Parental Notification Gaps in ChatGPT-5: An Empirical Study

Key Findings

• — Privacy violence, fraud, hate speech and malware produced no parent notifications in any of 20 sessions each, across three test windows from October to December 2025.
• — Pornography and physical harm notified the parent in 20 of 20 sessions each, although neither was named as a notification trigger in the vendor documentation in force; health consultation notified in 8 of 20.
• — Harmful content reached the child account in 16 of 20 malware sessions, 16 of 20 privacy-violence sessions and 12 of 20 fraud sessions, the categories with no parent notification.
• — Benign educational prompts near sensitive topics were refused or sanitised in up to 12 of 20 sessions per category (physical harm), and several sessions showed safeguards to the child without any parent notification.
• — The authors propose a versioned public notification taxonomy, configurable per-category parent alerts and privacy-preserving parent summaries.

Methodology Notes

Two-phase protocol: PAIR-style iterative prompt refinement over the API, then human replay in the consumer UI on one child profile with the parent inbox monitored; 20 adversarial trajectories and 20 benign prompts per category; three replay windows (October to December 2025) spanning the GPT-5.1 and GPT-5.2 releases. LLM judge validated against adjudicated human labels on a 10% stratified sample (n=142, Cohen's kappa 0.71; inter-human 0.79). One ChatGPT-5 configuration tested; other platforms reviewed from documentation only. AIES 2026 proceedings vol 9 issue 2, pp. 902 onwards; published 2026-10-11. Verified from the 9-page proceedings PDF (Table 4) and the Crossref record; the published PDF abstract says physical harm and pornography alerted consistently, which differs from the Crossref abstract wording. Test windows given by month only; observation dates set to the first and last day of that span.

Sources