Data Protection Monitor · Cross-Jurisdiction Domain Hub
Children & vulnerable groups
Jurisdiction Readings (167 markets)
10 Confirmed
92 Probable
65 Uncertain
| Jurisdiction | Region | Status | Regulatory Summary | Actions |
|---|---|---|---|---|
| African bloc (AFR) | Africa | Red | No continental-level age-of-consent, parental-consent, minor-profiling-ban, education-setting, or dependent-adult provision was found in the Malabo Convention, AU status list, or Roadmap reviewed in… | Profile →Brief |
| Alabama, USA (US-AL) | Americas | Amber | Alabama has the most active children's-privacy legislative track of any module reviewed: the App Store Accountability Act (HB 161) mandates age verification and verifiable parental consent for minors… | Profile →Brief |
| Alaska, USA (US-AK) | Americas | Red | Children's data privacy in Alaska is governed entirely by federal law: COPPA for children under 13 (enforced by the FTC and, per COPPA rulemaking comment records, jointly monitored by state AGs… | Profile →Brief |
| Alberta, Canada (CA-AB) | Americas | Amber | Alberta's age of majority is 18, but PIPA does not have a distinct statutory consent-age threshold or parental-consent mechanism separate from its general reasonable-person standard; children's… | Profile →Brief |
| Algeria (DZ) | Africa | Red | No Algeria-specific provisions on age of consent for data processing, parental-consent mechanisms, minor-profiling bans, education-setting-specific rules, or dependent-adult protections were… | Profile →Brief |
| Antigua and Barbuda (AG) | Caribbean | Red | No source located on age of digital consent, parental-consent mechanisms, minor-profiling bans, education-settings rules, or dependent-adult protections for Antigua and Barbuda. | Profile →Brief |
| Argentina (AR) | Americas | Amber | The current Act does not refer to children at all; AAIP's Resolución 4/2019 fills part of the gap by requiring consent for processing children's data. Pending reform bills would specifically regulate… | Profile →Brief |
| Arizona, USA (US-AZ) | Americas | Amber | Arizona has no in-force comprehensive minors'-data statute. Multiple 2026-session bills address minors' online safety and social-media data practices (HB 2861, HB 2858, HB 2920 covering age… | Profile →Brief |
| Arkansas, USA (US-AR) | Americas | Amber | Arkansas has an active legislative program on minors' data: Act 612 (Protection of Minors from Distribution of Harmful Material Act) mandates age verification for adult-content websites; HB1717… | Profile →Brief |
| Asia-Pacific bloc (APAC) | Asia-Pacific | Red | No bloc-level age-of-consent, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adults protection exists under either the Global CBPR Forum or ASEAN Framework… | Profile →Brief |
| Australia (AU) | Asia-Pacific | Green | Australia has implemented one of the world's most prominent children's online protection regimes: the Social Media Minimum Age (SMMA) scheme (in force from 10 December 2025) prevents under-16s from… | Profile →Brief |
| Austria (AT) | Europe | Amber | GDPR Article 8 establishes the EU digital age-of-consent framework (default 16, Member States may lower to no less than 13); the precise national threshold adopted under the Austrian DSG could not be… | Profile →Brief |
| Bangladesh (BD) | Asia-Pacific | Red | No age-of-consent threshold, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adults protection could be confirmed for Bangladesh's data protection framework… | Profile →Brief |
| Belgium (BE) | Europe | Amber | Belgium derogates from the GDPR default by setting the age of digital consent at 13 (rather than 16), with corresponding parental-consent and age-appropriate-information requirements reflected in… | Profile →Brief |
| Belize (BZ) | Americas | Red | No sourced age-of-consent, parental-consent mechanism, minor-profiling ban, education-setting rule, or dependent-adult protection specific to Belize's data protection regime was located. | Profile →Brief |
| Brazil (BR) | Americas | Amber | The LGPD (Art. 14) requires specific/highlighted parental or guardian consent for children's data processing as the general rule, subject to exceptions (contacting parents, protection, one-time… | Profile →Brief |
| British Columbia, Canada (CA-BC) | Americas | Amber | PIPA contains no codified age-of-consent threshold or parental-consent mechanism analogous to COPPA or GDPR Art 8; consent validity for minors is instead assessed contextually via the 'meaningful… | Profile →Brief |
| Bulgaria (BG) | Europe | Red | CPDP conducts child-oriented digital-safety and right-of-access awareness activities, including materials for parents. The specific national age-of-consent threshold under GDPR Article 8 (whether… | Profile →Brief |
| Cambodia (KH) | Asia-Pacific | Red | No Cambodia-specific provisions on age of consent for data processing, parental-consent mechanisms, minor-profiling bans, education-setting-specific rules, or dependent-adult protections were… | Profile →Brief |
| Cameroon (CM) | Africa | Red | No confirmed age-of-consent threshold, parental-consent mechanism, minor-profiling ban, education-setting rule, or dependent-adult protection specific to Cameroon's data protection framework was… | Profile →Brief |
| Canada — Kahnawake (CA-KAH) | Americas | Red | PIPEDA contains no fixed statutory age of digital consent. OPC interpretive guidance states that children under 13 generally cannot provide valid consent and that services should seek parental… | Profile →Brief |
| Canada — Tobique First Nation (CA-TFN) | Americas | Amber | PIPEDA has no statutory age-of-consent provision; the OPC's own 'Guidelines for obtaining meaningful consent' set an interpretive threshold that, in all but exceptional circumstances, children under… | Profile →Brief |
| Chile (CL) | Americas | Amber | Ley 21.719 creates a differentiated regime for children's/adolescents' data and imposes a heightened breach-notification duty when a breach affects data of children under 14. A separate… | Profile →Brief |
| China (CN) | Asia-Pacific | Amber | PIPL treats the personal information of minors under 14 as sensitive personal information, requiring parental/guardian consent, building on the standalone 2019 Provisions on Cyber Protection of… | Profile →Brief |
| Colombia (CO) | Americas | Amber | Colombian law treats children's personal data as a special category jointly with sensitive data, requiring consideration of the child's superior interest during collection. No distinct statutory… | Profile →Brief |
| Colorado, USA (US-CO) | Americas | Green | SB 24-041, effective October 1, 2025, amended the CPA to prohibit processing minors' data for targeted advertising without consent, require reasonable care to avoid risks to minors, and mandate data… | Profile →Brief |
| Comoros (KM) | Africa | Red | No age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-sector rule, or dependent-adult protection was located for the Union of the Comoros. | Profile →Brief |
| Comoros — Anjouan (KM-A) | Africa | Red | No statutory age-of-digital-consent threshold, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adults protection could be identified for Comoros. | Profile →Brief |
| Comoros — Mohéli (KM-M) | Africa | Red | No statutory age-of-digital-consent, parental-consent mechanism, minor-profiling ban, education-setting DP rule, or dependent-adults protection exists in Comorian law. | Profile →Brief |
| Connecticut, USA (US-CT) | Americas | Amber | CTDPA layers state-specific minors' protections atop COPPA: opt-in consent is required before selling personal data or using it for targeted advertising for consumers under 16 (with an… | Profile →Brief |
| Costa Rica (CR) | Americas | Red | No child- or vulnerable-group-specific data protection provision (age of consent, parental-consent mechanism, minor-profiling ban, education-setting rule, or dependent-adult protection) could be… | Profile →Brief |
| Croatia (HR) | Europe | Amber | Croatia sets the digital age of consent at 16 with no lower national derogation, meaning information-society-service processing of a child's data is lawful once the child turns 16. The EOS Matrix… | Profile →Brief |
| Curaçao (CW) | Caribbean | Red | No Curaçao-specific age-of-consent, parental-consent mechanism, minor-profiling ban, education-setting rule, or dependent-adult protection was located in this research pass. | Profile →Brief |
| Cyprus (CY) | Europe | Amber | Cyprus sets the digital age of consent at 14 (below the GDPR default of 16), requiring parental/guardian consent for data activities involving users aged 14 and under. The Commissioner has publicly… | Profile →Brief |
| Czech Republic (CZ) | Europe | Green | Czech Republic's GDPR-implementing legislative process set the age of a child's own valid consent for information-society-service data processing at 15 years (rejecting a proposal to lower it to 13).… | Profile →Brief |
| Delaware, USA (US-DE) | Americas | Green | Delaware provides children and teens under 18 additional protections beyond adults, including opt-in consent for sale/targeted-advertising processing and parental/guardian exercise of consumer… | Profile →Brief |
| Denmark (DK) | Europe | Amber | Denmark's headline child-specific rule is the lowered digital age-of-consent (13). Denmark is additionally among the EU governments piloting the Commission's privacy-preserving age-verification… | Profile →Brief |
| District of Columbia, USA (US-DC) | Americas | Red | The District has no District-specific age-of-consent, parental-consent, minor-profiling-ban, education-setting, or dependent-adult data-protection statute. Federal COPPA (parental consent for… | Profile →Brief |
| Dominican Republic (DO) | Americas | Red | No age-of-consent threshold, parental-consent mechanism (COPPA/GDPR Art. 8 analogue), minor-profiling ban, education-setting-specific rule, or dependent-adult protection provision was identified for… | Profile →Brief |
| Ecuador (EC) | Americas | Amber | Article 8 of the EUDPR is the EUI-context analogue of GDPR Art 8, setting the age threshold for a child's own consent to information-society services at 13 (with parental-responsibility-holder… | Profile →Brief |
| Egypt (EG) | Africa | Amber | Minors' data is listed among PDPL sensitive/special categories, warranting heightened (licensed) treatment, but comparative legal analysis confirms the PDPL does not set an explicit age-of-consent… | Profile →Brief |
| Estonia (EE) | Europe | Amber | GDPR Art 8 sets an EU baseline: information-society-service consent is valid from age 16, but Member States may lower this to no less than 13. This research pass did not locate a primary-source… | Profile →Brief |
| European Economic Area Expert reviewed (EEA) | Europe | Amber | GDPR Article 8 establishes the default digital-consent age of 16 (Member States may lower to no less than 13); the EDPB is actively developing dedicated Guidelines on children's data as part of its… | Profile →Brief |
| Finland (FI) | Europe | Amber | GDPR Article 8 sets an EU-wide range (13-16) within which each Member State fixes the age at which a child may independently consent to information-society-service processing. Finland's specific… | Profile →Brief |
| Florida, USA (US-FL) | Americas | Green | Florida has two distinct children's-data tracks: (1) FDBR's sensitive-data/parental-authorization rule for a 'known child' (under 18); and (2) House Bill 3 (2024), a standalone… | Profile →Brief |
| France (FR) | Europe | Amber | France sets the digital age of consent at 15 (Article 45 LIL), requiring joint minor-plus-parent consent below that age. The SREN law and Arcom age-verification référentiel (subject to CNIL opinion)… | Profile →Brief |
| Georgia, USA (US-GA) | Americas | Amber | COPPA is the operative federal framework requiring verifiable parental consent for collecting personal information from children under 13 online, enforced by the FTC nationally including in Georgia.… | Profile →Brief |
| Germany (DE) | Europe | Amber | Germany fixes the GDPR Art 8 digital-consent age at 16; below that age, parental consent is required for information-society-service processing. This diverges from general German civil-law… | Profile →Brief |
| Ghana (GH) | Africa | Amber | The Act provides a general prohibition and treats children's data similarly to other sensitive data, but does not contain GDPR Article 8-style age-of-consent thresholds or explicit parental-consent… | Profile →Brief |
| Gibraltar Expert reviewed (GI) | Europe | Red | No Gibraltar-specific age-of-consent, parental-consent mechanism, minor-profiling ban, or dependent-adults provision was independently located in this pass, beyond the general education-sector… | Profile →Brief |
| Greece (GR) | Europe | Amber | Law 4624/2019 Article 21 fixes the digital consent age at 15, with parental consent required below that age. Enforcement precedent covers education-sector and disability-services mishandling of… | Profile →Brief |
| Guernsey (GG) | Europe | Red | No Guernsey-specific statutory age-of-digital-consent provision (GDPR Art 8 analogue), minor-self-exercise-of-rights age, age-assurance/children's-design-code instrument, minor-profiling prohibition… | Profile →Brief |
| Guernsey — Alderney (GG-ALD) | Europe | Red | No Guernsey/Alderney-specific statutory age of digital consent (the local equivalent of GDPR Art 8), minors'-own-exercise-of-rights age threshold, age-assurance/children's-design-code instrument, or… | Profile →Brief |
| Hawaii, USA (US-HI) | Americas | Amber | Federal COPPA governs parental consent for children under 13 nationally, including Hawaii. Hawaii House Bill 566, reported effective July 1, 2025, targets minors' protection from addictive content… | Profile →Brief |
| Hong Kong (HK) | Asia-Pacific | Red | PDPO makes passing reference to 'minors' but does not codify a specific age of consent, parental-consent mechanism, or minor-specific profiling ban comparable to GDPR Art.8. No… | Profile →Brief |
| Hungary (HU) | Europe | Amber | No domestic derogation from the GDPR's general consent-age rules was identified, though the specific Art 8 digital-minor-consent threshold for Hungary was not separately confirmed. An… | Profile →Brief |
| Iceland (IS) | Europe | Amber | Children's data receives heightened protection under Act No. 90/2018, evidenced by a consistent Persónuvernd enforcement pattern targeting education-sector processors (Seesaw, InfoMentor, Google… | Profile →Brief |
| Idaho, USA (US-ID) | Americas | Amber | Idaho relies on federal COPPA for online children's-privacy protection and on its 2014 student-data statute (SB 1372) for education-sector protections. Idaho's 2026 chatbot legislation is reported to… | Profile →Brief |
| Illinois, USA (US-IL) | Americas | Amber | Illinois has no independent state-level age-of-consent or parental-consent statute for general data processing (COPPA, the applicable federal parental-consent instrument, belongs to the US-federal… | Profile →Brief |
| India (IN) | Asia-Pacific | Amber | DPDPA defines a child as under 18 and mandates verifiable parental/guardian consent before processing a child's data, with the finalized Rules elaborating mechanisms including digital-locker-based… | Profile →Brief |
| Indiana, USA (US-IN) | Americas | Green | Two Indiana statutes jointly govern minors' data: the ICDPA (parental exercise of a known child's rights; COPPA-aligned sensitive-data consent) and Senate Bill 11 (2025), which imposes a… | Profile →Brief |
| Iowa, USA (US-IA) | Americas | Amber | Beyond the ICDPA's general treatment of 'personal data collected from a known child' as sensitive data (opt-out model), Iowa has pursued child-specific legislation (House File 712) reported to… | Profile →Brief |
| Ireland (IE) | Europe | Amber | Ireland set the GDPR Article 8 age of digital consent at 16 years -- the maximum permitted under the GDPR's 13-16 range -- and the DPC published dedicated child-oriented processing guidance… | Profile →Brief |
| Isle of Man (IM) | Europe | Red | No Isle of Man-specific instrument confirming the exact digital age-of-consent figure, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adults protection was… | Profile →Brief |
| Italy (IT) | Europe | Amber | The Italian digital age of consent is 14 (Codice Privacy Art.2-quinquies), below which parental/guardian consent is required for information-society services; below-14 consent is invalid absent… | Profile →Brief |
| Ivory Coast (CI) | Africa | Red | No CI-specific evidence was retrieved on age-of-consent thresholds, parental-consent mechanisms, minor-profiling bans, education-setting rules, or dependent-adult protections under Law No. 2013-450. | Profile →Brief |
| Japan (JP) | Asia-Pacific | Red | The APPI currently contains no statutory definition of a 'child' and no explicit children's-data provisions; PPC Q&A guidance informally treats individuals aged roughly 12-15 and under as children… | Profile →Brief |
| Jersey (JE) | Europe | Red | No Jersey-specific age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-setting rule, or dependent-adults protection was located in this research pass. | Profile →Brief |
| Kansas, USA (US-KS) | Americas | Amber | Children's data protection in Kansas derives entirely from the federal COPPA regime (parental consent for under-13 data collection) and FERPA/PPRA for education settings. Kansas has no state-level… | Profile →Brief |
| Kazakhstan (KZ) | Asia-Pacific | Red | No confirmed Kazakhstan-specific age-of-consent threshold, parental-consent mechanism, minor-profiling ban, education-setting rule, or dependent-adult protection was located in available sources. | Profile →Brief |
| Kentucky, USA (US-KY) | Americas | Amber | The KCDPA treats data from a known child under 13 as 'sensitive data' requiring consent, giving Kentucky a COPPA-aligned baseline. Beyond that, several bills targeting minors online (Kentucky Kids… | Profile →Brief |
| Kenya (KE) | Africa | Amber | Section 33 of the Act provides detailed requirements for processing children's data, though the Act itself does not define 'child'; Article 260 of the Constitution sets the age of adulthood at 18… | Profile →Brief |
| Laos (LA) | Asia-Pacific | Red | No age-of-consent threshold, parental-consent mechanism, minor-profiling ban, education-settings-specific rule, or dependent-adults protection specific to electronic/personal data processing was… | Profile →Brief |
| Latin America bloc (LATAM) | Americas | Amber | The 2026 RIPD Standards contain the bloc's strongest children-specific content: reinforced accountability, default protective settings, effective age verification, limits on profiling/behavioural… | Profile →Brief |
| Latvia (LV) | Europe | Amber | GDPR Article 8 sets a default age of 16 for a child's own consent to information-society-service processing, with member states permitted to lower this to a minimum of 13; this research could not… | Profile →Brief |
| Liechtenstein (LI) | Europe | Amber | Children's data processing follows GDPR Article 8 as incorporated via the EEA Agreement; the DSS has issued guidance on social-media age restrictions and flagged minors'/vulnerable individuals'… | Profile →Brief |
| Lithuania (LT) | Europe | Amber | GDPR Art. 8 sets a default digital-consent age of 16 with Member State discretion to lower to no less than 13; no confirmed Lithuanian national derogation was found in this research pass, so the GDPR… | Profile →Brief |
| Louisiana, USA (US-LA) | Americas | Amber | Louisiana has enacted minor-specific online-safety statutes requiring parental consent for social-media use, alongside Arkansas, Texas and Utah: <cite index="90-10">New laws in Arkansas, Louisiana… | Profile →Brief |
| Luxembourg (LU) | Europe | Amber | GDPR Article 8's default digital-consent age of 16 applies absent an identified LU derogation lowering it toward the permitted 13-16 range; no such derogation was located in this pass.… | Profile →Brief |
| Maine, USA (US-ME) | Americas | Amber | Children's online-data protection in Maine rests on the federal COPPA framework; Maine has no state-specific age-verification, parental-consent, or minor-profiling statute currently in force. The… | Profile →Brief |
| Malaysia (MY) | Asia-Pacific | Red | No Malaysia-specific age-of-consent, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adult protection was confirmed via Malaysia-specific retrieval in this… | Profile →Brief |
| Malta (MT) | Europe | Amber | Malta has lowered the digital age of consent to 13 under the Processing of Personal Data (Protection of Minors) Regulations, a GDPR Article 8 national derogation. The same Regulations carve out a… | Profile →Brief |
| Marshall Islands (MH) | Asia-Pacific | Red | No age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-settings data rule, or dependent-adults protection exists in RMI law. Searched for an RMI minors'-data… | Profile →Brief |
| Maryland, USA (US-MD) | Americas | Amber | Maryland protects minors' data through two instruments: MODPA's ban on targeted advertising/sale for consumers a controller knew or should have known are under 18, and the separate Maryland Kids Code… | Profile →Brief |
| Massachusetts, USA (US-MA) | Americas | Amber | Children's data protection touching Massachusetts is driven primarily by the federal COPPA framework and its FTC enforcement (including age-verification policy activity in 2026), plus a pending… | Profile →Brief |
| Mexico (MX) | Americas | Red | Detailed practitioner review of the enacted NLFPDPPP text confirms that the new law does not include specific provisions addressing the processing of personal data of minors, continuing a… | Profile →Brief |
| Michigan, USA (US-MI) | Americas | Amber | Federal COPPA governs children's data nationally, including Michigan, requiring verifiable parental consent. Michigan has two significant pending minor-protection bills: the Kids Code Act (SB 758… | Profile →Brief |
| Minnesota, USA (US-MN) | Americas | Green | The MCDPA requires parental/guardian consent before processing a 'known child's' personal data (with limited exceptions) and COPPA compliance, plus an opt-in consent requirement for targeted… | Profile →Brief |
| Mississippi, USA (US-MS) | Americas | Amber | Mississippi enacted the Mississippi Social Media Safety Act, which requires covered social-media platforms to verify users' ages and implement measures to reduce minors' exposure to harmful online… | Profile →Brief |
| Missouri, USA (US-MO) | Americas | Amber | Children's and student data in Missouri are governed almost entirely by federal law: COPPA requires parental consent before online operators collect personal information from children under 13, and… | Profile →Brief |
| Montana, USA (US-MT) | Americas | Amber | Rights under the MTCDPA may be invoked by a known child's parent or legal guardian on the child's behalf. Enhanced protections apply to consumers aged 13 to under 16 (consent required for targeted… | Profile →Brief |
| Morocco (MA) | Africa | Red | No statutory age-of-consent, parental-consent mechanism, or minor-profiling ban was found under Law 09-08. CNDP has, however, launched an awareness platform ('Koun3labal') targeting children… | Profile →Brief |
| Mozambique (MZ) | Africa | Red | No age-of-consent, parental-consent mechanism, minor-profiling ban, education-setting-specific rule, or dependent-adult protection has been identified in Mozambican law. | Profile →Brief |
| Myanmar (MM) | Asia-Pacific | Red | No age-of-consent, parental-consent mechanism, minor-profiling ban, education-settings-specific rule, or dependent-adults protection was identified for Myanmar in any reviewed source. | Profile →Brief |
| Nebraska, USA (US-NE) | Americas | Amber | Nebraska adopted an Age-Appropriate Online Design Code Act (signed May 30, 2025, becoming the third state after California and Maryland), effective January 1, 2026, with AG enforcement beginning July… | Profile →Brief |
| Nepal (NP) | Asia-Pacific | Red | No age-of-consent-for-processing rule, parental-consent mechanism, minor-profiling ban, education-settings-specific rule, or dependent-adult protection regime was located for Nepal. | Profile →Brief |
| Netherlands (NL) | Europe | Green | The Netherlands applies the GDPR default age of 16 for information-society-service consent (Article 8), requiring verifiable parental/guardian consent below that age, with controllers expected to… | Profile →Brief |
| Nevada, USA (US-NV) | Americas | Red | No Nevada-specific age-verification, parental-consent, minor-profiling-ban, education-settings, or dependent-adult data-protection statute was identified in this research pass. Protections for minors… | Profile →Brief |
| New Brunswick, Canada (CA-NB) | Americas | Red | The clearest evidenced development is the November 2025 joint resolution by the federal Privacy Commissioner and provincial/territorial counterparts (including New Brunswick's) on protecting… | Profile →Brief |
| New Hampshire, USA (US-NH) | Americas | Green | The NHDPA requires opt-in consent for processing personal data of a known child under 13 for sensitive-data purposes, and bars targeted advertising or sale of personal data for consumers aged 13 to… | Profile →Brief |
| New Jersey, USA (US-NJ) | Americas | Amber | Children under 13 are governed by the federal COPPA regime; New Jersey layers an additional opt-in consent requirement for processing personal data of consumers aged 13-16 when the controller knows… | Profile →Brief |
| New Mexico, USA (US-NM) | Americas | Amber | New Mexico has no state-level age-of-consent, parental-consent, minor-profiling-ban, or education-settings-specific data statute; federal COPPA supplies the operative parental-consent baseline for… | Profile →Brief |
| New Zealand (NZ) | Asia-Pacific | Red | New Zealand's Privacy Act does not contain a GDPR Art 8/COPPA-style parental-consent regime or a general age-of-consent threshold for data processing. Age 16 is used only as a narrower ground… | Profile →Brief |
| Nigeria (NG) | Africa | Amber | Section 31 of the NDPA addresses 'Children or persons lacking the legal capacity to consent,' establishing a distinct legal basis category for processing data of minors and incapacitated persons.… | Profile →Brief |
| North Carolina, USA (US-NC) | Americas | Amber | North Carolina relies on the federal Children's Online Privacy Protection Act (COPPA) for age-of-consent and parental-consent mechanics; no NC-specific age-verification, minor-profiling-ban… | Profile →Brief |
| North Dakota, USA (US-ND) | Americas | Amber | North Dakota relies on federal COPPA for parental-consent and age-of-consent protections for children's online data; no ND-specific age-verification, parental-consent, or minor-profiling-ban statute… | Profile →Brief |
| Norway (NO) | Europe | Amber | Norway participates in Nordic-level joint DPA principles on children's data in online gaming, and Datatilsynet enforcement has specifically flagged unlawful collection/sharing of children's personal… | Profile →Brief |
| Ohio, USA (US-OH) | Americas | Amber | Ohio relies on the federal Children's Online Privacy Protection Act (COPPA), enforced with attorney-general involvement, as its operative children's-data framework; no Ohio-specific age-verification… | Profile →Brief |
| Oklahoma, USA (US-OK) | Americas | Amber | The federal COPPA regime applies nationally including Oklahoma, requiring parental consent for collection of personal information from children under 13. SB 546 explicitly does NOT add enhanced… | Profile →Brief |
| Ontario, Canada (CA-ON) | Americas | Amber | Ontario's most direct statutory protection for a vulnerable group is Part X of the CYFSA, which gives children in the child-welfare system a right to reasonable privacy and possession of personal… | Profile →Brief |
| Oregon, USA (US-OR) | Americas | Amber | OCPA and its 2025 amendment (HB 2008) impose parental-consent requirements for under-13 processing and expanded sale/targeted-advertising/profiling bans for consumers under 16, effective January 1… | Profile →Brief |
| Pakistan (PK) | Asia-Pacific | Red | No enacted age-of-consent, parental-consent, minor-profiling-ban, education-setting, or dependent-adult data protection provision exists. The May 2023 draft Personal Data Protection Bill contains a… | Profile →Brief |
| Palau (PW) | Asia-Pacific | Red | No age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adults protection could be located for Palau under a dedicated DP… | Profile →Brief |
| Panama (PA) | Americas | Red | No age-of-consent, parental-consent mechanism, minor-profiling ban, education-settings-specific rule, or dependent-adults provision specific to Law 81 was located in the sources reviewed. | Profile →Brief |
| Pennsylvania, USA (US-PA) | Americas | Red | No enacted PA statute sets an age of consent for data processing, mandates parental consent for minors' data, bans minor profiling, imposes education-setting-specific data rules, or protects… | Profile →Brief |
| Peru (PE) | Americas | Green | Processing of minors' data generally requires parental/guardian (patria potestad/tutela) consent; minors between 14 and 18 years may consent directly provided information is given in comprehensible… | Profile →Brief |
| Philippines (PH) | Asia-Pacific | Amber | NPC Advisory Opinion No. 2024-03 (issued December 17, 2024) establishes child-oriented transparency guidelines, defining 'child' broadly and requiring age-appropriate privacy notices, Child Privacy… | Profile →Brief |
| Poland (PL) | Europe | Amber | Poland's Act of 10 May 2018 is described as containing no major derogations from the GDPR, and no Poland-specific lower age-of-consent provision under GDPR Article 8 was located in this research… | Profile →Brief |
| Portugal (PT) | Europe | Amber | The digital consent age is 13, with secure-authentication verification for parental consent below that age. A pending Bill (398/XVII/1) seeks to strengthen online protection of minors by setting age… | Profile →Brief |
| Qatar (QA) | Middle East | Red | Mainland Law No. 13 of 2016 requires operators of websites related to children to publish a policy on managing minors' information and to obtain parental consent before processing a child's data. No… | Profile →Brief |
| Quebec, Canada (CA-QC) | Americas | Amber | Quebec sets a parental-consent threshold at under-14 (differing from the federal PIPEDA/OPC-suggested under-13 benchmark), with a minor's-benefit exception, and CAI has advocated for stricter minors'… | Profile →Brief |
| Rhode Island, USA (US-RI) | Americas | Amber | RIDTPPA's children's-data protections are tied directly to COPPA's under-13 'child' definition, with no separate 13-16 teen protections (unlike Connecticut/CPRA). 'Enhanced children's privacy… | Profile →Brief |
| Romania (RO) | Europe | Amber | GDPR Article 8 sets the EU default digital age of consent at 16, with Member States permitted to lower it to no less than 13. This research pass did not locate a definitive, authoritative… | Profile →Brief |
| Russia (RU) | Europe | Red | No GDPR Article 8-style age-of-consent threshold, parental-consent mechanism, minor-profiling ban, education-setting-specific rule, or dependent-adult protection specific to personal-data processing… | Profile →Brief |
| Rwanda (RW) | Africa | Amber | The final Law N°058/2021 retains a dedicated 'Child's consent' provision (Article 10) within Chapter II. A specific age-of-consent threshold (18 years, with parental-responsibility-holder consent… | Profile →Brief |
| Saudi Arabia (SA) | Middle East | Red | The PDPL's data-subject definition extends to a representative or legal guardian, implying protection for minors and incapacitated persons, but no specific statutory age of consent, dedicated… | Profile →Brief |
| Senegal (SN) | Africa | Red | No minor-specific age-of-consent threshold, parental-consent mechanism, minor-profiling prohibition, education-setting-specific rule, or dependent-adult protection provision was identified in Law No.… | Profile →Brief |
| Serbia (RS) | Europe | Red | The LPDP assigns the Commissioner a statutory duty to promote public awareness of risks, rules, safeguards and rights in relation to processing, with particular reference to processing of data… | Profile →Brief |
| Seychelles (SC) | Africa | Red | No age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adults protection specific to the Seychelles Act was identified in this… | Profile →Brief |
| Singapore (SG) | Asia-Pacific | Amber | Protections for minors are guidance-based rather than statutory. <cite index="43-2">The PDPA does not define 'child' nor 'children'.</cite> <cite index="49-10">Unlike the GDPR, the PDPA does not… | Profile →Brief |
| Slovakia (SK) | Europe | Amber | GDPR Art. 8's digital-consent age threshold applies as the default in Slovakia. <cite index="56-27,56-28,56-29">Where GDPR Art. 6(1)(a) applies to an offer of information-society services directly to… | Profile →Brief |
| Slovenia (SI) | Europe | Amber | The 2025 school enforcement case confirms operative protection of minors' data in the education setting. The specific national age-of-consent threshold under GDPR Article 8 was not confirmed in this… | Profile →Brief |
| South Africa (ZA) | Africa | Amber | POPIA defines a child as anyone under 18 and requires valid consent from a 'competent person' (parent/guardian) for processing a child's personal information under Sections 34-35, subject to… | Profile →Brief |
| South Carolina, USA (US-SC) | Americas | Amber | South Carolina's most developed data-protection regime is minors-focused: H.3431 (effective Feb. 5, 2026, with an additional social-media age-verification duty from March 1, 2026) requires age… | Profile →Brief |
| South Dakota, USA (US-SD) | Americas | Red | South Dakota has not enacted a state-specific children's online privacy, age-verification, parental-consent, minor-profiling, education-settings, or dependent-adults data-protection statute. Federal… | Profile →Brief |
| South Korea (KR) | Asia-Pacific | Red | PIPA requires the consent of a guardian or legal representative to process children's personal information, paralleling GDPR Art 8, but the statute lacks provisions specifically targeted at… | Profile →Brief |
| Spain (ES) | Europe | Amber | LOPDGDD sets the digital age of consent at fourteen, among the lowest permitted under GDPR Art 8's 13-16 range. AEPD publishes extensive guidance on age verification/age-appropriate design… | Profile →Brief |
| Sri Lanka (LK) | Asia-Pacific | Red | No PDPA provision or Authority guidance addressing age of consent, parental-consent mechanisms, minor-profiling bans, education-setting-specific rules, or dependent-adult protections was located in… | Profile →Brief |
| Sweden (SE) | Europe | Amber | Sweden exercised the GDPR Art 8 Member State option to set the digital age of consent at 13, with parental/guardian consent required below that age. Children and young people are a named 2026 IMY… | Profile →Brief |
| Switzerland (CH) | Europe | Red | The revFADP's legislative history explicitly cites the protection of minors as one of the European-standard alignment goals of the revision. However, specific mechanisms — an age-of-consent threshold… | Profile →Brief |
| Taiwan (TW) | Asia-Pacific | Red | Unlike the GDPR, the PDPA does not address the processing of children's data or provide additional requirements for minors, and no parental-consent mechanism, minor-profiling ban… | Profile →Brief |
| Tanzania (TZ) | Africa | Red | No qualifying source was located covering age-of-consent thresholds, parental-consent mechanisms, minor-profiling bans, education-setting-specific rules, or dependent-adult protections under… | Profile →Brief |
| Tennessee, USA (US-TN) | Americas | Red | No Tennessee-specific age-verification, parental-consent mechanics, minor-profiling ban, education-setting rule, or dependent-adult protection was independently confirmed for TIPA in this research… | Profile →Brief |
| Texas, USA (US-TX) | Americas | Amber | Texas maintains overlapping minors-protection statutes: HB 1181 (age-verification for adult content, upheld by SCOTUS in Free Speech Coalition v. Paxton, June 27, 2025) with steep per-day/per-access… | Profile →Brief |
| Thailand (TH) | Asia-Pacific | Amber | Minors' consent capacity is governed by reference to Thai civil-law majority/sui-juris concepts rather than a fixed statutory age threshold as in GDPR Art.8: <cite index="31-1,31-2">unlike the GDPR … | Profile →Brief |
| Trinidad and Tobago (TT) | Caribbean | Red | The Data Protection Bill, 2024 defines 'child' by reference to the Children's Act but no explicit digital age-of-consent threshold, parental-consent mechanism, minor-profiling ban, education-settings… | Profile →Brief |
| Tunisia (TN) | Africa | Red | No age-of-consent, parental-consent mechanism, minor-profiling ban, education-setting-specific rule, or dependent-adults protection specific to Tunisia's data-protection framework was identified in… | Profile →Brief |
| Turkey (TR) | Europe | Red | Unlike the GDPR (Article 8), the LPPD does not grant special statutory protection to children's personal data, does not set an age of consent, and does not specify whether parental/guardian consent… | Profile →Brief |
| Uganda (UG) | Africa | Amber | Section 8 of the Act requires prior parental/guardian consent for processing a child's personal data, and Regulation 11 requires collectors/controllers/processors to establish an age-ascertainment… | Profile →Brief |
| Ukraine (UA) | Europe | Amber | Ukraine has no dedicated children's-online-privacy statute; the 2010 Law applies to minors on a general basis. Civil-capacity rules (under-18 = child; 14+ can enter minor contracts) determine when… | Profile →Brief |
| United Arab Emirates (AE) | Middle East | Red | Free-zone instruments provide limited, inconsistent coverage of children's data: ADGM defines a child as under 18 (versus GDPR's 16, adjustable to 13) but does not set explicit parental-consent… | Profile →Brief |
| United Kingdom Expert reviewed (UK) | Europe | Amber | The Children's code (Age Appropriate Design Code), a statutory code under DPA 2018 s.125 in force since 2 September 2020, sets 15 standards for online services likely accessed by children, including… | Profile →Brief |
| United States (US) | Americas | Amber | COPPA remains the anchor federal children's-privacy statute, applying to children under 13 and requiring verifiable parental consent; its 2025 amendments strengthen opt-in consent for third-party… | Profile →Brief |
| United States — California (US-CA) | Americas | Amber | California layers multiple children's-privacy statutes: the CCPA/CPRA's opt-in consent requirement for selling/sharing the personal information of consumers under 16 (with heightened penalties for… | Profile →Brief |
| United States — New York (US-NY) | Americas | Amber | New York has two dedicated children's-data statutes: the Child Data Protection Act (CDPA), restricting collection/use/sale of minors' (under-18) personal data absent consent, and the SAFE for Kids… | Profile →Brief |
| Uruguay (UY) | Americas | Red | No Uruguay-specific provisions on age of consent for data processing, parental-consent mechanisms, minor-profiling bans, education-settings-specific DP rules, or dependent-adult protections were… | Profile →Brief |
| Utah, USA (US-UT) | Americas | Amber | The UCPA aligns its under-13 parental-consent threshold with COPPA. Utah's more consequential minors' protections sit outside the UCPA in the Minor Protection in Social Media Act (SB 194/HB 464)… | Profile →Brief |
| Vanuatu (VU) | Asia-Pacific | Red | No Vanuatu-specific age-of-consent, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adult protection was located in available sources. Searches run: 'Vanuatu… | Profile →Brief |
| Venezuela (VE) | Americas | Red | The Ley Orgánica para la Protección de Niños, Niñas y Adolescentes (LOPNNA) governs child-welfare matters generally, including identity/registration rights, but contains no data-protection-specific… | Profile →Brief |
| Vermont, USA (US-VT) | Americas | Amber | Vermont's Age-Appropriate Design Code Act (S.69, signed 2025-06-12, effective 2027-01-01) governs minors' online experience via a 2%-of-users threshold rather than direct age verification; S.71… | Profile →Brief |
| Vietnam (VN) | Asia-Pacific | Red | Despite targeted searches, no PDPL/Decree 356 provisions specifying a minimum age of consent, a parental-consent mechanism, or minor-specific profiling bans were located in the secondary sources… | Profile →Brief |
| Virginia, USA (US-VA) | Americas | Amber | Virginia has rapidly expanded children's-data protections: known-child (<13) data is VCDPA sensitive data requiring consent; a 2026 amendment (effective January 1, 2026) requires social-media… | Profile →Brief |
| Washington State, USA (US-WA) | Americas | Red | No Washington state-specific statute establishing an age-of-consent threshold, parental-consent mechanism, minor-profiling ban, education-settings privacy rule, or dependent-adults protection was… | Profile →Brief |
| West Virginia, USA (US-WV) | Americas | Amber | Children's data protection in West Virginia is governed by the federal COPPA regime; the state itself has not enacted comprehensive minors'-privacy legislation, though a bill on online privacy… | Profile →Brief |
| Wisconsin, USA (US-WI) | Americas | Amber | Federal COPPA and FERPA provide the operative protections for children and students affecting Wisconsin, in the absence of any Wisconsin-specific enhancement. COPPA requires verifiable parental… | Profile →Brief |
| Wyoming, USA (US-WY) | Americas | Amber | Children's data protections in Wyoming derive entirely from federal law: COPPA's verifiable-parental-consent regime for online operators, and FERPA's parental-rights structure for education records.… | Profile →Brief |
| Zambia (ZM) | Africa | Red | No T1/T2 material on age-of-consent thresholds, parental-consent mechanisms, minor-profiling bans, education-setting rules, or dependent-adult protections under Zambia's Act was retrievable via… | Profile →Brief |