Kids are spending more money on goods and services and more time online than ever before. This makes them an incredibly tempting target for online marketing. But what are the data protection issues where children are concerned? This paper considers child data protection using the concepts of knowledge, control and parental involvement; it reminds us of the DMA code of practice for online marketing to children and presents review of how 20 of the top children's websites match up to the code. While most of the children's websites do post a data protection policy, it is not easy for children to find or understand; few policies are displayed at the point of information collection; children have little control over what happens to any information they do disclose and the common practice of involving parents is woefully inadequate. It is hoped that this paper will highlight some of the issues involved in protecting children's online privacy and encourage debate on how the industry should proceed in this tricky area.