The impact of digital transformation is rapidly spreading across healthcare. Today, providers are constantly driven by the need to improve patient outcomes by incorporating advancements in analytics, health data records, and AI. Digital health has the potential to revolutionize healthcare in Africa, solving problems of limited human resources, high disease burdens, and limited access [1].

The digital transformation of health increases opportunities for improved care, as well as potential risks from unethical use [2]. Children and youth, particularly those under the age of 17, are potentially more vulnerable to the harms posed by non-ethical data use and privacy infringements online [3]. Typically, young people below 17 lack the essential maturity needed to discern harm from good, making them vulnerable to harmful data extraction, human rights violation, privacy infringements, and other dangers online [4]. Additionally, incidences of data breach of vulnerable groups in the past reveal an urgent need to invest in data protection in healthcare [5].

However, in low-income contexts, the adoption of data protection regulations for digital health platforms is slow, with the majority of the population uninformed about these protections where they exist [6]. As a result of poor data governance frameworks and limited enforcement, many mobile health applications fail to satisfy privacy, safety, and ethical standards [2]. With these tools having access to confidential information, such security risks expose data to potential breaches. This lack of governance disproportionately affects young people [3].

Global frameworks such as the European Union’s Global Data Protection Regulation, the US’s Health Insurance Portability and Accountability Act (HIPAA), and the WHO Global Strategy on Digital Health 2020–2025 specify standards for health information privacy and security requirements in higher-income countries. These regulations spell out key considerations for young people under 17 years (such as data minimization, autonomy, confidentiality, and data protection impact assessment) which can potentially be adapted for African contexts, which face various challenges in protecting their health data.

A recent assessment of the digital health strategies of 10 African countries by Holly and colleagues showed a lack of specific considerations for young people. Among these countries, only one mentioned the right to privacy [3]. The evidence, therefore, strongly hints that Africa faces unique challenges in consumer protection and privacy, including weak regulatory frameworks, low digital literacy, increased vulnerability to cybersecurity risks, and low levels of youth inclusion in policy development [2]. Identified regulatory limitations include the lack of youth input, broad and unclear principles, conflicting values, and poor enforcement [7].

Despite these challenges, several African countries demonstrate a desire to prioritize young people’s rights. South Africa’s Protection of Personal Information Act (2020), for example, provides clear regulations for handling children’s data, requiring consent from competent persons, data minimization, and robust safeguards. Similarly, Kenya’s Data Protection Act (2019) mandates that health data be handled by professionals bound to secrecy and incorporates age verification and consent requirements. At least 29 other African countries have documented data protection policies, indicating growing recognition of personal data security needs [8]. Efforts are not limited to individual territories. Regional bodies like the African Union, Economic Community of West African States (ECOWAS), and Southern African Development Community (SADC) have established minimum data processing standards, although these often lack specific protections for young people [9].

Noting the challenges that countries and international communities face in protecting young people, there is a need for action to bridge existing gaps. For one, there is a need to devise inclusive data governance frameworks for accessing vulnerable groups’ data. As the digital health landscape evolves, significant thought must be given to designing effective mechanisms for recognizing, characterizing, and mitigating the peculiar risks faced by young people, such as non-consensual data sharing and exploitation. Policies must emphasize principles such as data minimization, age-appropriate consent, and data security [10]. From new ways to recognize young people’s digital footprints to more robust systems for age verification, there must be significant emphasis on the importance of designing and regulating these technologies to protect them.

While many vulnerable groups are aware their data is being digitized, few fully grasp the extent of this data use [11]. This indicates a need for training digital users on the negative impacts of improper technology use, engaging digital health experts in policy design, and full enforcement of data protection laws. Indeed, exploratory studies have suggested that educational interventions have a positive effect on knowledge and personal practices to ensure digital safety [12]. There is, therefore, a need for large-scale awareness and educational campaigns to draw public attention and drive advocacy.

Engaging young people in policymaking is important for inclusivity and effectiveness [13]. Advisory groups, networks, and committees such as Meta’s ‘Safety Advisory Council’ and the Africa CDC’s Youth in Digital Health Network (YiDHN) are examples of models that can be adapted by stakeholders. Such frameworks should address key barriers that typically emerge in attempts at youth engagement, such as social exclusion [14]. Additionally, such efforts should be accompanied by clear roadmaps for integrating recommendations into policy and practice [15]. Youth representation should also be ensured at decision-making boards and meetings.

Beyond regulations, digital literacy is crucial for empowering young people to navigate digital health safely. As Carah and colleagues (2024) highlight, keeping young people away from the digital world will only expose them to more harm long-term [15]. Therefore, governments, private companies, and other actors must invest more into digital literacy and capacity-building, educating young people on digital safety.

Collaborating with international bodies such as the ECOWAS, AU, and SADC, countries should adopt robust policies for handling young persons’ data across borders. These provisions should fully address key essentials, including security, interoperability, ethical use of AI, patient privacy, and transparency [8]. Recommendations outlined in the WHO’s Global Digital Health Strategy will be instrumental in these provisions, as countries create regulations and continually enhance them to meet people’s needs [10].

Safeguarding young people’s privacy and consumer rights is essential for ethical and effective digital health transformation in Africa. Ongoing dialogue and collaboration among stakeholders—young people, policymakers, healthcare providers, and digital innovators—are critical. By proactively addressing these concerns, Africa can leverage digital technologies to improve health outcomes while protecting the rights and well-being of its youth.