TfL said children's data will be shared to prevent anti-social behaviour
The Information Commissioner's Office has criticised Transport for London for "collecting data without a clear purpose" for the children's photocard.
From June Transport for London (TfL) made it mandatory for children aged between 11 and 18 to carry an Oyster photocard in order to gain free travel.
But some parents have raised concerns given that TfL admits application data will be shared with its subsidiaries.
TfL said it needed such information to prevent anti-social behaviour.
The company took "the security of personal data extremely seriously", it said.
Police regularly use information on the adult Oyster card system to get details about passenger movements.
BBC London has learned that in the past year they made at least 3,000 requests for information.
Rachel Rolfe, a mother who objects to the practice, said: "I don't think that children need ID cards, once your information is out there you can never get it back. And I think you can't protect it."
A spokesperson for the ICO said: "It is not clear whether young people are really being offered a genuinely free choice here.
"We have some concerns that the information provided to young people about Zip cards does not clearly state why the personal information is being collected, how it will be used and how long it will be retained.
Parents say they are concerned about information security
"We have serious concerns about this scheme and we are contacting TfL to discuss this further."
A spokesperson for TfL said the card holder was required to abide by its Behaviour Code.
A young person with criminal convictions, warnings, reprimands and other sanctions committed on the public transport network could have the right to free travel withdrawn, the spokesman said.
"In order to enforce these specific cases, personal information is requested by the Metropolitan Police Service, City of London Police Service and British Transport Police," he added.
Applicants who do not agree to the Behaviour Code will not get the card.
If someone withdraws consent after getting the card they will be fined £5 and the card will be scrapped.
This page is best viewed in an up-to-date web browser with style sheets (CSS) enabled. While you will be able to view the content of this page in your current browser, you will not be able to get the full visual experience. Please consider upgrading your browser software or enabling style sheets (CSS) if you are able to do so.