Swiggle

Provider statement (checked 8 November 2026): Swiggle is a free, ad-free search engine website for Key Stage 1 and 2 pupils, intended to be set as the default search engine on school or home devices. Data flows described by the provider: search terms typed by the child are checked against blocked terms before a search runs; results are retrieved through Google Custom Search with Google SafeSearch and filtered using SWGfL-managed lists of approved and blocked sites. The optional browser extension (Chrome and Firefox) changes the default search engine and adds a Screen Cover button, which the provider says can be used to report a page to SWGfL or to the school's system administrator, and which shows the adult details of the covered page, possibly including its address or the previous page. A public Report Page form sends SWGfL the search query, page address, reason, an optional name and a required email address. The site sets Google Analytics and Google Tag Manager cookies if analytics cookies are accepted. The provider does not describe what search term, IP address or device data is passed to Google when a search runs. Not independently verified.

Provider statements (checked 8 November 2026): intended users are primary pupils in Key Stages 1 and 2, with teachers and parents as supervising adults; one SWGfL article gives the age range as 7 to 11. Pupils search without signing in. Data the service handles, as described by the provider: search terms typed by children; the search query, page address, reason, optional name and required email address submitted through the Report Page form; details of a covered page when the Screen Cover is used; and cookies for session, personalisation (avatar and background), language and, if accepted, Google Analytics identifiers. The FAQs state that some searches are redirected to an informational message because they indicate a harm or issue for the user, which means search terms can reveal welfare or safeguarding concerns about a child. The provider does not say whether search terms are stored or linked to an IP address or device. Not independently verified.

Swiggle can be used without any pupil account, name or login (FAQs), so a school can deploy it without giving the provider pupil records. In a developer reply on the Firefox Add-ons store dated 19 August 2020, SWGfL stated that the Swiggle service does not collect personal data as defined by GDPR and collects only anonymous aggregated usage data. That provider statement is six years old, predates the current SWGfL Privacy Policy (last updated May 2026) and later versions of the extension, and has not been independently verified. Practical minimisation steps for schools: have an adult using a school email address submit Report Page forms rather than pupils; set cookie choices on managed devices where possible; and teach pupils not to type names or personal details into search boxes. Ask the provider: Is any data collected when a search is made beyond anonymous aggregated statistics, and is any of it linked to IP addresses or devices?

Provider statement: the SWGfL Privacy Policy (last updated May 2026, checked 8 November 2026) names South West Grid for Learning Trust as data controller for the personal information it covers and lists swiggle.org.uk among the websites it covers. The same policy says SWGfL acts as a data processor, under separate data processing terms, only for certain services it provides to schools. No Swiggle-specific terms of service, data processing agreement or subprocessor list was found. The policy says SWGfL shares information with third-party providers of hosting, administration, security monitoring, research and data processing, without naming them. Swiggle is powered by Google Custom Search and uses Google Analytics and Google Tag Manager, but Google's role and the terms under which any data reaches Google are not described. Independently verified: South West Grid for Learning Trust is an active company (number 05589479) with its registered office in Exeter, on the Companies House register. The school should confirm with SWGfL whether it acts as controller for Swiggle use in schools, which would mean no processor agreement is offered, and what role Google plays.

No hosting or processing location for Swiggle is stated on the Swiggle pages or in the SWGfL Privacy Policy (checked 8 November 2026). The policy states generally that transfers of personal data outside the UK rely on an adequacy decision or standard contractual clauses approved by the Information Commissioner, without describing any Swiggle-specific transfer. Searches are served through Google Custom Search and the site uses Google Analytics, so data may reach Google, but the provider does not describe where or under what terms. Schools outside the UK, including service schools in the EU, would also need to assess any transfer under EU GDPR. Ask the provider: Where are the Swiggle website, search logs, Screen Cover reports and Report Page submissions hosted? Are search terms or IP addresses passed to Google, and if so under which Google terms and transfer safeguards?

The SWGfL Privacy Policy (checked 8 November 2026) says contact details are kept for no longer than 7 years after the last contact and that data may be kept longer for research and statistical purposes. It does not state how long Swiggle search terms, server logs, Screen Cover report details or Report Page submissions are kept. The Swiggle cookie banner says the session cookie and associated server data are deleted after a short period, without saying how long. Ask the provider: How long are search terms, IP addresses and server logs kept? How long are Report Page submissions and Screen Cover reports, including any email address, kept, and how are they deleted, including from backups?

No Swiggle-specific security information was found (checked 8 November 2026). Pupils do not need accounts to search, so there are no pupil passwords to manage. SWGfL publishes a vulnerability disclosure policy, and its data protection policy refers to assurance processes such as Cyber Essentials as an example, but no certificate for SWGfL or Swiggle was found or verified on an issuing body's register. In October 2026 SWGfL published a statement that it had updated its products to protect against a PHP issue. The provider notes that the Screen Cover bookmarklet may not work on websites with a strict Content Security Policy, so the extension is the more reliable option. Ask the provider: Which security certifications cover Swiggle? How are search logs and report data protected, and who at SWGfL can access them? How would schools be told about a security incident affecting Swiggle?

The Swiggle pages (checked 8 November 2026) describe smart search tools and a SwiggleBot helper character but do not say whether any feature uses artificial intelligence or a third-party AI model. The SWGfL Privacy Policy states that SWGfL may use personal information, including information shared when using its services, to train AI to help target and deliver its services; its plain-language summary says data used for this will not identify people. The policy does not say whether Swiggle search terms or reports are included, and no opt-out is described. SWGfL's AI Use Statement is general and does not mention Swiggle. Ask the provider: Does the SwiggleBot or the search filtering use AI, and if so which models or providers? Are Swiggle search terms, Screen Cover reports or Report Page submissions used to train or improve AI systems, and can schools opt out?

Provider statements (checked 8 November 2026): all search queries are checked and filtered automatically before a search runs; blocked queries show a refusal message, and searches that indicate a harm or issue for the user are redirected to an informational message. Results are filtered automatically using Google SafeSearch and SWGfL's lists of approved and blocked sites. These automated decisions affect what content a child sees, but they are not described as producing scores or profiles of individual children, and no alerts to the school based on search behaviour are described. Human review applies to reported pages: SWGfL staff evaluate reports and decide whether to remove a page from the index. The provider does not say whether blocked or redirected searches are logged or reviewed by people. Not independently verified.

Provider statements: the SWGfL Privacy Policy (last updated May 2026, checked 8 November 2026) explains data subject rights, offers a child-friendly version, gives privacy@swgfl.org.uk and a telephone number for requests, states that requests are normally answered within one month, and names the ICO as the route for complaints. Swiggle pages link to a Swiggle privacy page (swiggle.org.uk/privacy/), but that page blocks automated access, so its content could not be checked in this review and the school should read it directly. Because pupils use Swiggle without accounts, access, correction or deletion requests about search activity may be hard to fulfil unless SWGfL can link records to a device or IP address. Ask the provider: Can SWGfL locate, export or delete data about a particular device's use of Swiggle, and how should a school make such a request?

Key risks for school use and suggested safeguards: 1. Treating Swiggle as a filter. The provider states it is not a web filter and cannot block all harmful content. Keep it as an addition to filtering and monitoring that meets the DfE filtering and monitoring standard, and describe it that way in the online safety policy. 2. Unsuitable results and images still appearing, including through the Image search tab. Supervise younger pupils, decide whether image search is appropriate for Key Stage 1, and install the extension so the Screen Cover is available. 3. Disclosures through searches. Searches suggesting a child may be at risk are redirected to an information page, but no alert to the school is described, so the school's monitoring system and staff vigilance remain the route for the DSL to learn of concerns. 4. Screen Cover handling. Agree who responds when a pupil uses the Screen Cover, how the page is blocked locally, how it is reported to SWGfL and how the incident is logged. 5. Personal data in reports. The Report Page requires an email address; ask staff, not pupils, to submit reports using school accounts. 6. Third-party data flows. Searches use Google Custom Search and the site can set Google Analytics cookies; check cookie settings on shared and managed devices. 7. Wider data use. The SWGfL group privacy policy allows research use and AI training on service data and is not Swiggle-specific; seek written confirmation of how Swiggle data is treated. 8. Deployment conflicts. Chrome policy overrides the extension's search setting, so set the Omnibox search provider in Chrome policy if Swiggle should be the default on managed Chromebooks. 9. Fit for the school. Results are UK-focused and English only, and provider pages variously describe the audience as Key Stages 1 and 2 or Key Stage 2 only; check suitability for the year groups and pupils concerned.

Checks for the school's data protection lead: 1. Read the Swiggle privacy page at swiggle.org.uk/privacy/ directly, as it could not be retrieved in this review, and note any differences from the SWGfL group policy. 2. Confirm with SWGfL whether any personal data, including IP addresses and search terms, is collected or logged when pupils search, and how long it is kept. 3. Confirm whether search terms or IP addresses are passed to Google and under what terms, and where Swiggle data is hosted. 4. Confirm whether Swiggle data is used for research or AI training and whether schools can opt out. 5. Confirm SWGfL's role as controller for Swiggle and whether any written terms are available for schools. 6. Check how the Screen Cover sends reports to a teacher or system administrator and what page details are included. 7. Decide whether a full DPIA is needed. Used without accounts, Swiggle may involve limited personal data, but the users are children, their searches can reveal sensitive information and the data flows to SWGfL and Google are not fully documented, so the school should at least record a screening assessment and the reasons for its decision.