Protection of Children's Data
The GDPR recognizes that children merit specific protection regarding their personal data, as they may be less aware of risks, consequences, and safeguards concerned with data processing.
Age of Consent for Information Society Services
Article 8 addresses consent for information society services (online services) offered directly to children:
- Children aged 16 or over can consent to processing themselves
- For children under 16, consent must be given or authorized by the holder of parental responsibility
- Member States can lower this age to not below 13 years
- Controllers must make reasonable efforts to verify that consent is given by an appropriate person
Age Verification
Organizations must implement age-appropriate verification methods, which should be proportionate to the risks. Methods may include:
- Self-declaration
- Email verification sent to a parent
- Credit card verification
- More robust methods for high-risk processing
Enhanced Transparency
When processing children's data, privacy information must be presented in a clear and age-appropriate manner. Organizations should:
- Use clear, plain language that children can understand
- Consider using visual aids, videos, or icons
- Ensure information is concise and accessible
- Make it easy for children to access and understand their rights
Privacy by Design for Children
Organizations should implement privacy by design with children in mind:
- Set privacy settings to the most protective by default
- Minimize data collection to what is necessary
- Avoid profiling or automated decision-making that could be harmful
- Consider the potential impact on children's rights and well-being
Special Category Data
Extra caution should be taken when processing special category data about children. Such processing should only occur when strictly necessary and with robust safeguards.
Marketing and Profiling
The GDPR explicitly states that children's data should not be used for marketing purposes or for creating personality or user profiles. Recital 38 emphasizes that children deserve specific protection as they may be less aware of risks and consequences.
Right to Erasure
Article 17(1)(f) specifically provides that children have the right to have data erased that was collected when they were a child, recognizing that children may not fully appreciate the risks when initially providing consent.