Complaints about covert phone surveillance are not a hypothetical privacy debate. The UK’s Information Commissioner’s Office (ICO) regularly fields reports from employees who have discovered tracking applications silently collecting their locations, messages, and call logs on devices they thought were private. Some of these cases start with an anxious parent. Others stem from a business trying to protect its data. Regardless of intention, the General Data Protection Regulation (GDPR) treats unauthorized phone monitoring with enormous seriousness – and the legal fallout can be as severe as criminal charges or fines reaching into the millions of euros.
For anyone weighing a mobile monitoring solution, the conversation no longer starts with “which app is most powerful.” It starts with a constellation of urgent legal questions. Can you track a minor’s smartphone without their knowledge? Under what circumstances does an employer cross the line? When does a digital safety net become an illegal intrusion? And perhaps most pointedly: how do tools that promise discrete monitoring stand up to Europe’s strict data protection regime?
The following analysis unpacks those questions by moving through the key scenarios where monitoring occurs – parenting, employment, and covert use – and the legal frameworks that govern each. It draws on guidance from the ICO, the European Data Protection Board (EDPB), the National Institute of Standards and Technology (NIST), and workplace policy research by the Society for Human Resource Management (SHRM), while examining how specific feature sets in software like Spapp Monitoring intersect with the GDPR’s core requirements.
Monitoring a child’s phone under GDPR: age, consent, and the limits of legitimate interest
Nowhere is the tension between digital care and legal exposure fiercer than in parental monitoring. In the EU, children are not simply property to be guarded; they are data subjects whose rights grow with their maturity. The GDPR sets a default age of 16 for a child to independently consent to the processing of their personal data, though member states can lower that threshold to 13. But here’s the legal subtlety that trips up many parents: installing a parental control app isn’t about obtaining consent from the child to use an online service. It’s about processing the child’s personal data as a data controller – a role parents assume the moment they deploy monitoring software.
Most parents rely on “legitimate interests” (Article 6(1)(f)) as their lawful basis. The ICO has acknowledged that protecting a child’s safety can constitute a legitimate interest, but that interest must be balanced against the child’s own right to privacy. A blanket installation that records every WhatsApp message and keystroke on a teenager’s Android device will almost certainly fail the balancing test. A review of EDPB guidance makes clear that blanket surveillance, untethered from a specific documented risk, is disproportionate, no matter how well-intentioned.
The child’s age changes the equation dramatically. For a 9-year-old, transparency duties are lighter; explaining the monitoring in clear, age-appropriate terms might suffice. For a 15-year-old, Article 8 and the principle of fairness demand that they understand what data is harvested and why. Courts across Europe have increasingly recognised that adolescents hold privacy rights that can be breached even by a parent. In a widely referenced Dutch case, a court found that a mother who covertly installed tracking software on her teenage son’s phone violated his right to respect for private life under Article 8 of the European Convention on Human Rights, which the GDPR supplements and reinforces.
Before reaching for a third-party application, parents should examine the built-in tools that ship with most Android devices. Google’s Family Link, Digital Wellbeing, and screen time restrictions offer location sharing, app blocking, and usage limits within a framework that is inherently less intrusive – because Google itself operates as a data controller with standardized consent flows. Those tools reflect a design philosophy that aligns with data minimisation: only collect what’s essential to the feature. For many families, they are the legally safest starting point. Yet they leave gaps. Family Link, for instance, won’t record calls from unknown numbers or surface warning signs in social media chats – scenarios where parents with specific safety worries may need something more granular.
That’s where specialist monitoring apps enter the picture. When a parent installs Spapp Monitoring on a child’s Android phone, they become a data controller with full responsibility for configuring the tool lawfully. The software can track location, log SMS and calls, and monitor social media interactions. From a GDPR standpoint, the difference between lawful use and a regulatory breach lies in the settings. A parent who activates continuous location polling and records every message “just to be safe” is collecting far beyond what is necessary, potentially triggering complaints from the child – or, if the child seeks advice from a privacy advocacy group, formal complaints to a data protection authority. The EDPB’s data minimisation principle (Article 5(1)(c)) demands that every data point be demonstrably necessary. A parent using Spapp Monitoring could, for example, set geofence alerts around a specific risky location rather than logging a 24/7 GPS trail, and record only calls from numbers not in the contact list. That kind of calibrated approach shows the thoughtful boundary-setting that regulators expect.
Practitioners who work at the intersection of digital safety and privacy law increasingly stress one practical step: document your safety concerns before installation. Write down the specific dangers you are trying to mitigate – whether it’s grooming, radicalisation, or a disappearance risk – and then map the data categories to those concerns. The exercise