Managing Consent for Children

Overview

GDPR Article 8 establishes special rules for processing children's personal data in the context of information society services offered directly to a child. Where processing is based on consent under Article 6(1)(a), the controller must make reasonable efforts to verify that consent is given or authorized by the holder of parental responsibility over the child. Member States may set the age threshold between 13 and 16 years.

In the United States, the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. Section 6501-6506) requires verifiable parental consent before collecting personal information from children under 13.

Country-Specific Age Thresholds under GDPR Article 8(1)

Member States may provide by law for a lower age threshold, provided it is not below 13 years: