Article 8 GDPR: Processing Children's Data Online

· Updated on · By Bertrand BucelleBertrand Bucelle · 1 min read

Article 8 GDPR: Processing Children's Data Online

In brief

  • Article 8 of the GDPR governs the processing of minors' personal data for online services.
  • The consent of a parent or legal guardian is required for children below a certain age.
  • Data controllers must implement reasonable checks on age and consent.

What Article 8 of the GDPR provides for children's data online

Article 8 of the GDPR applies specifically to information society services offered directly to children. When processing is based on consent, it is only lawful if the child has reached the age set by national law, which may vary between 13 and 16 years depending on the Member State. In France, this age is set at 15. Below this threshold, consent must be given or authorised by the holder of parental responsibility. The data controller must also make reasonable efforts to verify that this parental consent has indeed been obtained, taking into account available technologies. This obligation involves designing appropriate registration processes, using clear and understandable language for minors, and documenting the verification mechanisms implemented.

Best practices and how Data Comply One supports you

Protecting minors' data requires a rigorous approach from the design stage of digital services, in accordance with the privacy by design principle set out in the GDPR. It is recommended to precisely map the processing activities likely to involve minors, to adapt information notices to their level of understanding, and to formalise procedures for collecting parental consent.

  • Identify processing activities targeting or potentially affecting children in your record of processing activities.
  • Document the age verification and parental consent mechanisms you have put in place.
  • Train your teams on the legal specificities relating to minors' data.

Data Comply One centralises the management of your GDPR obligations, facilitates the maintenance of your record, and guides you in bringing your sensitive processing activities into compliance, including those involving minor audiences.