EdLaw
Children's consent
Conditions applicable to a child's consent for information society services. The EU default age is 16; Member States may lower it to no less than 13 — a key divergence from the UK GDPR's fixed 13.
Article 8 — Conditions applicable to child's consent in relation to information society services
Verbatim from EUR-Lex (consolidated text 02016R0679-20160504), via the Publications Office Cellar API.
1. Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.
Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.
2. The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology.
3. Paragraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child.
Sources
- EUR-Lex — Regulation (EU) 2016/679 (GDPR), consolidated text 02016R0679-20160504
- European Data Protection Board — guidelines and recommendations
Meta
All article text above is reproduced verbatim from the EUR-Lex consolidated EU GDPR (CELEX 02016R0679-20160504), extracted mechanically via the Publications Office Cellar API. Each article carries the official ELI identifier as a trailing attribute anchor (e.g. {#art_8}), which also works as a fragment on the EUR-Lex HTML view; paragraphs and points carry derived anchors built from the article id and their printed labels (e.g. {#art_6-1-a}).