Designing Games for GDPR: Negotiating Understandings of GDPR in EU Schools

This study examines how students in EU secondary schools can be engaged as co-researchers in understanding the General Data Protection Regulation (GDPR) through the design and testing of gamified educational applications. Drawing on participatory design, citizen science, and participatory action research traditions, the authors bring together Danish designer students and Italian tester students across three schools as part of a small-scale sub-inquiry within the broader Erasmus+ Spadatas project. The work is framed by an ecological view of schooling, which holds that students' school and personal digital spaces increasingly overlap through social media.

Students built GDPR-themed quiz apps using the BASIC design model and Code.org, and three of these prototypes were tested with peers and younger pupils. Feedback gathered through questionnaires and ethnographic observation showed that testers rated the apps positively but asked for more playful, social-media-inspired formats. A notable finding is the gap between students' confidence and their practice: participants believed they already understood data privacy, yet incidents such as a classmate's video posted without consent and a disciplinary case over shared comments revealed that they often fail to recognize how school and personal online ecologies intersect.

The authors conclude that pairing citizen science with participatory design, and treating prototyping as an epistemic practice, is an effective means of engaging young people with GDPR. They also identify remaining challenges, including cultural and linguistic barriers across the Italian and Danish contexts and the need for better frameworks governing the timing of follow-up sessions. The study's scope is limited to a small number of schools and a single project cycle, positioning its contribution as exploratory evidence for participatory approaches to privacy education rather than as generalizable findings about GDPR literacy across the EU.