The previous Data Protection Directive that regulated the data protection principles and requirements in the EU did not distinguish the measures to be adopted between adults and children regarding the processing of personal data. However, as children increasingly started to access the internet, the regulator had to respond to this shift in the market. In that regard, the GDPR incorporated a separate article that regulates the processing of children’s personal data where children can provide valid consent on their behalf.
As per Article 8 of the GDPR, where consent is the most appropriate mechanism to process personal data, ‘in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old’. It is the responsibility of the controller to ‘make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology’.