gdpr-parental-consent

GDPR Parental Consent Verification

Overview

Article 8 of the GDPR establishes that when information society services are offered directly to a child, the processing of personal data based on consent is lawful only where the child is at least 16 years old. Member States may lower this threshold to a minimum of 13 years. Where the child is below the applicable age threshold, consent must be given or authorised by the holder of parental responsibility. The controller must make reasonable efforts to verify that the person giving consent holds parental responsibility, taking into consideration available technology. This skill provides a comprehensive framework for implementing Art. 8 compliance, drawing on EDPB Guidelines 5/2020, national implementations, and enforcement precedents.

Legal Foundation — Article 8 GDPR

Art. 8(1) — Conditions for Child's Consent

Where Article 6(1)(a) (consent) applies in relation to the offer of information society services directly to a child, the processing shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, processing is lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.

Art. 8(2) — Verification Obligation

The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology.

Art. 8(3) — Other Lawful Bases Unaffected

Article 8(1) does not affect the general contract law of Member States such as rules on the validity, formation or effect of a contract in relation to a child.

Age Thresholds by EU/EEA Member State

Country	Age Threshold	National Legislation
Austria	14	Austrian Data Protection Act (DSG) Section 4(4)
Belgium	13	Act of 30 July 2018, Art. 7
Bulgaria	14	Personal Data Protection Act, Art. 25a
Croatia	16	Implementation Act on GDPR, Art. 19
Cyprus	14	Law 125(I)/2018, Art. 8
Czech Republic	15	Act No. 110/2019 Sb., Section 7
Denmark	13	Danish Data Protection Act, Section 6(2)
Estonia	13	Personal Data Protection Act, Section 8
Finland	13	Data Protection Act 1050/2018, Section 5
France	15	Loi Informatique et Libertes, Art. 45
Germany	16	GDPR default — no lowering enacted
Greece	15	Law 4624/2019, Art. 21
Hungary	16	GDPR default — Act CXII of 2011 amended
Ireland	16	Data Protection Act 2018, Section 31
Italy	14	Legislative Decree 101/2018, Art. 2-quinquies
Latvia	13	Personal Data Processing Law, Art. 10
Lithuania	14	Law on Legal Protection of Personal Data, Art. 5
Luxembourg	16	Law of 1 August 2018, Art. 8
Malta	13	Data Protection Act Cap. 586, Art. 30
Netherlands	16	GDPR default — UAVG did not lower
Norway	13	Personal Data Act, Section 5
Poland	16	GDPR default — Act of 10 May 2018
Portugal	13	Law 58/2019, Art. 16
Romania	16	GDPR default — Law 190/2018
Slovakia	16	GDPR default — Act 18/2018
Slovenia	16	GDPR default — Personal Data Protection Act
Spain	14	Organic Law 3/2018, Art. 7
Sweden	13	Act 2018:218, Chapter 2, Section 4
UK (post-Brexit)	13	Data Protection Act 2018, Section 9; UK GDPR Art. 8