# Standards and Regulatory References — GDPR Parental Consent ## Primary Legislation ### GDPR Article 8 — Conditions Applicable to Child's Consent in Relation to Information Society Services - **Art. 8(1)**: Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years. - **Art. 8(2)**: The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology. - **Art. 8(3)**: Paragraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child. ### GDPR Recital 38 — Specific Protection of Children "Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data. Such specific protection should, in particular, apply to the use of personal data of children for the purposes of marketing or creating personality or user profiles and the collection of personal data with regard to children when using services offered directly to children. The consent of the holder of parental responsibility should not be necessary in the context of preventive or counselling services offered directly to a child." ### Directive (EU) 2015/1535 — Information Society Services Definition - **Art. 1(1)(b)**: "Service" means any Information Society service, that is to say, any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services. This definition is incorporated by reference into GDPR Art. 4(25). ## EDPB and WP29 Guidance ### EDPB Guidelines 05/2020 on Consent under Regulation 2016/679 (Version 1.1, Adopted 4 May 2020) - **Section 6**: Addresses conditions for children's consent. Confirms that Art. 8 applies only when consent (Art. 6(1)(a)) is the lawful basis and the service is an information society service offered directly to a child. - **Paragraph 133**: The EDPB notes that "reasonable efforts" to verify parental consent under Art. 8(2) must be proportionate to the nature and risks of the processing activities. - **Paragraph 134**: Verification measures should be proportionate to the type of processing and should not lead to excessive data collection about the parent. - **Paragraph 135**: Where processing involves low-risk data, verification through a confirmatory email to the parent may be sufficient. For higher-risk processing involving special categories of data, more robust verification is expected. ### WP29 Opinion 2/2009 on the Protection of Children's Personal Data (Adopted 11 February 2009) - Pre-GDPR guidance that established the principle that children require specific protection in the digital environment. - Recommended that controllers implement age verification mechanisms before collecting personal data from children. - Stated that parental consent mechanisms should be robust enough to provide a meaningful level of assurance. ## National Implementation Laws ### Belgium — Act of 30 July 2018 on the Protection of Natural Persons with Regard to the Processing of Personal Data - **Article 7**: Sets the age threshold at 13 years for information society services. ### Denmark — Danish Data Protection Act (Act No. 502 of 23 May 2018) - **Section 6(2)**: Sets the age threshold at 13 years. ### France — Loi Informatique et Libertes (Law No. 78-17, as amended by Ordinance No. 2018-1125) - **Article 45**: Sets the age threshold at 15 years. Requires that consent be given jointly by the minor and the holder of parental responsibility for children aged 15 and under. For minors who have reached 15, consent is given solely by the minor. ### Ireland — Data Protection Act 2018 - **Section 31**: Sets the age threshold at 16 years. The Minister may, by regulation, reduce this to not less than 13 years (no such regulation has been made). ### Italy — Legislative Decree 101/2018 - **Article 2-quinquies**: Sets the age threshold at 14 years. Below 14, consent must be given or authorised by the holder of parental responsibility. ### Spain — Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights - **Article 7**: Sets the age threshold at 14 years. ### United Kingdom — Data Protection Act 2018 - **Section 9**: Sets the age threshold at 13 years for UK GDPR Article 8 purposes. ## Enforcement Decisions - **TikTok (DPC Ireland, Decision IN-21-3-3, 2023)**: EUR 345 million fine. TikTok failed to implement adequate age verification and parental consent mechanisms for users under 13. Default public profiles for child accounts violated Art. 5(1)(c) and Art. 25. The DPC specifically addressed Art. 8 compliance regarding the adequacy of parental verification. - **Instagram/Meta (DPC Ireland, Decision IN-21-3-4, 2022)**: EUR 405 million fine for allowing children aged 13-17 to operate business accounts with public-by-default settings. The DPC found that Meta failed to apply appropriate age-related protections and did not adequately implement Art. 8 and Art. 25. - **TikTok (CNIL, SAN-2022-027, 2022)**: EUR 5 million fine for deficiencies in cookie consent mechanisms affecting children, compounding the Art. 8 compliance concerns. - **TikTok (ICO, 2023)**: GBP 12.7 million fine for processing data of children under 13 without appropriate parental consent under UK GDPR Art. 8. ## ISO/IEC Standards ### ISO/IEC 29184:2020 — Online Privacy Notices and Consent - Provides guidance on the content and structure of privacy notices including consent collection. - Section 5.3 addresses consent for children, referencing age-based consent thresholds and parental authorisation requirements. ### ISO/IEC 27701:2019 — Privacy Information Management System - **Annex D.7.2.8**: Addresses consent in the context of children. Recommends that organizations determine applicable age thresholds and implement age verification and parental consent mechanisms.