EU GDPR Children's Provisions (Article 8)

Provide children and their parents/guardians with all required information about data collection, processing purposes, legal basis, recipients, and rights in a child-appropriate format

Articles 13 & 14 - Information to be provided when collecting children's data · Read the full page →

Facilitate the right to erasure of childhood data, especially when consent was given as a child and the data subject later wishes to remove it upon reaching adulthood

Article 17(1) / Recital 65 - Right to erasure of childhood data · Read the full page →

Prohibit solely automated decision-making (including profiling) that produces legal or similarly significant effects on children, with no exceptions applying to children

Article 22 / Recital 71 - Automated individual decision-making restrictions for children · Read the full page →

Embed data protection by design and by default into all services that process children's data, with enhanced safeguards reflecting the heightened risk to children

Article 25 - Data protection by design and by default for children's services · Read the full page →

Implement enhanced security measures for children's personal data, reflecting the heightened risk and vulnerability of child data subjects

Article 32 - Security of processing children's personal data · Read the full page →

Conduct a Data Protection Impact Assessment before processing children's data, as processing data of vulnerable persons (including children) is considered likely to result in high risk

Article 35 / Recital 75 - Data protection impact assessment for children's data · Read the full page →

Organisations processing children's personal data at scale should designate a Data Protection Officer to oversee children's data processing activities

GDPR Art. 37 — Data Protection Officer (children's data context) · Read the full page →

Encourage and support the development, adoption, and adherence to approved codes of conduct that specify how GDPR applies to children's data, including information provision and parental consent mechanisms

Article 40(2)(g) - Codes of conduct for children's data · Read the full page →

Apply a strict data minimisation standard to children's data, collecting and processing only what is strictly necessary for the specified purpose

Article 5(1)(c) - Data minimisation principle applied to children's data · Read the full page →

Implement strict storage limitation for children's data, retaining it only for as long as necessary and applying shorter retention periods than for adult data where appropriate

Article 5(1)(e) - Storage limitation for children's data · Read the full page →

Apply a heightened legitimate interests balancing test when processing children's data, recognising that children's rights and interests are more likely to override the controller's legitimate interests

Article 6(1)(f) / Recital 47 - Legitimate interests balancing test for children · Read the full page →

Obtain parental consent for children below the digital age of consent (default 16, Member States may lower to 13) when processing is based on consent for information society services

Article 8(1) - Conditions applicable to child's consent in relation to information society services · Read the full page →

Non-compliance with children's data protection provisions carries administrative fines up to EUR 20 million or 4% of total worldwide annual turnover, with violations concerning children likely attracting the higher end of penalties

Article 83(5) - Administrative fines for children's data violations · Read the full page →

Restrict the use of children's personal data for marketing purposes or for creating personality or user profiles

Recital 38 - Restriction on profiling and marketing to children · Read the full page →

Profiling measures with legal or similarly significant effects should not concern children; controllers should not engage in profiling activities that have significant effects on child data subjects

Recital 71 - Profiling restrictions specific to children · Read the full page →

Apply specific and enhanced protection to children's personal data, recognising that children are less aware of risks, consequences, and their rights regarding data processing

Recital 38 - Specific protection of children's personal data · Read the full page →

Provide all privacy information and communications in clear, plain language that children can easily understand, using age-appropriate formats

Article 12(1) / Recital 58 - Transparency for children · Read the full page →

Make reasonable efforts to verify that parental consent is genuinely given or authorised by the holder of parental responsibility, using available technology

Article 8(2) - Verification of parental consent · Read the full page →