GDPR-K Article 8(1) - Conditions applicable to child's consent in relation to information society services
Obtain parental consent for children below the digital age of consent (default 16, Member States may lower to 13) when processing is based on consent for information society services
Where this comes from
Provision: Article 8(1) - Conditions applicable to child's consent in relation to information society services
Instrument: General Data Protection Regulation (EU) 2016/679
Citation: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, Article 8(1)
Text version: Regulation (EU) 2016/679 (GDPR), OJ L 119, 4.5.2016, consolidated
Who it applies to
Established age 13 rule with Article 8 scope — all of these:
- GDPR consent lawful basis: YES
- GDPR direct child information society service: YES
- Q_GDPR_GOVERNING_STATE is At, Be, Bg, Hr, Cy, Cz, Dk, Ee, Fi, Fr, De, Gr, Hu, Ie, It, Lv, Lt, Lu, Mt, Nl, Pl, Pt, Ro, Sk, Si, Es, Se, Is, Li or No
- GDPR established national consent age: AGE_13
- Q_GDPR_YOUNGEST_CONSENT_AGE is fewer than 13
Established age 14 rule with Article 8 scope — all of these:
- GDPR consent lawful basis: YES
- GDPR direct child information society service: YES
- Q_GDPR_GOVERNING_STATE is At, Be, Bg, Hr, Cy, Cz, Dk, Ee, Fi, Fr, De, Gr, Hu, Ie, It, Lv, Lt, Lu, Mt, Nl, Pl, Pt, Ro, Sk, Si, Es, Se, Is, Li or No
- GDPR established national consent age: AGE_14
- Q_GDPR_YOUNGEST_CONSENT_AGE is fewer than 14
Established age 15 rule with Article 8 scope — all of these:
- GDPR consent lawful basis: YES
- GDPR direct child information society service: YES
- Q_GDPR_GOVERNING_STATE is At, Be, Bg, Hr, Cy, Cz, Dk, Ee, Fi, Fr, De, Gr, Hu, Ie, It, Lv, Lt, Lu, Mt, Nl, Pl, Pt, Ro, Sk, Si, Es, Se, Is, Li or No
- GDPR established national consent age: AGE_15
- Q_GDPR_YOUNGEST_CONSENT_AGE is fewer than 15
Established age 16 rule with Article 8 scope — all of these:
- GDPR consent lawful basis: YES
- GDPR direct child information society service: YES
- Q_GDPR_GOVERNING_STATE is At, Be, Bg, Hr, Cy, Cz, Dk, Ee, Fi, Fr, De, Gr, Hu, Ie, It, Lv, Lt, Lu, Mt, Nl, Pl, Pt, Ro, Sk, Si, Es, Se, Is, Li or No
- GDPR established national consent age: AGE_16
- Q_GDPR_YOUNGEST_CONSENT_AGE is fewer than 16
Scope in the source's own terms
- Service processes children's data based on consent
- Information society service offered directly to a child
- Processing subject to EU GDPR
What engineering work it implies
- Parental Consent and ControlsCovers it fully
Implement verifiable parental consent for users under threshold age with ongoing parental controls.
Sample acceptance criteria Landfall generates for this obligation:
- Consent modal/page appears BEFORE data collection begins
- Consent options are granular (user can accept some, reject others)
- 'Reject All' is as prominent as 'Accept All'
- No pre-checked boxes - all start unchecked
- When relying on consent, store the necessary scoped consent reference, purposes and choices, timestamp and notice version; avoid collecting extra identity data solely for the record
Evidence an auditor expects
- Technical controlTechnical audit
Age gate implementation
Technical mechanism to determine if user is below consent age threshold
- Consent recordLog analysis
Parental consent records
Records of parental consent for children below threshold with verification method
- Policy documentDocument review
Child consent policy
Policy documenting consent age threshold and parental verification procedures
Questions people ask
- Does GDPR-K Article 8(1) - Conditions applicable to child's consent in relation to… apply to my service?
- It applies when GDPR consent lawful basis: YES; GDPR direct child information society service: YES; Q_GDPR_GOVERNING_STATE is At, Be, Bg, Hr, Cy, Cz, Dk, Ee, Fi, Fr, De, Gr, Hu, Ie, It, Lv, Lt, Lu, Mt, Nl, Pl, Pt, Ro, Sk, Si, Es, Se, Is, Li or No; GDPR established national consent age: AGE_13; Q_GDPR_YOUNGEST_CONSENT_AGE is fewer than 13; and GDPR consent lawful basis: YES; GDPR direct child information society service: YES; Q_GDPR_GOVERNING_STATE is At, Be, Bg, Hr, Cy, Cz, Dk, Ee, Fi, Fr, De, Gr, Hu, Ie, It, Lv, Lt, Lu, Mt, Nl, Pl, Pt, Ro, Sk, Si, Es, Se, Is, Li or No; GDPR established national consent age: AGE_14; Q_GDPR_YOUNGEST_CONSENT_AGE is fewer than 14; and GDPR consent lawful basis: YES; GDPR direct child information society service: YES; Q_GDPR_GOVERNING_STATE is At, Be, Bg, Hr, Cy, Cz, Dk, Ee, Fi, Fr, De, Gr, Hu, Ie, It, Lv, Lt, Lu, Mt, Nl, Pl, Pt, Ro, Sk, Si, Es, Se, Is, Li or No; GDPR established national consent age: AGE_15; Q_GDPR_YOUNGEST_CONSENT_AGE is fewer than 15; and GDPR consent lawful basis: YES; GDPR direct child information society service: YES; Q_GDPR_GOVERNING_STATE is At, Be, Bg, Hr, Cy, Cz, Dk, Ee, Fi, Fr, De, Gr, Hu, Ie, It, Lv, Lt, Lu, Mt, Nl, Pl, Pt, Ro, Sk, Si, Es, Se, Is, Li or No; GDPR established national consent age: AGE_16; Q_GDPR_YOUNGEST_CONSENT_AGE is fewer than 16.
- From when does this apply?
- GDPR-K Article 8(1) - Conditions applicable to child's consent in relation to… applies from 25 May 2018. Its current status is: in force.
- What evidence does an auditor expect?
- Age gate implementation; Parental consent records; Child consent policy.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.