The trick is to not track good children at all, only those bad ones. I'd you leverage sanction lists (that exist already) to track the bad children, you have all cases covered.

Any Santa related contractor (Santa helpers, elves, etc) have to check a sanction list to see if they can finalize a transaction with said child.

As for lists: when a child sends a request for particular gift, it starts a formal transaction. The other entity is legally allowed to process said child's data to provide the service they agreed upon.

Kids that have not sent a letter to Santa and are not mentioned in sanction lists, can still get gifts but Santa lacks profiling metadata and can only provide generic, unprofiled gifts. Which is good as already have sufficient amount of Bluetooth speakers and Paw Patrol toys.