EU GDPR Children's Provisions (Article 8)

Provide children and their parents/guardians with all required information about data collection, processing purposes, legal basis, recipients, and rights in a child-appropriate format

Articles 13 and 14 - Information to be provided where personal data are collected from, or not obtained from, the data subject (read with Article 12(1) where the data subject is a child) · Read the full page →

Facilitate the right to erasure of childhood data, especially when consent was given as a child and the data subject later wishes to remove it upon reaching adulthood

Article 17 - Right to erasure ('right to be forgotten') (Article 17(1)(f): data collected in relation to the offer of information society services referred to in Article 8(1)) · Read the full page →

Solely automated decisions with legal or similarly significant effects are prohibited unless an Article 22(2) ground applies; where the ground is contract necessity or explicit consent, the Article 22(3) safeguards must be in place and effective for a child

Article 22 - Automated individual decision-making, including profiling (where the data subject is a child) · Read the full page →

Embed data protection by design and by default into all services that process children's data, with enhanced safeguards reflecting the heightened risk to children

Article 25 - Data protection by design and by default (applied where the processing reaches children) · Read the full page →

Implement enhanced security measures for children's personal data, reflecting the heightened risk and vulnerability of child data subjects

Article 32(1)-(2) - Security of processing (where the processing reaches children) · Read the full page →

Screen processing of children’s personal data for likely high risk and applicable supervisory-authority Article 35(4) lists. Carry out a DPIA before processing where required. Children’s vulnerability is a risk factor, not a universal rule that every processing operation requires a DPIA.

Article 35(1) and 35(3) - Data protection impact assessment (screening where processing reaches children) · Read the full page →

Assess whether designation of a DPO is mandatory: public authority/body processing (subject to the court exception); core activities involving large-scale regular and systematic monitoring; or core activities involving large-scale Article 9 special-category or Article 10 criminal-offence data. Children’s data alone is not a separate Article 37 trigger. Check additional Union or Member State requirements. Where mandatory, designate a DPO with the required expertise, independence and reporting access.

Article 37(1) - Designation of the data protection officer · Read the full page →

Encourage and support the development, adoption, and adherence to approved codes of conduct that specify how GDPR applies to children's data, including information provision and parental consent mechanisms

Articles 24(3), 32(3), 35(8) and 83(2)(j) read with Article 40(2)(g) - Approved codes of conduct addressing children's data · Read the full page →

Ensure children's personal data is adequate, relevant and limited to what is necessary for the purposes, applying the Article 5(1)(c) test carefully in the light of Recital 38

Article 5(1)(c) - Principles relating to processing of personal data (data minimisation, where the processing reaches children) · Read the full page →

Keep children's personal data for no longer than is necessary for the purposes; shorter periods and automated deletion are Landfall recommendations, not the Article's words

Article 5(1)(e) - Principles relating to processing of personal data (storage limitation, where the processing reaches children) · Read the full page →

Apply a heightened legitimate interests balancing test when processing children's data, recognising that children's rights and interests are more likely to override the controller's legitimate interests

Article 6(1)(f) - Lawfulness of processing (legitimate interests, where the data subject is a child) · Read the full page →

Obtain parental consent for children below the digital age of consent (default 16, Member States may lower to 13) when processing is based on consent for information society services

Article 8(1) - Conditions applicable to child's consent in relation to information society services (controller offering an information society service directly to a child on a consent basis) · Read the full page →

Article 8 and the Article 25, 32, 35 and 37 duties are in the EUR 10 million / 2% tier (Article 83(4)(a)); Articles 5, 6, 7, 9 and 12-22 are in the EUR 20 million / 4% tier (Article 83(5)); children are not a listed Article 83(2) factor

Article 83(4)-(5) - General conditions for imposing administrative fines (tiers applicable to the child-related provisions) · Read the full page →

Identify and record the lawful basis for any profiling or marketing use of a child's data, apply the child-weighted Article 6(1)(f) balancing test, and honour the Article 21(2) right to object; the GDPR prohibits neither, the DSA does for platforms

Articles 6(1)(f), 21(2)-(3) and 22 read with Recital 38 - Lawful basis and objection handling for profiling and marketing that reaches children · Read the full page →

Recital 71's 'such measure should not concern a child' is interpretive context for Article 22, not a prohibition on profiling children; the duty is carried by the Article 22 record

Recital 71 - Interpretive context for Article 22 where the data subject is a child · Read the full page →

Apply specific and enhanced protection to children's personal data, recognising that children are less aware of risks, consequences, and their rights regarding data processing

Articles 24(1) and 5(2) read with Recital 38 - Establishing specific protection for children's personal data (controller-level governance) · Read the full page →

Provide all privacy information and communications in clear, plain language that children can easily understand, using age-appropriate formats

Article 12(1) - Transparent information, communication and modalities for the exercise of the rights of the data subject (information addressed specifically to a child) · Read the full page →

Make reasonable efforts to verify that parental consent is genuinely given or authorised by the holder of parental responsibility, using available technology

Article 8(2) - Conditions applicable to child's consent in relation to information society services (verification of parental authorisation) · Read the full page →