2025 G7 Data Protection and Privacy Authorities Roundtable Statement

Promoting Responsible Innovation and Protecting Children by Prioritizing Privacy

June 19, 2025

---

1. Following the adoption of the G7 Data Protection and Privacy Authorities’ Action Plan in Rome in October 2024, and the commitment “to continue to promote the development and usage of emerging technologies in ways that reinforce trust and respect privacy” we, the G7 Data Protection and Privacy Authorities (G7 DPAs)^{Footnote 1}, met to discuss the ways in which prioritizing privacy in the design and use of new technologies supports responsible innovation and protects children online.
2. We are unquestionably in an era of significant, data-driven innovation, and this innovation can bring important economic, societal and public interest benefits. However, much of the value of innovation can be jeopardized when it is not accompanied by trust, which is created and maintained by building safety and privacy into the design of new technologies and services and considering any special protections required to act in children users’ best interests. This is the responsible innovation that we, the G7 DPAs, support.
3. Privacy serves a dual, mutually beneficial role with respect to responsible innovation. It is a pre-condition to individual freedom, dignity, and autonomy, and when it is recognized, respected and advanced by developers of new technologies it enables responsible innovation. When individuals have confidence that their data is protected and used lawfully and responsibly, trust exists; where trust exists, innovation is embraced.
4. We, the G7 DPAs, emphasize that prioritizing privacy by identifying and addressing potential privacy and data protection issues in the design, development and deployment of new technologies can achieve more than facilitating compliance with legal obligations. It can also be a driver of economic success and societal growth.

Prioritizing Privacy to Support Market Confidence and Individuals’ Trust

5. To support confidence in the digital world, individuals need to know that their applicable rights and expectations, as well as all applicable regulatory requirements, are respected. Without this confidence, individuals may feel misled or otherwise wary about engaging with innovative products and services.
6. To ensure that individuals’ expectations and applicable rights are met, organizations should consider privacy and data protection from the outset of product design. Such considerations include ensuring that appropriate security safeguards are in place, considering whether and what personal data is needed for the technology or service, and providing individuals clear and meaningful choices where information processing might otherwise differ from what the nature of the particular product or services would lead them to reasonably expect.
7. Individuals should be clearly informed about what data processing activities will be associated with the use of a device or service – particularly where those activities vary from reasonable expectations. This clarity should come from truthful and transparent communications. It should not require the user of a new device or service to engage with an overly complex and user-unfriendly privacy policy or to search deep within a device’s settings to exercise any controls that may be available to them.
8. When individuals can see that their privacy is a priority in the design, development and deployment of a new technology or service trust will follow, increasing potential uptake. On the other hand, where the failure to consider privacy, consumers’ reasonable expectations, or applicable rights leads to data breaches or inappropriate uses of a technology, or if individuals cannot easily exercise their rights or choose between the options available to them – an organization’s place in the market may be at risk.
9. The prioritization of privacy throughout the lifecycle of a technology, from design to development to deployment, can allow organizations to unleash innovation, seize market opportunities, and do so in a cost-effective way.

Prioritizing Privacy to Protect Children

10. While prioritizing privacy can lead to economic and public interest benefits for stakeholders, it is particularly important with respect to the protection of children online. Use of the Internet and new technologies is near-ubiquitous among children in G7 countries. Surveys regularly find, for instance, that an overwhelming majority of teenagers in those countries own, or have regular access to, smartphones. The current generation of children will also be the first raised in a world strongly influenced by artificial intelligence.
11. The design, development and deployment of new technologies that are used by or applied to children – particularly with respect to the processing of personal data by those technologies – will have significant effects and impact. Though they have grown up in a world of modern technologies, children remain particularly vulnerable to their associated harms. They may be susceptible to deceptive design practices, or simply may not understand their rights or the consequences of certain data processing, highlighting the need for careful design that makes that exploration safe. Children want and are entitled to be active digital citizens and they deserve tailored and strong privacy protections which consider their best interests and allow them to fully participate in the digital world.
12. Many jurisdictions have recognized that children may be impacted by technologies differently than adults, be at greater risk of being affected by privacy-related issues, and therefore require special protections. For instance, each of the jurisdictions in the G7 requires parental consent for at least some processing of children’s information. The Recommendation of the OECD Council on Children in the Digital Environment^{Footnote 2} has also affirmed the importance of accounting for the best interests of children in the digital environment and implementing measures that provide for age-appropriate child safety by design. International agreements such as the Convention on the Rights of the Child^{Footnote 3} as adopted by the United Nations General Assembly also speak to the concept of the best interests of the child, which requires that children’s well-being and rights be primary considerations in decisions or actions concerning them directly or indirectly.
13. In the context of privacy, this may mean turning off or limiting tracking of users known to be children; communicating privacy practices to children and their parents in clear and accessible ways that are adapted to the age of the child using the service; ensuring that products and services do not include deceptive design patterns that influence children to make poor privacy decisions or to engage in harmful behaviours; adapting privacy impact assessments to consider the specific perspectives and experiences of children; and, obtaining parental consent for certain processing.
14. We also note that many jurisdictions have introduced, or are considering introducing, recommendations or requirements that age assurance be used as a tool to support the protection of children online. We recognize the efforts already made by some Data Protection Authorities to provide guidance on the ways in which age assurance can be designed, developed and deployed in a privacy-protective manner, including the Joint Statement on a Common International Approach to Age Assurance^{Footnote 4} and the EDPB Statement on Age Assurance^{Footnote 5}. Those statements emphasize that where age assurance technologies are implemented, this should be done in a risk-based and proportionate manner, only when necessary and proportionate for the aim pursued, and in compliance with privacy and data protection principles.
15. Specific requirements with respect to designing, developing or deploying technologies that are used by or otherwise affect children will vary by jurisdiction. However, we emphasize that the protection of children’s best interests as a primary consideration is a key element of responsible innovation.

Prioritizing Privacy in Practice

16. The prioritization of privacy serves as an opportunity for creative thinking, focused exploration and unconventional solutions – the very drivers of innovation. We, the G7 DPAs, seek to ensure that our work is done in a way that encourages responsible innovation in the knowledge that there will always be a pragmatic, operationalizable, and privacy-respectful path to achieving the promise of our modern technological society.
17. Building privacy into the design, development and deployment of a new technology should not focus only on meeting a series of compliance checkboxes. Rather, it should include a meaningful consideration of how the technology is likely to, or will, impact people – in both positive and negative ways – and finding appropriate, creative solutions to mitigate identified harms.
18. Making privacy a priority – including by building it into the design, development, and deployment of new technologies – will involve different steps depending on the context. However, the G7 DPAs find that certain key considerations consistently support, and lead to the success of, this process. They include:
    • Determining whether the processing of personal data is necessary for the development or operation of the technology;
    • Conducting an assessment of privacy risks that may be created or exacerbated by this technology, and regularly revisiting or updating this assessment;
    • Making appropriate design, development and deployment decisions, including considering the use of privacy-enhancing technologies, to mitigate identified risks;
    • Designing technologies in a way that supports the exercise of privacy rights; and,
    • Monitoring and regularly re-assessing the effectiveness of risk mitigations.
19. We encourage organizations to act as responsible innovators by adopting privacy by design practices even when they are not legally required in a particular jurisdiction.
20. We also:
    • Reassert that building privacy into new technologies can drive economic success and innovation;
    • Emphasize the importance of considering the best interests of children when designing, developing or deploying technologies that they use or by which they are confronted;
    • Will continue to support organizations in their efforts to innovate responsibly, including through guidance documents and the issuance of investigation findings that clarify the application of our national laws.