# Regulatory Standards — Managing Consent for Children

## Primary Regulations

### GDPR — Regulation (EU) 2016/679

- **Article 8(1)**: "Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years."
- **Article 8(2)**: "The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology."
- **Article 8(3)**: Clarifies that Article 8 does not affect the general contract law of Member States, such as rules on validity, formation, or effect of a contract in relation to a child.
- **Recital 38**: "Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data."

### Children's Online Privacy Protection Act (COPPA) — 15 U.S.C. Section 6501-6506

- **Section 6502(b)(1)(A)(ii)**: Requires operators of websites or online services directed to children under 13 to obtain verifiable parental consent before collecting, using, or disclosing personal information from children.
- **FTC COPPA Rule (16 CFR Part 312.5)**: Specifies acceptable methods for obtaining verifiable parental consent, including: signed consent form, credit card transaction, toll-free number staffed by trained personnel, video conferencing, government-issued ID with knowledge-based authentication, and facial recognition comparison.

### UK ICO Age Appropriate Design Code (Children's Code)

Effective September 2, 2021, under Section 123 of the UK Data Protection Act 2018. Establishes 15 standards of age-appropriate design for information society services likely to be accessed by children in the UK. The Code applies to all online services — including apps, connected toys, social media, streaming services, and educational platforms — that process UK children's personal data and are "likely to be accessed by children."

### CNIL Guidance on Age Verification (June 2022)

The French supervisory authority published guidance assessing the adequacy of various age verification methods. Key findings:
- Self-declaration alone is insufficient for services with significant data processing
- A combination of methods (layered approach) provides the best balance of accuracy and privacy
- Age verification systems must themselves comply with data minimization principles
- Third-party age verification services must be assessed for their own data protection compliance

## Supervisory Authority Guidance

### EDPB Guidelines 05/2020 on Consent (Children-Specific Sections)

- Paragraphs 128-136: Specific guidance on children's consent under Article 8
- The "reasonable efforts" standard for verification must be proportionate to the risk and nature of the processing
- Controllers must determine whether their service is "offered directly to a child" by assessing content, marketing, and design

### Irish DPC Fundamentals for a Child-Oriented Approach to Data Processing (December 2021)

The Irish Data Protection Commission published guidance emphasizing:
- The best interests of the child must be a primary consideration
- Organizations must carry out a DPIA where processing of children's data is likely to result in a high risk
- Default settings must provide the highest level of privacy protection
- Processing of children's data for direct marketing, profiling, or automated decision-making requires particular caution

### Spanish AEPD Guidelines on Children and Adolescents (2021)

The Spanish supervisory authority set the age threshold at 14 (per Organic Law 3/2018) and requires:
- Age verification that goes beyond self-declaration for services involving profiling
- Specific transparency measures adapted to the child's comprehension level
- Parental dashboard functionality for monitoring and managing consent