The worry, when a parent asks about a device that knows where their child is, is usually some version of: does this make us responsible for that data. In most arrangements of this kind, the answer is no, and understanding why makes the rest of the conversation shorter.
Where a family buys a device, sets it up, and decides who can see the information, the family is making the decisions about that data. The school has not chosen the device, cannot see the data, and has no say in what happens to it. Being a controller is about deciding the purposes and means of processing, and in that arrangement the school is not deciding anything.
This changes if the school is involved, if it provides devices, requires them, or has access to a dashboard. Then there is a genuine question and it needs your DPO rather than a web page.
The questions worth asking a family
Can anyone at the school see where the child is? Can the school be asked to? Who can see the data, and can that list be changed without the parent knowing? What happens to it when the family stops using the device? If a device company cannot answer those four in plain language, that tells you something as well.
Reasonable things to ask for
- Written confirmation that the school has no access and will not be given any.
- Confirmation of where the data is held.
- A copy of the family-facing privacy notice, so you know what they were told.
- A note on the file that this was checked, and when.
Beyond data protection
Data protection is not the only lens. A device that can record audio or images in a classroom raises a question that has nothing to do with who the controller is, and that question belongs to the school regardless. This is another reason the capability test is worth running: it tells you which of these conversations you are actually having.
Yado makes a screenless safety device for children, so we have a commercial interest in this subject. About these pages.
- UK GDPR, Articles 4 and 24, legislation.gov.uk
- ICO, guidance on controllers and processors, ico.org.uk
- ICO, Age Appropriate Design Code, ico.org.uk
- August 2026. First published.