In short. GDPR Article 8 requires parental consent for consent-based processing in online services offered directly to children below the applicable national age threshold.
Definition: Under Article 8 of the General Data Protection Regulation (GDPR), a website needs consent given or authorised by a holder of parental responsibility when it offers an information society service directly to a child, relies on consent to process the child's personal data, and the child is below the applicable national consent age. The default age is 16; Member States may lower it to no less than 13.
Key facts
- As of 17 October 2026, the GDPR's Article 8(1) sets the default threshold at 16 and permits national thresholds down to 13.
- An information society service is a service normally provided for remuneration, remotely, electronically and at an individual's request, under Article 1(1)(b) of Directive (EU) 2015/1535.
- The European Data Protection Board (EDPB), in its consent guidelines, recommends proportionate verification; parental responsibility checks by email may suffice in low-risk cases.
Which website activities fall within Article 8?
A lawful basis is a legal ground for processing personal data. The GDPR's Article 6(1)(a) provides the consent basis: the person agrees to processing for one or more specific purposes. Article 8 expressly applies where that basis supports processing connected with an information society service offered directly to a child.
The service definition comes through GDPR Article 4(25). Under Directive (EU) 2015/1535, Article 1(1)(b), providing a service at a distance means the parties are not simultaneously present. An individual request means data is transmitted at the recipient's request.
The EDPB's consent guidelines explain that a service clearly offered only to people aged 18 or over falls outside Article 8 if other evidence, including its content or marketing plans, supports that restriction.
Which age threshold applies?
The GDPR's Article 8(1) allows a child aged at least 16 to give consent independently for this processing. Below the applicable threshold, consent must come from, or be authorised by, the holder of parental responsibility. A Member State may choose a lower threshold through national law, with 13 as the minimum.
The EDPB's consent guidelines say operators must consider the national laws relevant to their intended audience. A cross-border service may need to comply with laws in the Member States where it offers the service, depending on those laws' connecting factors.
What must the consent process establish?
A controller is the person or organisation that determines the purposes and means of processing personal data, under GDPR Article 4(7). The GDPR's Article 8(2) requires reasonable efforts to verify that consent comes from, or is authorised by, the holder of parental responsibility, taking available technology into account.
The EDPB's consent guidelines also expect reasonable age checks proportionate to the processing risks. They recommend limiting verification data; higher-risk processing may call for stronger proof of parental responsibility.
Under GDPR Article 7(1), the controller must be able to demonstrate consent. Article 12(1) requires clear, plain language, particularly for information addressed to a child. Article 7(3) gives a right to withdraw consent at any time and requires withdrawal to be as easy as giving consent.
Related terms
- GDPR lawful basis for web data
- GDPR data minimisation
- How must a website let visitors withdraw consent under GDPR Article 7?
FAQ
Does Article 8 require parental consent for every visitor under 18?
No. The GDPR's Article 8(1) concerns consent-based processing for information society services offered directly to children, with a default threshold of 16 and national reductions permitted down to 13.
Does this age also decide whether a child can enter a contract?
Article 8(3) preserves Member States' general contract law, including rules on a contract's validity, formation and effect in relation to a child.
What about online preventive or counselling services?
GDPR Recital 38 states that parental consent should not be necessary for preventive or counselling services offered directly to a child.
Sources
- EUR-Lex, "General Data Protection Regulation", 27 April 2016
- EUR-Lex, "Directive (EU) 2015/1535", 9 September 2015
- European Data Protection Board, "Guidelines 05/2020 on consent under Regulation 2016/679", 4 May 2020
Check how a page reads to answer engines. Open the GEO score analyzer