Make your website GDPR compliant today — Cookiebot automates cookie consent, scanning, and compliance so you don't have to.
Try Cookiebot Free
Article 8
Conditions applicable to child's consent in relation to information society services
Chapter 2|Principles|📖 8 min read
1. Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.
2. The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology.
3. Paragraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child.
Understanding This Article
Article 8 provides special protection for children in the digital environment by establishing higher standards for consent when information society services are offered directly to children. This recognizes that children may not fully understand the implications of consenting to data processing and deserve enhanced protection.
Scope and Application:
Article 8 only applies in specific circumstances: (1) the service must be an 'information society service' (online services like social media, gaming platforms, educational apps, streaming services); (2) the service must be offered 'directly to a child' (child-directed services or services where the provider knows the user is a child); and (3) consent must be the legal basis under Article 6(1)(a). It does not apply when other legal bases are used (e.g., a school processing student data under a public task legal basis). The definition of 'information society service' comes from Directive 2015/1535 and broadly covers services provided at a distance, electronically, and at the individual request of the recipient.
Age Threshold and Member State Flexibility:
The default age is 16 - children at or above this age can consent for themselves without parental involvement. However, Member States can set a lower age by national law, but not below 13. This creates variation across the EU: some countries use 16, others have lowered it to 15, 14, or 13. The age refers to when the child provides consent, not when they use the service. This flexibility allows Member States to align with national legal traditions and cultural norms regarding children's capacity, but ensures a minimum protection floor at age 13.
Parental Consent Requirement:
For children below the applicable age threshold, processing based on consent is lawful only if consent is 'given or authorised by the holder of parental responsibility.' This means either the parent directly consents on the child's behalf, or the parent authorizes the child to consent. 'Holder of parental responsibility' is determined by national law but typically includes parents and legal guardians. Services cannot accept a child's consent alone below the threshold - they must obtain parental involvement. This applies each time consent is required as a legal basis; however, if the service can rely on a different legal basis (like contract for paid services), Article 8 doesn't apply.
Verification Obligations:
Paragraph 2 requires controllers to make 'reasonable efforts' to verify parental consent, considering available technology. What is 'reasonable' depends on: the risks of the processing, the state of technology, implementation costs, and the type of service. High-risk processing (collecting sensitive data, profiling, public disclosure) requires stronger verification. Methods include: email verification to parent-provided addresses, credit card verification (small charge to adult payment method), government ID checks, video verification, or knowledge-based authentication. However, verification must not be so burdensome it creates a barrier to legitimate service access or involves excessive data collection that undermines children's privacy. The 'available technology' reference acknowledges that verification methods evolve - controllers should use current best practices. No perfect verification exists; the requirement is reasonable efforts, not absolute certainty.
Relationship to Contract Law:
Paragraph 3 clarifies that Article 8 doesn't override national contract law about children's capacity to form contracts. A child might have capacity under national law to enter into a contract (thus making processing necessary for contract performance under Article 6(1)(b) rather than consent under 6(1)(a)), even if they're below the Article 8 consent age. The GDPR's consent provisions and national contract capacity rules operate independently. For example, if a 14-year-old in a country where the consent age is 16 purchases a product online, national law determines if they can form a valid purchase contract. If they can, processing for contract performance doesn't require parental consent under Article 8. However, if the retailer wants to send marketing emails to that 14-year-old (requiring consent as legal basis), Article 8 applies and parental consent is needed.
Enhanced Protection Rationale:
Children deserve special protection because they may be less aware of privacy risks and long-term consequences of data processing. Online profiling, targeted advertising, and data collection during formative years can have lasting impacts. Article 8 implements the UN Convention on the Rights of the Child principles in the digital context. It balances protecting children with recognizing their evolving capacities and avoiding patronizing restrictions that completely exclude them from digital participation.
Key Points
Children under 16 cannot provide valid consent for information society services without parental authorization (Member States can lower this to 13)
Controllers must make reasonable efforts to verify that parental consent was obtained, considering available technology
Applies only to information society services offered directly to children and only when consent is the legal basis
Does not override national contract law regarding children's capacity to enter into contracts
Age verification mechanisms must balance child protection with privacy and security considerations
Practical Application
Social Media Platform Example: A social media service offered directly to users, including children, must verify user ages. For users claiming to be 16 or older (in a Member State using the default age), they can create accounts and consent to data processing themselves. For users under 16, the platform must obtain parental consent before processing data based on consent. The platform implements verification by requiring users under 16 to provide a parent's email address, to which a consent request is sent. The parent must click a verification link and confirm consent. This represents a reasonable effort at verification given the service type and available technology.
Educational App Example: A free educational app offered directly to children collects learning progress data and personalizes content based on this data. The processing relies on consent (Article 6(1)(a)). For users under the applicable consent age, the app requires parental consent. The app uses a two-step verification: (1) child enters parent's email; (2) parent receives a link requiring them to create a parent account with age verification (credit card check or ID verification) before authorizing their child's use. This stronger verification is reasonable given the processing of children's educational and behavioral data.
Gaming Platform Example: An online game marketed to all ages has players including children. When a user indicates they are under 16, the platform restricts certain features requiring consent (like in-game chat, personalized advertising, sharing gameplay publicly) until parental consent is obtained. Core gameplay continues because it relies on contract (the terms of service) rather than consent, and paragraph 3 preserves contract law. For consent-requiring features, the platform sends a parental consent form via email with basic verification (parent must confirm from that email address).
Streaming Service Example: A video streaming service requires subscription payment, making contract (Article 6(1)(b)) the primary legal basis for processing. A 14-year-old can subscribe if national contract law permits, without parental consent needed under Article 8 (since consent isn't the legal basis - it's contract performance). However, if the service wants to collect additional data for personalized recommendations based on consent, or send marketing communications based on consent, Article 8 applies for those specific processing operations and parental consent is needed for users under the threshold.
Age Verification Challenges: A service wants to verify user ages but must balance verification effectiveness with privacy. Options include: (a) simple age declaration (low verification, acceptable for low-risk processing); (b) email verification to parent-provided address (moderate verification); (c) credit card verification (stronger but creates barriers and privacy concerns from collecting payment data); (d) government ID checks (strongest but highest privacy impact and implementation costs). The service chooses email verification as proportionate to the processing risks and available technology.
Member State Variation: A pan-European children's platform must account for different national age thresholds. The platform maintains a database of applicable ages by country (e.g., 16 in Germany, 13 in some other countries) and applies the relevant threshold based on user location. This adds complexity but is necessary for compliance.
Non-Applicable Scenario: A school uses a learning management system to process student data for providing education (a public task under Article 6(1)(e)). Article 8 doesn't apply because the legal basis isn't consent - it's public task. The school doesn't need parental consent under Article 8, though it may need to notify parents under transparency obligations and may need parental consent under national education laws.
Direct Offer Clarification: Article 8 requires services to be offered 'directly' to children. An adult-oriented service that happens to have some child users (without targeting children) may not trigger Article 8's heightened requirements, though such services should still implement age-appropriate protections and may be subject to other child protection laws. Conversely, a service with child-specific features, child-directed marketing, or design appealing primarily to children is offered 'directly' to children and must comply with Article 8.
Best Practices: (1) Implement age-gating mechanisms at account creation; (2) create child-safe defaults (privacy-protective settings by default for child accounts); (3) provide clear information to both children and parents about data processing; (4) make parental consent mechanisms user-friendly while maintaining security; (5) periodically re-verify ages as children grow; (6) consider privacy-by-design approaches minimizing data collection from children; (7) train staff on child protection obligations; (8) have clear processes for parental control and oversight of child accounts.