When a site needs a CAPTCHA, an age check and a cookie banner, put them in that order: the bot check only where a form needs it, then the age gate, then the cookie banner for visitors who are old enough. Under GDPR Article 8, a child below the digital age of consent, which is 13 to 16 depending on the country, cannot consent to non-essential cookies alone. Until a parent authorises it, a declared minor gets the same result as a visitor who refused.
Most consent flows assume the visitor is an adult. That assumption breaks the moment a child lands on your site, and the order of the checks decides whether anything optional runs before you know who is there.
A child's click on the banner is not valid consent
Under GDPR Article 8, when an information society service is offered directly to a child, consent is only valid if the child has reached the digital age of consent, or if a parent or guardian has authorised the processing. The ePrivacy Directive adds a second layer: Article 5(3) requires consent before any non-essential cookie or tracker is placed on a device, regardless of the user's age. Together, these rules mean your cookie banner cannot collect a click from a 12-year-old and treat it as lawful consent.
The practical result is direct. If your audience includes minors, you need a way to identify their age range and adjust the consent flow accordingly.
GDPR Article 8 sets a digital age of consent
Article 8(1) of the GDPR states that processing a child's personal data on the basis of consent is lawful only where the child is at least 16 years old. Below that threshold, consent must be given or authorised by the holder of parental responsibility.
Member states may lower this age, but not below 13. The result is a patchwork of thresholds across Europe. Controllers operating across borders must respect the threshold of each country where they have users, not just the country where the business is based.
Article 8(2) adds a verification requirement: controllers must make reasonable efforts to verify that consent was given or authorised by a parent, taking available technology into account. The regulation does not prescribe a method, which gives organisations flexibility but also leaves room for regulatory scrutiny. The law itself, with the parental consent methods in detail, is covered in children's data, age verification and parental consent under the GDPR.
Age thresholds by country
The table below shows the digital age of consent set by selected EU and EEA member states, plus the United Kingdom. Where a country has not legislated a different threshold, the GDPR default of 16 applies. Ireland, for example, set 16 in section 31 of its Data Protection Act 2018, and Spain set 14 in Article 7 of its Organic Law 3/2018.
| Age threshold | Countries |
|---|---|
| 13 | Denmark, Latvia, Portugal, Sweden, United Kingdom |
| 14 | Austria, Bulgaria, Italy, Lithuania, Spain |
| 15 | Czech Republic, France, Greece, Slovenia |
| 16 (GDPR default) | Croatia, Germany, Hungary, Ireland, Luxembourg, Netherlands, Poland, Romania, Slovakia |
For websites serving visitors from several jurisdictions, the safest approach is to apply the strictest threshold relevant to your audience. A site with significant traffic from Germany and France, for example, would need to handle visitors under 16 as children in both cases, even though France sets its threshold at 15.
The order of the CAPTCHA, the age gate and the cookie banner
A CAPTCHA is a bot check, not an age check. Google's reCAPTCHA documentation says it sets a necessary cookie, _GRECAPTCHA, for its risk analysis, and that loading it from www.recaptcha.net avoids other Google cookies. That is Google's own classification. A bot check that protects the form a visitor is submitting is easier to defend as strictly necessary than one loaded on every page, and the data reCAPTCHA sends to Google still belongs in your privacy notice.
The age gate comes next. Its job is to decide whether the visitor can give cookie consent at all, so it has to run before the banner asks. Google treats legally required age verification screens and cookie banners alike: its guidance on intrusive interstitials exempts both, so a full-screen age check does not count against the page in search.
Bot check, age gate, then the cookie banner
Some sites also put a paywall behind the banner, asking visitors to pay or accept cookies. A child below the threshold cannot give that cookie consent either, so the age gate still comes first. The EDPB lists guidelines on "consent or pay" models in its 2026-2027 work programme, adopted in February 2026.
EDPB statement on age assurance (February 2025)
In February 2025, the European Data Protection Board adopted Statement 1/2025 on age assurance. The statement sets out ten principles that controllers should follow when determining a user's age or age range. Among them: data minimisation, proportionality, privacy by default and effectiveness.
The EDPB warns that age assurance mechanisms must not create new privacy risks. Collecting a full ID scan to verify age, for instance, could breach the data minimisation principle if a less intrusive method would achieve the same goal. The statement also confirms that any automated age determination must comply with GDPR Article 22 on automated decision-making.
As of October 2026, the EDPB is still drafting dedicated guidelines on children's data: they are listed in its 2026-2027 work programme.
Practical age-gating methods for cookie consent
There is no single mandated method for age-gating. The GDPR requires reasonable efforts, and what counts as reasonable depends on the risk to the child and the nature of the service. Below are the most common approaches, ranked roughly by verification strength.
Self-declaration (age gate screen)
The lightest approach asks visitors to enter their date of birth or confirm they are above a certain age before the cookie banner loads non-essential cookies. This method is low-friction but also low-assurance. A child can enter a false date without effort. Regulators have signalled that a bare checkbox is unlikely to satisfy the reasonable efforts standard for services directed at children.
Email-based parental verification
If a visitor declares they are under the applicable age threshold, the site can request a parent's email address and send a verification link. The parent clicks the link and authorises consent on behalf of the child. This is stronger than self-declaration alone, though it does not fully prevent a child from using a parent's email without permission.
Credit card or identity verification
A stronger method verifies a parent's identity through a credit card micro-transaction or an ID check. The US COPPA Rule (16 CFR Part 312) lists credit card verification among its accepted methods. Under the GDPR, this level of verification is more likely to be expected for high-risk services, such as those involving special category data or behavioural profiling of minors.
Third-party age estimation
Newer solutions use facial age estimation or document verification services. These can provide higher confidence but raise their own data protection by design questions. The EDPB's 2025 statement warns that such systems must comply with data minimisation and should not retain biometric data beyond what is strictly necessary for the age check.
Integrating age-gating with your cookie banner
The technical integration depends on when in the user journey you perform the age check. Two patterns dominate.
Pattern 1: age gate before the cookie banner. The visitor sees an age verification screen first. If they are above the threshold, the standard consent flow loads. If they are below, either no non-essential cookies are set at all, or a parental authorisation flow begins. This pattern is the cleanest because no tracking scripts fire until age and consent status are both confirmed.
Pattern 2: age question within the cookie banner. The cookie banner itself includes an age declaration step. If the visitor indicates they are under the threshold, the banner blocks all non-essential categories and displays a message explaining that parental consent is required. This is lighter to build but requires your script-blocking logic to handle the additional condition.
Whichever pattern you choose, the key technical requirement is the same: no marketing or analytics cookies may fire until valid consent, from an adult or an authorised parent, is confirmed. Your tag management setup should treat an underage declaration the same as a consent refusal until parental authorisation is received.
Children's consent rules outside the EU
The GDPR is not the only regulation with age-specific consent rules. If your site has a global audience, the privacy rules of other jurisdictions apply to their visitors too.
COPPA in the United States covers operators of sites or services directed to children under 13, or with actual knowledge that they collect personal information from a child under 13, wherever the operator is based. It requires verifiable parental consent before collecting personal information, including through cookies that enable behavioural advertising.
The UK Age Appropriate Design Code (Children's Code) applies to services likely to be accessed by children. It requires high privacy settings by default for child users and restricts profiling, nudge techniques and geolocation tracking. Under the UK GDPR, the digital age of consent is 13.
Brazil's LGPD requires specific and prominent consent from a parent or guardian for processing children's data (under 12), and the processing of adolescents' data (12 to 17) must be in their best interest.
Mistakes that undo an age gate
Treating the age gate as a one-time barrier is a frequent error. If a visitor clears cookies or uses a different browser, the age declaration is lost. Consider tying the age status to an authenticated session rather than a cookie alone, though this brings its own questions about account creation for minors.
Ignoring the age question because your site is not directed at children is another risk. The GDPR also applies on the basis of actual knowledge. If your consent records show a pattern of visitors declaring ages below the threshold, you cannot claim ignorance.
Applying a single threshold across all of Europe is simpler but may not satisfy regulators in countries with lower thresholds. A site that uses 16 as the universal cut-off will over-restrict in countries like Denmark (13) or Austria (14), but will not breach any national threshold. A site that uses 13 everywhere, however, treats 13 to 15-year-olds in Germany, Ireland, the Netherlands and Poland as able to consent when the law says they are not.
Questions about age checks and cookie consent
Does GDPR Article 8 apply to all cookies or only to personal data processing?
Article 8 applies specifically to consent for processing personal data in the context of information society services offered to children. The ePrivacy Directive's Article 5(3) separately governs the placement of cookies on devices, regardless of age. In practice, both rules apply: you need valid ePrivacy consent for non-essential cookies and valid GDPR consent for the personal data those cookies collect.
What age should I use for cookie consent if my website serves multiple EU countries?
Use the digital age of consent of each visitor's country where you can detect it. Where you cannot, 16 is the fallback that no national threshold sits above, at the cost of treating some visitors as children who could consent where they live.
Can a child under 16 consent to strictly necessary cookies?
Strictly necessary cookies do not require consent under the ePrivacy Directive. They may be set regardless of the visitor's age. Session cookies for login, shopping cart cookies and load-balancing cookies all fall into this category.
Does a CAPTCHA need cookie consent?
Google describes reCAPTCHA's _GRECAPTCHA cookie as necessary for its risk analysis. A bot check that protects the form a visitor is submitting is easier to defend as strictly necessary than one loaded on every page, and either way it runs before the age gate and the banner, not after them.
Is an age checkbox enough under GDPR Article 8?
Regulators have indicated that a bare checkbox or self-declaration is unlikely to meet the reasonable efforts standard for services directed at or likely to attract children. Stronger methods, such as email-based parental verification, are generally expected.
Do I need age-gating if my website is not aimed at children?
If your service is not directed at children and you have no actual knowledge that minors use it, Article 8 obligations are less likely to apply. But if analytics or user feedback reveal that children do visit your site, you should put appropriate safeguards in place.
How does COPPA differ from GDPR Article 8 for children's consent?
COPPA covers operators of sites or services directed to children under 13, or with actual knowledge that they collect from them, wherever the operator is based, and it lists accepted ways to verify parental consent. GDPR Article 8 lets member states set thresholds between 13 and 16 and requires reasonable efforts to verify parental consent without prescribing a method.
Set the consent model for each country you serve
Kukie.io does not check a visitor's age. Its geo-based consent rules set the consent model for each country or region you choose, the banner keeps non-essential categories blocked until a visitor accepts them, and the cc:consent-updated event tells your own age-gate code what was chosen.
