Children's data and parental consent under GDPR Article 8

Under Article 8 of the GDPR, a child can consent to an online service on their own from the age of 16, unless their country has set a lower age, which can go no lower than 13. Below that age, a parent or guardian has to give or authorise consent, and the service has to make reasonable efforts to check that they did. The age therefore depends on where your visitor lives: 13 in Sweden, 14 in Italy, 15 in France, 16 in Germany and Ireland. If your website or app collects data from people who might be under 16, this applies to you.

What Article 8 says

The provision is narrow but powerful. Where consent under Article 6(1)(a) is the legal basis for processing, and the processing relates to offering an information society service (ISS) directly to a child, the data subject must be at least 16 years old for their consent to be valid on its own. Below that age, consent must be given or authorised by the holder of parental responsibility.

EU member states may lower this threshold, but not below 13.

Article 8(2) of the GDPR adds a practical obligation: controllers must make reasonable efforts to verify that consent has genuinely been given or authorised by someone with parental responsibility, taking available technology into account. This is deliberately vague. The GDPR does not prescribe a specific verification method, which gives website operators flexibility but also creates uncertainty about what counts as "reasonable."

One often-missed carve-out appears in Recital 38: parental consent is not required for preventive or counselling services offered directly to a child. A mental health helpline chatbot aimed at teenagers, for instance, would not need to route through a parent first.

The digital age of consent by country

The 16-year default is only a starting point. Many EU member states have used their right to set a lower threshold, creating a patchwork of ages across Europe. If your website serves visitors from several countries, you need to know which threshold applies where.

The table lists the countries whose age was checked against the national law itself on 16 October 2026. Ireland is the one most often listed wrongly: section 31 of the Irish Data Protection Act 2018 sets 16, not 13. Countries not in the table were left out because their statute could not be opened, not because they follow the default.

This means a 14-year-old in Italy can consent to data processing by an online service on their own, while a 14-year-old in Germany cannot. For a website with EU-wide traffic, the safest approach is to either apply the strictest threshold (16) universally, or use geo-detection to apply the correct national threshold based on the visitor's location.

The UK keeps 13, but its rules are moving. Since 29 April 2026, the Children's Wellbeing and Schools Act 2026 lets the Secretary of State change the age in Article 8 of the UK GDPR by regulations, to anything between 13 and 16.

Kukie.io's geo-targeting identifies the country or region a visitor is in, so you can apply different consent rules per region. Working out a visitor's age is a separate step that your own sign-up or age assurance flow has to handle.

Which services count as an information society service

Article 8 only applies to information society services offered directly to a child. The definition of an ISS comes from EU Directive 2015/1535: any service normally provided for remuneration, at a distance, by electronic means, and at the individual request of a recipient. That covers most commercial websites, apps, games, social media platforms, streaming services, and online marketplaces.

"Remuneration" does not mean the child has to pay. Ad-supported services qualify because the economic activity exists, even if the user pays nothing. Free mobile games, social media platforms, and educational apps funded by advertising are all information society services.

What falls outside? Public authority websites providing information (a school's homepage, a library catalogue) typically do not qualify. Offline services are excluded by definition. And services not directed at children - even if some children happen to use them - occupy a grey area that regulators are still working through.

"Directed to a child" is a contested boundary

Article 8 applies when an ISS is offered "directly to a child." This phrase does more work than it might seem.

A children's game app with cartoon characters and bright colours is clearly directed at children. A professional accounting software tool is clearly not. Between those extremes sits a vast range of services - social media platforms, general-audience games, video sharing sites, messaging apps - where the answer is less obvious. The US Children's Online Privacy Protection Act (COPPA), a federal law enforced by the Federal Trade Commission (FTC), uses specific criteria to determine whether a service is "directed to children": subject matter, visual content, use of animated characters, the age of models, music, and similar factors. European law has no equivalent list, which leaves it to regulators and courts to fill the gap.

In the UK, the ICO took a broad stance with its Age Appropriate Design Code (also called the Children's Code), which applies to any service "likely to be accessed" by under-18s - a much wider net than "directed to." Under the UK GDPR framework, even services not aimed at children must comply if children are among their likely users. The Code's 15 standards include requirements for high privacy settings by default and restrictions on nudge techniques that encourage children to share more data. Since 5 February 2026, the Data (Use and Access) Act 2025 has also written children's higher protection needs into the UK GDPR's data protection by design duty for services likely to be used by children.

Age verification: what "reasonable efforts" look like

Article 8(2) requires controllers to make "reasonable efforts" to verify parental consent, but does not specify how. This has been one of the most debated aspects of the regulation since 2018.

The EDPB's 2020 Guidelines on Consent noted that verification measures should be "proportionate to the nature and risks of the processing activities." A low-risk newsletter sign-up might warrant less rigorous verification than a social media account that collects location data and enables public posting. In February 2025, the EDPB adopted Statement 1/2025 on age assurance, listing ten principles for the compliant processing of personal data when determining a user's age. The statement identifies three categories of age assurance: age estimation (inferring age from behavioural or physical signals), age verification (confirming age against an authoritative source), and self-declaration (the user states their own age).

Self-declaration alone - a date-of-birth field or a checkbox saying "I am over 16" - is widely considered insufficient for anything beyond the lowest-risk scenarios. The EDPB expressed serious doubts about TikTok's age gate during its 2023 investigation, noting that the platform's mechanism could be circumvented by anyone willing to enter a false birth date.

Practical verification methods range from light-touch to heavy:

• Email-based confirmation - asking a child to provide a parent's email address, then sending a verification link. Quick to build, but easy to fake.
• Credit card or payment verification - requiring a small transaction from a parent's payment method. Provides reasonable assurance but introduces friction.
• Government ID checks - scanning a passport or driving licence. High assurance, but raises data minimisation concerns (you collect far more data than needed to confirm age).
• Third-party age verification services - outsourcing to providers who confirm age without passing unnecessary personal data back to the service. The ICO's 2024 opinion on age assurance endorsed "waterfall techniques" that combine methods, such as a self-declaration step followed by AI-based behavioural analysis if the declared age appears inconsistent.
• AI-based age estimation - using facial analysis or behavioural signals to estimate whether a user falls above or below a threshold. Increasingly used but raises accuracy and bias questions.

If you put a date-of-birth question in front of content, the age gate itself processes personal data and has to sit alongside your cookie consent, not replace it.

The EDPB's 2025 statement emphasised that age assurance must not create new data protection risks. Collecting a passport scan to verify a 14-year-old's age creates a honeypot of sensitive identity documents. Controllers should delete data collected purely for verification once the check is complete, in line with the data minimisation principle under Article 5(1)(c).

Enforcement against children's data

Children's data has become one of the highest-priority enforcement areas for EU data protection authorities. The penalties handed down in recent years make the financial risk clear.

In September 2023, the Irish Data Protection Commission (DPC) fined TikTok EUR 345 million for GDPR violations related to its processing of children's data between July and December 2020. The investigation found that TikTok set accounts belonging to 13-17 year olds to public by default, enabled public commenting, and used design patterns that the EDPB described as unfair under Article 5(1)(a).

Meta's Instagram received a EUR 405 million fine from the DPC in September 2022 for similar issues - public-by-default account settings for children aged 13 to 17, and allowing children's contact information to be exposed through business account features.

Both decisions turned on default settings rather than on missing paperwork. Regulators are signalling that claiming ignorance about child users is not a defence.

Cookies, tracking and children's data

Cookie consent and children's data meet on any site that children visit. If your website sets analytics cookies like _ga or advertising cookies like _fbp, and children visit your site, those cookies process children's personal data. The same consent requirements apply - and arguably more stringent ones, given the GDPR's expectation of heightened protection for minors.

Under the ePrivacy Directive (Article 5(3)), storing cookies on a user's device requires prior informed consent regardless of the user's age, except for strictly necessary cookies. But where the user is a child, the quality of that consent faces additional scrutiny. Can a 12-year-old meaningfully understand a cookie banner explaining that their browsing behaviour will be shared with 47 advertising partners? Almost certainly not.

The UK's Age Appropriate Design Code is explicit: analytics, personalisation, and advertising features that go beyond the core service should be switched off by default for users under 18. The ICO considers data collection to "improve" or "personalise" a user's experience as beyond core service provision, meaning it requires separate consent - and for under-13s in the UK, that consent must come from a parent.

For website operators, this means your cookie consent setup cannot be one-size-fits-all if children are among your users. You need to consider whether your cookie banner is comprehensible to younger audiences, whether non-essential cookies are genuinely off by default, and whether you have a mechanism to identify and handle child users differently.

Practical steps for website operators

Article 8 is not a single checkbox exercise. It takes technical, legal and design measures working together.

Determine whether your service is likely accessed by children. If you operate a general-audience website and have no evidence that children use it, your obligations under Article 8 may be limited. But "no evidence" is not the same as "no children." If your analytics show users in age brackets that include minors, or if your service has features (games, social elements, educational content) that would appeal to younger users, assume Article 8 applies.

Conduct a Data Protection Impact Assessment. The EDPB's 2025 statement on age assurance specifically notes that age assurance processes are likely to present high risks to rights and freedoms, making a DPIA advisable in many cases. A DPIA should map what personal data you collect from children, through what mechanisms (including cookies), and what risks that processing poses.

Implement age-appropriate consent mechanisms. Your consent flow should use clear, plain language suitable for the youngest users likely to encounter it. Avoid legal jargon. Recital 58 of the GDPR asks that information addressed to a child be in language the child can understand. A cookie consent banner shown to a 13-year-old should not read the same as one shown to a 35-year-old IT professional.

Apply the correct age threshold based on the user's location. Use geo-detection to determine which national implementation of Article 8 applies. A visitor from France triggers the 15-year threshold. A visitor from Sweden triggers 13.

Choose proportionate age verification. Match your verification method to the risk level of your processing. A basic content site might reasonably rely on a self-declaration age gate. A service that profiles users, enables social interaction, or serves behavioural advertising needs stronger checks.

Default to privacy for child users. Non-essential cookies, tracking pixels, and third-party scripts should be off by default for anyone identified or reasonably suspected to be a child. This aligns with both Article 25 GDPR (data protection by design and by default) and the ICO's Children's Code.

Where the rules are heading

Several developments point toward stricter regulation of children's data across Europe.

The EU's Digital Services Act (DSA), fully applicable since February 2024, requires online platforms accessible to minors to ensure a high level of privacy, safety and security for them (Article 28). On 14 July 2025, the European Commission published guidelines under Article 28 that recommend age verification for adult content and where national law sets a minimum age for a service, and age estimation in other cases. The guidelines point to the EU Digital Identity Wallets and an age verification blueprint as the reference method. The EDPB's February 2025 statement on age assurance was explicitly positioned to support consistent enforcement across both the GDPR and the DSA.

France enacted its SREN law in May 2024, granting the ARCOM regulator authority to enforce age verification requirements for pornographic content and expanding enforcement powers to include administrative fines and site blocking. France's "digital majority" law of 2023 sought to restrict social media access for under-15s without parental approval, though implementation has stalled over conflicts with the EU's e-Commerce Directive.

On 26 November 2025, the European Parliament adopted a non-binding resolution on the protection of minors online that calls for an EU-wide digital minimum age of 16 for social media, with parental consent possible from 13 and no access below 13. As of October 2026, it is a political position, not law: the GDPR's Article 8 ages in the table above remain the rule.

Questions about Article 8 and children's consent

Keep non-essential cookies off until someone chooses

Kukie.io blocks analytics and marketing scripts until a visitor makes a choice, applies different consent rules by country or region, and records each choice in the Consent Log. It does not check a visitor's age, so pair it with an age assurance method that fits the risk of your service.

Start free