1. Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.
Article 8 GDPR - Conditions applicable to child's consent in relation to information society services
Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.
2. The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology.
3. Paragraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child.
Relevant Recitals
Frequently Asked Questions
Short answers to common questions about this provision. They are general information and not legal advice.
It applies only where processing is based on consent under point (a) of Article 6(1) and relates to the offer of information society services, as defined in Article 4(25), directly to a child. Where the service is not offered directly to children, or the processing rests on another basis of Article 6(1), the ordinary rules apply without the age conditions of Article 8.
At 16 under the first subparagraph of paragraph 1, although Member States may provide by law for a lower age so long as it is not below 13. The result is a national patchwork between 13 and 16, so a controller offering services across several Member States must apply the threshold of each Member State whose law governs the child concerned.
Only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child, as paragraph 1 provides. The wording covers both consent given by the parent directly and parental authorisation of the child's own consent.
Paragraph 2 requires reasonable efforts to verify that consent is given or authorised by the holder of parental responsibility, taking into consideration available technology. The standard is one of proportionate diligence rather than absolute certainty, so the intensity of verification may be calibrated to the risks of the processing, consistent with the risk-based approach reflected in Articles 24 and 25.
No. Paragraph 3 provides that paragraph 1 does not affect the general contract law of Member States, such as the rules on the validity, formation or effect of a contract in relation to a child. The age conditions therefore govern only the data protection question of valid consent, while the enforceability of any underlying contract remains a matter of national law.