Reading the Privacy Terms Behind One Ordinary Family Day Would Take 83 Hours

If you sat down to read every privacy policy and set of terms behind one ordinary day with your children, you would need about 83 hours, or 10.4 full working days, according to “Everyday Surveillance”, a white paper Web3 Foundation published on 28 September 2026. For its model UK family, the researchers counted 257 documents and 1,184,835 words, about a third more than the complete works of Shakespeare.

Priya and Tom are not a real family. The researchers built them from public data on how ordinary households live: a Leeds couple, 40 and 43, with children aged 8 and 11. In their modelled day, Priya pays for school meals on ParentPay, the 8-year-old watches YouTube Kids and plays Roblox on a tablet, and the 11-year-old uses TikTok and Snapchat on her iPhone. Counting the family’s Samsung TV, Alexa, Ring doorbell, online shopping and smart meter too, the researchers linked that one day to 88 organisations. The longest single document is Roblox’s Terms of Use, at 36,966 words, about two and a half hours of reading on its own.

25 of the Family’s 88 Organisations Say They May Collect Information From the Children

Of the 88 organisations linked to the family’s day, 25 have documents saying they may collect information from the children. Separately, at least 26 products in the household say they may use the family’s data to train or improve AI. The study’s examples include Roblox voice recordings used for safety systems and conversations with Snapchat’s My AI chatbot, which Snapchat says it keeps until the user deletes them.

At school, the monitoring software in the model can flag words pupils type, take a screenshot when it detects a possible risk and send an alert for staff to review, so what a child types on a school device can be recorded even if she deletes it straight away. The paper’s illustrative school record logs 11,400 keystrokes in a week, deleted messages included, and the model estimates school cameras could capture the two children about 100 times a day between them.

Under the Department for Education’s statutory guidance, Keeping children safe in education, every school must have appropriate filtering and monitoring in place as part of its legal duty to keep children safe online as well as offline. The department describes monitoring as software that follows what pupils do on devices, sometimes recording it, and raises alerts about illegal, inappropriate or potentially harmful activity, including bullying.

Most of the Companies in the Study Say They May Use Your Data for Marketing

Across six model households in the UK and US, the researchers read the documents of 143 companies and institutions. More than four in five say they may use personal data for marketing or advertising. Three quarters describe profiling, which means working out your interests or making predictions about you, seven in ten may share data with commercial partners such as advertisers and data brokers, and two thirds set no fixed date for deleting it.

“None of this is hidden. Rather, it is disclosed, in public, in full, and at a volume that functions as concealment.”

— Gavin Wood, founder of Web3 Foundation

The researchers say a documented permission shows what an organisation says it may do, not that it actually did it. The families are models, the results change with the products, settings and opt-outs a household chooses, and the paper has not been independently reviewed, though the foundation has published its method so others can check the sums. The Zurich-based foundation, set up by Gavin Wood to support decentralised web software, wants services designed so people disclose less by default, for example proving a child’s age without handing over a date of birth.

You Can Ask the School for Its Monitoring Policy and a Copy of Your Child’s Data

The Department for Education tells schools to make sure parents and carers are aware of their filtering and monitoring policy, so you can ask to see it. You can also ask the school for a copy of the personal data it holds about your child, known as a subject access request. Anyone with parental responsibility can make one, you can ask in person rather than in writing, and the school must respond within one calendar month.

If you have a Samsung TV, check its automatic content recognition, or ACR, setting, which captures information about what you watch. The researchers assumed it was switched on for their model families, and Samsung says ACR is optional and can be turned off at any time in the TV’s Settings menu.

For your children’s own apps, games and social media, the Information Commissioner’s Office Children’s code applies: services likely to be used by children must give them a high level of privacy by default. The code does not cover schools themselves.

The full white paper is at web3.foundation/insights.