UK GDPR: Children's Consent (Article 8)
Children’s Consent [Art 8]
Rule: Special protections apply when processing children’s data based on consent. In the UK, parental consent is required for children under 13.
Key requirements:
| Requirement | Details | Citation |
|---|---|---|
| Age threshold | UK has set age at 13 (GDPR allows 13-16) | Art 8(1), DPA 2018 s9 |
| Parental consent | Under 13: must have parental/guardian consent | Art 8(1) |
| Verification | Must make reasonable efforts to verify parental consent | Art 8(2) |
| Information society services | Applies to online services offered directly to children | Art 8(1) |
Note: This applies specifically to consent as a lawful basis. Other lawful bases may apply for processing children’s data.
Source Text
- Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.
Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.
The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology.
Paragraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child.
UK Implementation
The Data Protection Act 2018 sets the UK age at 13:
Section 9: Child’s consent in relation to information society services
(1) This section applies where— (a) subsection (1) of Article 8 of the GDPR (conditions applicable to child’s consent in relation to information society services) would apply to the processing of personal data, and (b) the condition in point (a) of Article 6(1) of the GDPR (consent) is relied on as a basis for the processing.
(2) Subsection (1) of Article 8 of the GDPR has effect as if for “16 years” there were substituted “13 years”.
Citation
Article 8, UK GDPR | DPA 2018 Section 9