Financial technology companies are using information about children’s online behavior to assemble detailed profiles, according to The Epoch Times. The reporting raises concerns about privacy and surveillance involving minors.

The available source summary does not identify the businesses involved, the products through which information is collected or the countries where the activity occurs. It also provides no figures for the number of children affected. Those limits prevent conclusions about the scale of the practice or whether any particular company has broken a law.

Financial technology, commonly shortened to fintech, covers software and services used for activities such as payments, saving, borrowing and managing money. Information held by those services can include records needed to operate an account. Behavioral information is a separate category: it describes how someone interacts with a digital service rather than simply recording a financial transaction.

The distinction is relevant to understanding the report. Collecting information to process a payment does not, by itself, establish that a company is building a broader behavioral profile. The source summary describes profiling but does not explain which information is included or how companies connect it to individual children.

How digital profiles are assembled

In general, digital services can record events such as opening an application, viewing a page or selecting a feature. Depending on the service and its configuration, those events may be associated with an account identifier, a browser cookie or an identifier attached to a device. These are common technical mechanisms, not confirmed methods used by the companies in this report.

A profile brings multiple observations together. It can contain information a user supplies directly, activity a service observes and characteristics inferred from that activity. An inference is an estimate rather than a verified personal fact. For example, repeated interaction with a topic can be treated as an indication of interest without establishing why the user viewed it.

Identification also has several meanings. A dataset does not need to display a person's name to distinguish one account or device from another over time. Conversely, a device identifier does not necessarily establish who was using a shared device when an event occurred.

Children’s privacy rules depend on the service

In the United States, the Children’s Online Privacy Protection Act and its implementing rule govern certain online collection of personal information from children under 13. Covered operators generally must provide notice and obtain verifiable parental consent before collecting, using or disclosing that information, subject to exceptions. The framework also includes parental rights to review information and request its deletion.

Those requirements do not apply identically to every service used by a minor. Coverage depends on factors including whether a service is directed to children or has actual knowledge that it is collecting personal information from a child under 13. The available reporting does not establish those facts for any business.

What to watch

Further reporting would need to identify the companies, the information collected, how long it is retained and who can access it. Details about parental notice, consent and deletion options would help establish which protections apply and how families can exercise them.