It's not quite that cut and dry in the UK[0], and the article mentions that parental consent was required.
But if they were operating in the UK, I'm somewhat doubtful their disclosures as reported in the article could be classed as informed consent under GDPR given the "specific protection" children are provided [1].