| name | managing-consent-for-children |
| title | Managing Consent for Children |
| description | Guide for managing consent for children's personal data under GDPR Article 8 and COPPA. Covers parental consent mechanisms, age verification methods, country-specific age thresholds (ranging from 13 to 16), parental authorization workflows, and age-appropriate design per the UK ICO Children's Code. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/managing-consent-for-children |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | cross-jurisdiction |
| practice | data-protection |
| language | en |
Managing Consent for Children
Overview
GDPR Article 8 establishes special rules for processing children's personal data in the context of information society services offered directly to a child. Where processing is based on consent under Article 6(1)(a), the controller must make reasonable efforts to verify that consent is given or authorized by the holder of parental responsibility over the child. Member States may set the age threshold between 13 and 16 years.
In the United States, the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. Section 6501-6506) requires verifiable parental consent before collecting personal information from children under 13.
Country-Specific Age Thresholds under GDPR Article 8(1)
Member States may provide by law for a lower age threshold, provided it is not below 13 years:
| Country | Age Threshold | Legal Basis |
|---|
| Austria | 14 | Austrian Data Protection Act (DSG) Section 4(4) |
| Belgium | 13 | Law of 30 July 2018, Art. 7 |
| Croatia | 16 | GDPR default (no national derogation) |
| Czech Republic | 15 | Act No. 110/2019, Section 7 |
| Denmark | 13 | Danish Data Protection Act Section 12 |
| Estonia | 13 | Personal Data Protection Act Section 8 |
| Finland | 13 | Data Protection Act 1050/2018, Section 5 |
| France | 15 | Law No. 2018-493 (Loi Informatique et Libertés), Art. 45 |
| Germany | 16 | GDPR default (no national derogation) |
| Greece | 15 | Law 4624/2019, Art. 21 |
| Hungary | 16 | GDPR default (no national derogation) |
| Ireland | 16 | Data Protection Act 2018, Section 31 |
| Italy | 14 | Legislative Decree 101/2018, Art. 2-quinquies |
| Latvia | 13 | Personal Data Processing Law, Section 9 |
| Lithuania | 14 | Law on Legal Protection of Personal Data, Art. 5 |
| Luxembourg | 16 | GDPR default (no national derogation) |
