GDPR-K Article 22 / Recital 71 - Automated individual decision-making restrictions for children
Prohibit solely automated decision-making (including profiling) that produces legal or similarly significant effects on children, with no exceptions applying to children
Where this comes from
Provision: Article 22 / Recital 71 - Automated individual decision-making restrictions for children
Instrument: General Data Protection Regulation (EU) 2016/679
Citation: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, Article 22 and Recital 71
Text version: Regulation (EU) 2016/679 (GDPR), OJ L 119, 4.5.2016, consolidated
Who it applies to
It applies when all of these are true:
- Service is likely to be accessed by children under 18
- Service uses content personalization
…unless:
- Automated decisions permitted where necessary for contract performance between data subject and controller. (UK GDPR Article 22(2)(a))
- Automated decisions permitted where authorised by UK law with appropriate safeguards. (UK GDPR Article 22(2)(b))
- Automated decisions permitted with explicit consent. (UK GDPR Article 22(2)(c))
Scope in the source's own terms
- Service uses automated decision-making or profiling
- Decisions affect child users
- Processing subject to GDPR (EU scope; block moved from UK-GDPR authorship)
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- User model has `profilingEnabled` boolean field (default: false)
- Recommendation engine checks profilingEnabled before processing user
- Behavioral tracking skips users with profilingEnabled=false
- Ad targeting excludes users with profilingEnabled=false
- Admin dashboard shows count of users with profiling disabled
Evidence an auditor expects
- Technical controlTechnical audit
Human review mechanism
Technical implementation allowing human intervention in automated decisions affecting children
- Policy documentDocument review
Automated decision-making policy
Policy documenting automated decision logic, safeguards, and human oversight for decisions affecting children
- User-interface evidenceUser testing
Explanation and contest mechanism
Child-friendly interface explaining automated decisions and allowing them to contest or request human review
- Process recordLog analysis
Human review request log
Records of human review requests and outcomes
Questions people ask
- Does GDPR-K Article 22 / Recital 71 - Automated individual decision-making restric… apply to my service?
- It applies when Service is likely to be accessed by children under 18; Service uses content personalization. It does not apply where Automated decisions permitted where necessary for contract performance between data subject and controller. (UK GDPR Article 22(2)(a)).
- From when does this apply?
- GDPR-K Article 22 / Recital 71 - Automated individual decision-making restric… applies from 25 May 2018. Its current status is: in force.
- What evidence does an auditor expect?
- Human review mechanism; Automated decision-making policy; Explanation and contest mechanism.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.