GDPR — Children's Consent Requirements
GDPR — Children's Consent Requirements in European Union: active, effective May 25, 2018. Applies to All information society services offering services directly to children in the EU. Age range: Under 13-16 (varies by member state). Parental consent required for processing personal data of children
Key facts
| Jurisdiction | European Union |
|---|---|
| Category | International |
| Status | active |
| Effective date | May 25, 2018 |
| Age range | Under 13-16 (varies by member state) |
| Applies to | All information society services offering services directly to children in the EU |
Key requirements
- Parental consent required for processing personal data of children
- Member states set age threshold between 13 and 16
- Reasonable efforts to verify parental consent
- Clear, plain language privacy notices for children
- Right to erasure for data collected as a child
- Enhanced data protection impact assessments for child-directed services
Notes
Age thresholds by country: France (15), Germany (16), Spain (14, rising to 16 under pending law), Ireland (16), Netherlands (16), Denmark (13), Sweden (13), UK (13). Organizations must determine applicable age based on user location.
Frequently asked
What does GDPR — Children's Consent Requirements require?
Parental consent required for processing personal data of children Member states set age threshold between 13 and 16 Reasonable efforts to verify parental consent Clear, plain language privacy notices for children Right to erasure for data collected as a child Enhanced data protection impact assessments for child-directed services
Who must comply with GDPR — Children's Consent Requirements in European Union?
All information society services offering services directly to children in the EU
When does GDPR — Children's Consent Requirements take effect and what is its status?
Effective May 25, 2018. Current status: active. Age thresholds by country: France (15), Germany (16), Spain (14, rising to 16 under pending law), Ireland (16), Netherlands (16), Denmark (13), Sweden (13), UK (13). Organizations must determine applicable age based on user location.
Related laws
| Law | Jurisdiction | Category | Status | Effective |
|---|---|---|---|---|
| Social Media Minimum Age Law | Australia | International | active | December 10, 2025 |
| Online Safety Act — Age Verification Requirements | United Kingdom | International | active | July 25, 2025 |
| Online Safety Act — Child Safety Regime | United Kingdom | International | active | July 25, 2025 |
| Under-16 Social Media Ban (Children's Wellbeing and Schools Act 2026 regulations) | United Kingdom | International | pending | Spring 2027 (expected) |
| Digital Services Act — Guidelines on Protecting Minors | European Union | International | active | July 14, 2025 |
| EU Digital Minimum Age & Mandatory Age Assurance Initiative | European Union | International | pending | TBD (Commission proposal expected; Digital Fairness Act 2026) |
| Under-15 Social Media Ban (2026 Law) | France | International | blocked | N/A (struck down August 14, 2026) |
| Organic Law for the Protection of Minors in Digital Environments | Spain | International | pending | TBD (parliamentary approval expected autumn 2026) |
Put it into practice
- Generate the policy: GDPR policy generator (generatepolicy.com)
- Buy the policy pack: GDPR Complete Bundle (cyberpolicy.shop)
- Build it yourself: GDPR & DPIA Compliance Workbook (ciso.diy)