Overview

This article ensures the lawful processing of a child’s personal data in the context of information society services. For children under 16 years old, parental or guardian consent is required, and organizations must take reasonable efforts to verify that consent has been provided by the parent or guardian.


Key Principles

  • Parental Consent: Consent must be obtained from a parent or legal guardian for children under the age threshold (typically 16, subject to Member State variations).

  • Lawfulness: Processing of children’s personal data must comply with GDPR principles.

  • Verification: Organizations must implement reasonable measures to verify parental consent.

  • Transparency: Information provided to children and parents must be clear and understandable.

Organizational Applicability

This article applies to all organizations that process children’s personal data within the EU:

  • Providers of information society services (e.g., online platforms, apps, social media).

  • Organizations offering services to children under 16 or Member State-defined age thresholds.

  • Public and private entities responsible for obtaining and verifying parental consent.

Implementation Requirements

  • Implement mechanisms to obtain parental or guardian consent prior to processing a child’s personal data.

  • Apply verification procedures to ensure the validity of parental consent.

  • Maintain records of consent for accountability purposes.

  • Ensure all communications to children and parents are clear and age-appropriate.

Implementation Guidance

  • Include consent forms or verification steps in online registration processes.

  • Use reliable tools or methods to verify parental identity and consent.

  • Train staff to recognize and properly handle data of children under GDPR.

  • Regularly review and update consent collection processes to maintain compliance.

Periodic Review

  • Frequency: Annually or when changes occur in services offered to children.

  • Responsible Role: Data Protection Officer (DPO) or Compliance Team.

  • Outcome: Ensure ongoing compliance with child consent requirements and proper documentation.

Non-Compliance Risks

  • Fines: Up to €20 million or 4% of global annual turnover.

  • Legal Exposure: Regulatory enforcement, invalid consent issues, or legal challenges.

  • Reputational Damage: Loss of trust with users, parents, and regulatory authorities.

  • Operational Risk: Suspension of services or deletion of child data due to lack of valid consent.