That could include failing to ask for parental consent before collecting data.