EdLaw
Children's consent and age verification
Conditions applicable to a child's consent in relation to information society services, and the age-verification provisions. Central to EdTech: services are routinely used by, and offered to, children.
Article 8 — Conditions applicable to child's consent in relation to information society services
Verbatim from legislation.gov.uk (consolidated text, valid as at 2026-06-19).
1. Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 13 years old. Where the child is below the age of 13 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.
...
2. The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology.
- (a) amend paragraph 1 so as to change the age for the time being specified in that paragraph (but not to an age lower than 13 years or higher than 16 years);
- (b) make provision in relation to services specified, or of a description specified, in the regulations for a different age to apply for the purposes of paragraph 1 (but not lower than 13 years or higher than 16 years).
3. Paragraph 1 shall not affect the general contract law as it operates in domestic law such as the rules on the validity, formation or effect of a contract in relation to a child.
4. In paragraph 1, the reference to information society services does not include preventive or counselling services.
Article 8ZA — Child’s consent in relation to information society services: age verification
Verbatim from legislation.gov.uk (consolidated text, valid as at 2026-06-19).
- (a) that a data subject who has given consent to the processing of his or her personal data in relation to the offer of information society services is at least the age for the time being specified in Article 8(1);
- (b) in the case of a service specified, or of a description specified, in regulations under Article 8(2A)(b), that a data subject who has given consent to the processing of his or her personal data in relation to the offer of information society services is at least the age for the time being applicable by virtue of those regulations in relation to that service or description of service.
- (a) provision imposing requirements on persons specified, or of a description specified, in the regulations;
- (b) provision about the steps that must or may be taken by such persons for the purposes of complying with a requirement imposed by the regulations;
- (c) provision about the monitoring of compliance with a requirement imposed by the regulations;
- (d) provision about the enforcement of a requirement imposed by the regulations.
- (a) make provision amending, repealing, revoking or applying (with or without modifications) any provision of the data protection legislation (within the meaning given by section 3(9) of the Data Protection Act 2018);
- (b) make provision for exceptions to requirements imposed by the regulations;
- (c) make provision about the time by which, or period within which, a thing must be done;
- (d) make provision by reference to standards, arrangements, specifications or technical requirements as published from time to time;
- (e) confer functions on a person, including functions involving the exercise of a discretion, and make provision in connection with the procedure for exercising the functions.
5. In paragraph 1, the reference to information society services does not include preventive or counselling services.
Sources
- legislation.gov.uk — UK GDPR (Regulation (EU) 2016/679 as retained), consolidated text
- ICO — UK GDPR guidance and resources
Meta
All article text above is reproduced verbatim from the consolidated UK GDPR on legislation.gov.uk, extracted mechanically from the official XML. Repealed or omitted text appears as "..." exactly as published. Amendment history is available via each article link. Each provision carries its official identifier as a trailing attribute anchor (e.g. {#article-35-2}, attributes syntax) — the same id legislation.gov.uk uses, so .../eur/2016/679/article/35/2 at the source corresponds to #article-35-2 here.