GDPR Q23
What is the age of digital consent?
Q23. What is the age of digital consent?
Category: Children
Children need extra protection online. In the UK, children under 13 usually need a parent or guardian’s consent for online services that rely on consent as the lawful basis.
In simple terms
- Use 13 as the standard age for digital consent in the UK.
- Verify parental responsibility when relying on consent for younger children.
- Design services with children’s best interests in mind.
Age thresholds
Article 8 allows Member States to set the age for consent between 13 and 16. The UK chose 13. For services aimed at children under 13, you must obtain verifiable parental consent if consent is your lawful basis.
- For services based on another lawful basis (e.g., contract with parents), parental consent may not be required.
- If you offer services across borders, check local age thresholds.
- Keep evidence of how age or parental responsibility was verified.
Child-friendly design
Provide privacy information that children can understand and avoid nudging them to share more than necessary.
- Follow the ICO’s Age Appropriate Design Code.
- Offer privacy settings that default to high protection.
- Give children and parents easy tools to exercise rights like erasure.
Practical steps to take
- Decide whether your service targets or is likely to attract children.
- Choose a lawful basis and confirm if parental consent is needed.
- Implement age verification or parental consent mechanisms where required.
- Produce child-friendly privacy notices and user journeys.
- Review designs regularly as children’s needs and regulations evolve.
Real-life examples
Educational app
An app aimed at primary school pupils collects minimal data and requires a parent to approve the account via email.
Teen social platform
A social network for 14- to 17-year-olds provides clear privacy guidance and strong default privacy settings.
Helpful reminders
- Do not rely on complicated terms to gain consent from children.
- Allow parents to withdraw consent easily when they no longer approve.
- Assess risks of profiling or automated decisions affecting children.
Key takeaway
Put children’s rights first—use age-appropriate language, parental controls, and privacy by default.
Article references
Further reading
Have we made a mistake, or an error or omission? Email support@akadata.ltd so we can correct it quickly.