they are important, and the “business case” for conducting robust CRIAs.

2. A CRIA tool that provides: • A list of risk and impact statements to assess in relation to child rights in the digital environment with clear signposting of child rights, • Key considerations delineated by industry actor, type of technology or product feature, • Key considerations of vulnerability characteristics including individual and environmental factors.

3. Accompanying guidance, including guidance on best practice and baseline expectations for CRIAs in the digital environment; steps to determine appropriate mitigation measures to address salient risks or impacts; advice on incorporating CRIAs into broader human rights assessment or due diligence processes; and best practices for responsible child engagement.

A round of structured consultation with stakeholders to elicit feedback on the draft tool will begin in June and July 2024. Inputs gathered from stakeholder feedback will be incorporated into the final version of the tool which will be launched in late 2024. 10 CHILD RIGHTS IMPACT ASSESSMENTSCOPYRIGHT AND DISCLAIMER All rights to this publication and the accompanying material remain with the United Nations Children’s Fund (UNICEF). Any part of the report may be freely reproduced with the appropriate acknowledgment. © United Nations Children’s Fund (UNICEF) April 2024