Paper, clay, or paint do not require an account or impose terms of service. An application for drawing, video editing, music composition, or image generation may do so. When a school or workshop introduces one, it also incorporates storage infrastructure, access rules, and a specific distribution of responsibilities.
I write as a cultural organiser who must decide which tools to bring to a creative activity, not as a data protection officer or as a teacher evaluating learning. The specific decision rests with the data controller and, where applicable, their data protection officer.
Six tools that are not the same
Before assessing an application, it is advisable to understand what kind of tool it is:
- Local software: installed on the device and capable of functioning without sending content to an external service.
- Institutional educational platform: administered by the educational authority or the school within an approved infrastructure.
- Cloud service with a school account: centralises access but remains dependent on a provider and its terms.
- Commercial service with individual accounts: each participant maintains their own relationship with the service.
- Social network: creation, publication, recommendation, and interaction occur within the same environment.
- Generative system: in addition to processing instructions and materials, it may subject them to specific conditions regarding retention, review, or use.
These do not form an automatic scale from lower to higher risk. Local software can be insecure, and an external platform can be well-governed. The classification serves to identify what must be verified.
Age does not resolve the decision
Article 7 of Organic Law 3/2018 allows the processing of a minor's data to be based on their consent when they are over fourteen years of age, except in cases where the law requires assistance. Below that age, when the basis is consent, it must be provided by the person exercising parental authority or guardianship.
This does not mean that all school processing depends on consent. The AEPD notes that many forms of processing necessary for educational purposes are supported by other legal bases. Nor does it mean that turning fourteen allows one to accept any contract, open any account, or authorise any publication. The age of consent for processing, contractual capacity, copyright, and publication are distinct matters.
The account changes who can act
An individual account may facilitate continuity outside the classroom, but it also shifts decisions to the student or the family: recovery, export, closure, changes to terms, and provider communications. An institutional account retains more capacity within the school, although it requires defining who administers it and how the work is separated.
Before requesting individual accounts, it is advisable to check whether the objective can be achieved with a demonstration, a shared controlled account, pseudonymous profiles, or a local tool. Minimising data does not consist solely of requesting fewer fields: it also consists of avoiding unnecessary relationships with providers.
Seven questions before adopting an application
- Who decides and who is responsible? The person conducting the workshop does not always represent the data controller.
- Who opens the account? The school, the family, or the participant.
- What data is processed? Identification, voice, image, usage behaviour, and produced work.
- What is it used for? Service provision, analytics, security, product improvement, or other declared purposes.
- Where and for how long are they retained? Including copies, logs, and international transfers.
- How are they exported and deleted? Deleting an account does not, in itself, guarantee the immediate disappearance of all copies.
- What rights are granted over the materials? One must read the exact clause, rather than assuming that every platform can appropriate the works or that none can reuse them.
Works can also be data
A drawing may include a signature, a filename, metadata, or information about the person who created it. A recording may contain voice and image. An instruction to a generator may reveal interests, circumstances, or third-party data. Removing the visible name does not automatically render the set anonymous.
Creative work must be distinguished from associated data and the participant's image. Furthermore, creating must be separated from publishing: the fact that a tool allows sharing does not make that function necessary for the activity.
What institutional guidance provides
The AEPD guide for educational centres covers platforms, web, networks, images, controllers, processors, transfers, and erasure. In 2026, the Spanish data protection authorities also published common principles for contracting and using digital educational platforms, with attention to risk assessment, privacy by design, commissioning, and transfers.
The EducaMadrid Data Protection Delegation compiles recommendations on applications that store data in clouds external to educational platforms and on the use of institutional channels. This is a precedent for internal governance, not a certification transferable to any association, museum, or workshop.
These sources do not offer a national list of approved creative applications. Nor do they replace the analysis of a specific version and set of conditions, which are subject to change.
Choosing also means limiting dependencies
The most visually appealing tool is not necessarily the most suitable. The objective, accessibility, the possibility of working without an account, exportability, file format, support, and the exit strategy upon completion are what matter.
The guide How to organise a digital creation workshop with minors structures these decisions before, during, and after the activity. If the results are to be exhibited or published, consult How to exhibit or publish works by children and adolescents.
About the open conversation
A practical question remains open: how centres document the evaluation of a creative tool without turning every workshop into an unmanageable file. There is also a lack of a public and homogeneous comparison between creation services used in Spain.
Procedures that explain who evaluated the tool, what account-free alternative was considered, and what happened to the works upon completion are of particular interest. If you work in education, mediation, or data protection and can provide a documented case, write to me. A specific experience does not prove a general rule, but it can highlight which questions are missing.
The author's relationship with the cases
There is no financial, professional, or collection-based relationship with the cited institutions.
Sources
- Organic Law 3/2018, article 7.
- AEPD, Guide for educational centres.
- AEPD and regional authorities, Basic principles for the contracting and use of digital educational platforms.
- EducaMadrid, guides and recommendations from its Data Protection Delegation.
- Committee on the Rights of the Child, General Comment No. 25.