--- title: "Children & vulnerable groups — Global Regulatory Comparison | Data Protection Monitor" canonical: https://dataprotection.gi/domains/children-and-vulnerable-groups/ source_html: /domains/children-and-vulnerable-groups/index.html description: "Cross-jurisdiction comparison of Children & vulnerable groups across 167 markets in Data Protection Monitor." generated_at: 2026-10-25T04:46:50Z content_sha256: 3ed007e2171f61d5fad6ab4baa5276b3004fd2a3cc6492703d8c316fe550bff7 generator: "fe-fleet/md-twin@1.0" --- # Children & vulnerable groups — Global Regulatory Comparison | Data Protection Monitor ## Jurisdiction Readings (167 markets) 10 Confirmed 92 Probable 65 Uncertain Jurisdiction Region Status Regulatory Summary Actions [African bloc](/jurisdictions/african-bloc/) (AFR) Africa Red No continental-level age-of-consent, parental-consent, minor-profiling-ban, education-setting, or dependent-adult provision was found in the Malabo Convention, AU status list, or Roadmap reviewed in… [Profile →](/jurisdictions/african-bloc/)[Brief](/reports/?t=entry&j=AFR) [Alabama, USA](/jurisdictions/alabama-usa/) (US-AL) Americas Amber Alabama has the most active children's-privacy legislative track of any module reviewed: the App Store Accountability Act (HB 161) mandates age verification and verifiable parental consent for minors… [Profile →](/jurisdictions/alabama-usa/)[Brief](/reports/?t=entry&j=US-AL) [Alaska, USA](/jurisdictions/alaska-usa/) (US-AK) Americas Red Children's data privacy in Alaska is governed entirely by federal law: COPPA for children under 13 (enforced by the FTC and, per COPPA rulemaking comment records, jointly monitored by state AGs… [Profile →](/jurisdictions/alaska-usa/)[Brief](/reports/?t=entry&j=US-AK) [Alberta, Canada](/jurisdictions/alberta-canada/) (CA-AB) Americas Amber Alberta's age of majority is 18, but PIPA does not have a distinct statutory consent-age threshold or parental-consent mechanism separate from its general reasonable-person standard; children's… [Profile →](/jurisdictions/alberta-canada/)[Brief](/reports/?t=entry&j=CA-AB) [Algeria](/jurisdictions/algeria/) (DZ) Africa Red No Algeria-specific provisions on age of consent for data processing, parental-consent mechanisms, minor-profiling bans, education-setting-specific rules, or dependent-adult protections were… [Profile →](/jurisdictions/algeria/)[Brief](/reports/?t=entry&j=DZ) [Antigua and Barbuda](/jurisdictions/antigua-and-barbuda/) (AG) Caribbean Red No source located on age of digital consent, parental-consent mechanisms, minor-profiling bans, education-settings rules, or dependent-adult protections for Antigua and Barbuda. [Profile →](/jurisdictions/antigua-and-barbuda/)[Brief](/reports/?t=entry&j=AG) [Argentina](/jurisdictions/argentina/) (AR) Americas Amber The current Act does not refer to children at all; AAIP's Resolución 4/2019 fills part of the gap by requiring consent for processing children's data. Pending reform bills would specifically regulate… [Profile →](/jurisdictions/argentina/)[Brief](/reports/?t=entry&j=AR) [Arizona, USA](/jurisdictions/arizona-usa/) (US-AZ) Americas Amber Arizona has no in-force comprehensive minors'-data statute. Multiple 2026-session bills address minors' online safety and social-media data practices (HB 2861, HB 2858, HB 2920 covering age… [Profile →](/jurisdictions/arizona-usa/)[Brief](/reports/?t=entry&j=US-AZ) [Arkansas, USA](/jurisdictions/arkansas-usa/) (US-AR) Americas Amber Arkansas has an active legislative program on minors' data: Act 612 (Protection of Minors from Distribution of Harmful Material Act) mandates age verification for adult-content websites; HB1717… [Profile →](/jurisdictions/arkansas-usa/)[Brief](/reports/?t=entry&j=US-AR) [Asia-Pacific bloc](/jurisdictions/asia-pacific-bloc/) (APAC) Asia-Pacific Red No bloc-level age-of-consent, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adults protection exists under either the Global CBPR Forum or ASEAN Framework… [Profile →](/jurisdictions/asia-pacific-bloc/)[Brief](/reports/?t=entry&j=APAC) [Australia](/jurisdictions/australia/) (AU) Asia-Pacific Green Australia has implemented one of the world's most prominent children's online protection regimes: the Social Media Minimum Age (SMMA) scheme (in force from 10 December 2025) prevents under-16s from… [Profile →](/jurisdictions/australia/)[Brief](/reports/?t=entry&j=AU) [Austria](/jurisdictions/austria/) (AT) Europe Amber GDPR Article 8 establishes the EU digital age-of-consent framework (default 16, Member States may lower to no less than 13); the precise national threshold adopted under the Austrian DSG could not be… [Profile →](/jurisdictions/austria/)[Brief](/reports/?t=entry&j=AT) [Bangladesh](/jurisdictions/bangladesh/) (BD) Asia-Pacific Red No age-of-consent threshold, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adults protection could be confirmed for Bangladesh's data protection framework… [Profile →](/jurisdictions/bangladesh/)[Brief](/reports/?t=entry&j=BD) [Belgium](/jurisdictions/belgium/) (BE) Europe Amber Belgium derogates from the GDPR default by setting the age of digital consent at 13 (rather than 16), with corresponding parental-consent and age-appropriate-information requirements reflected in… [Profile →](/jurisdictions/belgium/)[Brief](/reports/?t=entry&j=BE) [Belize](/jurisdictions/belize/) (BZ) Americas Red No sourced age-of-consent, parental-consent mechanism, minor-profiling ban, education-setting rule, or dependent-adult protection specific to Belize's data protection regime was located. [Profile →](/jurisdictions/belize/)[Brief](/reports/?t=entry&j=BZ) [Brazil](/jurisdictions/brazil/) (BR) Americas Amber The LGPD (Art. 14) requires specific/highlighted parental or guardian consent for children's data processing as the general rule, subject to exceptions (contacting parents, protection, one-time… [Profile →](/jurisdictions/brazil/)[Brief](/reports/?t=entry&j=BR) [British Columbia, Canada](/jurisdictions/british-columbia-canada/) (CA-BC) Americas Amber PIPA contains no codified age-of-consent threshold or parental-consent mechanism analogous to COPPA or GDPR Art 8; consent validity for minors is instead assessed contextually via the 'meaningful… [Profile →](/jurisdictions/british-columbia-canada/)[Brief](/reports/?t=entry&j=CA-BC) [Bulgaria](/jurisdictions/bulgaria/) (BG) Europe Red CPDP conducts child-oriented digital-safety and right-of-access awareness activities, including materials for parents. The specific national age-of-consent threshold under GDPR Article 8 (whether… [Profile →](/jurisdictions/bulgaria/)[Brief](/reports/?t=entry&j=BG) [Cambodia](/jurisdictions/cambodia/) (KH) Asia-Pacific Red No Cambodia-specific provisions on age of consent for data processing, parental-consent mechanisms, minor-profiling bans, education-setting-specific rules, or dependent-adult protections were… [Profile →](/jurisdictions/cambodia/)[Brief](/reports/?t=entry&j=KH) [Cameroon](/jurisdictions/cameroon/) (CM) Africa Red No confirmed age-of-consent threshold, parental-consent mechanism, minor-profiling ban, education-setting rule, or dependent-adult protection specific to Cameroon's data protection framework was… [Profile →](/jurisdictions/cameroon/)[Brief](/reports/?t=entry&j=CM) [Canada — Kahnawake](/jurisdictions/canada-kahnawake/) (CA-KAH) Americas Red PIPEDA contains no fixed statutory age of digital consent. OPC interpretive guidance states that children under 13 generally cannot provide valid consent and that services should seek parental… [Profile →](/jurisdictions/canada-kahnawake/)[Brief](/reports/?t=entry&j=CA-KAH) [Canada — Tobique First Nation](/jurisdictions/canada-tobique-first-nation/) (CA-TFN) Americas Amber PIPEDA has no statutory age-of-consent provision; the OPC's own 'Guidelines for obtaining meaningful consent' set an interpretive threshold that, in all but exceptional circumstances, children under… [Profile →](/jurisdictions/canada-tobique-first-nation/)[Brief](/reports/?t=entry&j=CA-TFN) [Chile](/jurisdictions/chile/) (CL) Americas Amber Ley 21.719 creates a differentiated regime for children's/adolescents' data and imposes a heightened breach-notification duty when a breach affects data of children under 14. A separate… [Profile →](/jurisdictions/chile/)[Brief](/reports/?t=entry&j=CL) [China](/jurisdictions/china/) (CN) Asia-Pacific Amber PIPL treats the personal information of minors under 14 as sensitive personal information, requiring parental/guardian consent, building on the standalone 2019 Provisions on Cyber Protection of… [Profile →](/jurisdictions/china/)[Brief](/reports/?t=entry&j=CN) [Colombia](/jurisdictions/colombia/) (CO) Americas Amber Colombian law treats children's personal data as a special category jointly with sensitive data, requiring consideration of the child's superior interest during collection. No distinct statutory… [Profile →](/jurisdictions/colombia/)[Brief](/reports/?t=entry&j=CO) [Colorado, USA](/jurisdictions/colorado-usa/) (US-CO) Americas Green SB 24-041, effective October 1, 2025, amended the CPA to prohibit processing minors' data for targeted advertising without consent, require reasonable care to avoid risks to minors, and mandate data… [Profile →](/jurisdictions/colorado-usa/)[Brief](/reports/?t=entry&j=US-CO) [Comoros](/jurisdictions/comoros/) (KM) Africa Red No age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-sector rule, or dependent-adult protection was located for the Union of the Comoros. [Profile →](/jurisdictions/comoros/)[Brief](/reports/?t=entry&j=KM) [Comoros — Anjouan](/jurisdictions/comoros-anjouan/) (KM-A) Africa Red No statutory age-of-digital-consent threshold, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adults protection could be identified for Comoros. [Profile →](/jurisdictions/comoros-anjouan/)[Brief](/reports/?t=entry&j=KM-A) [Comoros — Mohéli](/jurisdictions/comoros-moheli-mwali/) (KM-M) Africa Red No statutory age-of-digital-consent, parental-consent mechanism, minor-profiling ban, education-setting DP rule, or dependent-adults protection exists in Comorian law. [Profile →](/jurisdictions/comoros-moheli-mwali/)[Brief](/reports/?t=entry&j=KM-M) [Connecticut, USA](/jurisdictions/connecticut-usa/) (US-CT) Americas Amber CTDPA layers state-specific minors' protections atop COPPA: opt-in consent is required before selling personal data or using it for targeted advertising for consumers under 16 (with an… [Profile →](/jurisdictions/connecticut-usa/)[Brief](/reports/?t=entry&j=US-CT) [Costa Rica](/jurisdictions/costa-rica/) (CR) Americas Red No child- or vulnerable-group-specific data protection provision (age of consent, parental-consent mechanism, minor-profiling ban, education-setting rule, or dependent-adult protection) could be… [Profile →](/jurisdictions/costa-rica/)[Brief](/reports/?t=entry&j=CR) [Croatia](/jurisdictions/croatia/) (HR) Europe Amber Croatia sets the digital age of consent at 16 with no lower national derogation, meaning information-society-service processing of a child's data is lawful once the child turns 16. The EOS Matrix… [Profile →](/jurisdictions/croatia/)[Brief](/reports/?t=entry&j=HR) [Curaçao](/jurisdictions/curacao/) (CW) Caribbean Red No Curaçao-specific age-of-consent, parental-consent mechanism, minor-profiling ban, education-setting rule, or dependent-adult protection was located in this research pass. [Profile →](/jurisdictions/curacao/)[Brief](/reports/?t=entry&j=CW) [Cyprus](/jurisdictions/cyprus/) (CY) Europe Amber Cyprus sets the digital age of consent at 14 (below the GDPR default of 16), requiring parental/guardian consent for data activities involving users aged 14 and under. The Commissioner has publicly… [Profile →](/jurisdictions/cyprus/)[Brief](/reports/?t=entry&j=CY) [Czech Republic](/jurisdictions/czech-republic/) (CZ) Europe Green Czech Republic's GDPR-implementing legislative process set the age of a child's own valid consent for information-society-service data processing at 15 years (rejecting a proposal to lower it to 13).… [Profile →](/jurisdictions/czech-republic/)[Brief](/reports/?t=entry&j=CZ) [Delaware, USA](/jurisdictions/delaware-usa/) (US-DE) Americas Green Delaware provides children and teens under 18 additional protections beyond adults, including opt-in consent for sale/targeted-advertising processing and parental/guardian exercise of consumer… [Profile →](/jurisdictions/delaware-usa/)[Brief](/reports/?t=entry&j=US-DE) [Denmark](/jurisdictions/denmark/) (DK) Europe Amber Denmark's headline child-specific rule is the lowered digital age-of-consent (13). Denmark is additionally among the EU governments piloting the Commission's privacy-preserving age-verification… [Profile →](/jurisdictions/denmark/)[Brief](/reports/?t=entry&j=DK) [District of Columbia, USA](/jurisdictions/district-of-columbia-usa/) (US-DC) Americas Red The District has no District-specific age-of-consent, parental-consent, minor-profiling-ban, education-setting, or dependent-adult data-protection statute. Federal COPPA (parental consent for… [Profile →](/jurisdictions/district-of-columbia-usa/)[Brief](/reports/?t=entry&j=US-DC) [Dominican Republic](/jurisdictions/dominican-republic/) (DO) Americas Red No age-of-consent threshold, parental-consent mechanism (COPPA/GDPR Art. 8 analogue), minor-profiling ban, education-setting-specific rule, or dependent-adult protection provision was identified for… [Profile →](/jurisdictions/dominican-republic/)[Brief](/reports/?t=entry&j=DO) [Ecuador](/jurisdictions/ecuador/) (EC) Americas Amber Article 8 of the EUDPR is the EUI-context analogue of GDPR Art 8, setting the age threshold for a child's own consent to information-society services at 13 (with parental-responsibility-holder… [Profile →](/jurisdictions/ecuador/)[Brief](/reports/?t=entry&j=EC) [Egypt](/jurisdictions/egypt/) (EG) Africa Amber Minors' data is listed among PDPL sensitive/special categories, warranting heightened (licensed) treatment, but comparative legal analysis confirms the PDPL does not set an explicit age-of-consent… [Profile →](/jurisdictions/egypt/)[Brief](/reports/?t=entry&j=EG) [Estonia](/jurisdictions/estonia/) (EE) Europe Amber GDPR Art 8 sets an EU baseline: information-society-service consent is valid from age 16, but Member States may lower this to no less than 13. This research pass did not locate a primary-source… [Profile →](/jurisdictions/estonia/)[Brief](/reports/?t=entry&j=EE) [European Economic Area](/jurisdictions/european-economic-area-bloc/) Expert reviewed (EEA) Europe Amber GDPR Article 8 establishes the default digital-consent age of 16 (Member States may lower to no less than 13); the EDPB is actively developing dedicated Guidelines on children's data as part of its… [Profile →](/jurisdictions/european-economic-area-bloc/)[Brief](/reports/?t=entry&j=EEA) [Finland](/jurisdictions/finland/) (FI) Europe Amber GDPR Article 8 sets an EU-wide range (13-16) within which each Member State fixes the age at which a child may independently consent to information-society-service processing. Finland's specific… [Profile →](/jurisdictions/finland/)[Brief](/reports/?t=entry&j=FI) [Florida, USA](/jurisdictions/florida-usa/) (US-FL) Americas Green Florida has two distinct children's-data tracks: (1) FDBR's sensitive-data/parental-authorization rule for a 'known child' (under 18); and (2) House Bill 3 (2024), a standalone… [Profile →](/jurisdictions/florida-usa/)[Brief](/reports/?t=entry&j=US-FL) [France](/jurisdictions/france/) (FR) Europe Amber France sets the digital age of consent at 15 (Article 45 LIL), requiring joint minor-plus-parent consent below that age. The SREN law and Arcom age-verification référentiel (subject to CNIL opinion)… [Profile →](/jurisdictions/france/)[Brief](/reports/?t=entry&j=FR) [Georgia, USA](/jurisdictions/georgia-usa/) (US-GA) Americas Amber COPPA is the operative federal framework requiring verifiable parental consent for collecting personal information from children under 13 online, enforced by the FTC nationally including in Georgia.… [Profile →](/jurisdictions/georgia-usa/)[Brief](/reports/?t=entry&j=US-GA) [Germany](/jurisdictions/germany/) (DE) Europe Amber Germany fixes the GDPR Art 8 digital-consent age at 16; below that age, parental consent is required for information-society-service processing. This diverges from general German civil-law… [Profile →](/jurisdictions/germany/)[Brief](/reports/?t=entry&j=DE) [Ghana](/jurisdictions/ghana/) (GH) Africa Amber The Act provides a general prohibition and treats children's data similarly to other sensitive data, but does not contain GDPR Article 8-style age-of-consent thresholds or explicit parental-consent… [Profile →](/jurisdictions/ghana/)[Brief](/reports/?t=entry&j=GH) [Gibraltar](/jurisdictions/gibraltar/) Expert reviewed (GI) Europe Red No Gibraltar-specific age-of-consent, parental-consent mechanism, minor-profiling ban, or dependent-adults provision was independently located in this pass, beyond the general education-sector… [Profile →](/jurisdictions/gibraltar/)[Brief](/reports/?t=entry&j=GI) [Greece](/jurisdictions/greece/) (GR) Europe Amber Law 4624/2019 Article 21 fixes the digital consent age at 15, with parental consent required below that age. Enforcement precedent covers education-sector and disability-services mishandling of… [Profile →](/jurisdictions/greece/)[Brief](/reports/?t=entry&j=GR) [Guernsey](/jurisdictions/guernsey/) (GG) Europe Red No Guernsey-specific statutory age-of-digital-consent provision (GDPR Art 8 analogue), minor-self-exercise-of-rights age, age-assurance/children's-design-code instrument, minor-profiling prohibition… [Profile →](/jurisdictions/guernsey/)[Brief](/reports/?t=entry&j=GG) [Guernsey — Alderney](/jurisdictions/guernsey-alderney/) (GG-ALD) Europe Red No Guernsey/Alderney-specific statutory age of digital consent (the local equivalent of GDPR Art 8), minors'-own-exercise-of-rights age threshold, age-assurance/children's-design-code instrument, or… [Profile →](/jurisdictions/guernsey-alderney/)[Brief](/reports/?t=entry&j=GG-ALD) [Hawaii, USA](/jurisdictions/hawaii-usa/) (US-HI) Americas Amber Federal COPPA governs parental consent for children under 13 nationally, including Hawaii. Hawaii House Bill 566, reported effective July 1, 2025, targets minors' protection from addictive content… [Profile →](/jurisdictions/hawaii-usa/)[Brief](/reports/?t=entry&j=US-HI) [Hong Kong](/jurisdictions/hong-kong/) (HK) Asia-Pacific Red PDPO makes passing reference to 'minors' but does not codify a specific age of consent, parental-consent mechanism, or minor-specific profiling ban comparable to GDPR Art.8. No… [Profile →](/jurisdictions/hong-kong/)[Brief](/reports/?t=entry&j=HK) [Hungary](/jurisdictions/hungary/) (HU) Europe Amber No domestic derogation from the GDPR's general consent-age rules was identified, though the specific Art 8 digital-minor-consent threshold for Hungary was not separately confirmed. An… [Profile →](/jurisdictions/hungary/)[Brief](/reports/?t=entry&j=HU) [Iceland](/jurisdictions/iceland/) (IS) Europe Amber Children's data receives heightened protection under Act No. 90/2018, evidenced by a consistent Persónuvernd enforcement pattern targeting education-sector processors (Seesaw, InfoMentor, Google… [Profile →](/jurisdictions/iceland/)[Brief](/reports/?t=entry&j=IS) [Idaho, USA](/jurisdictions/idaho-usa/) (US-ID) Americas Amber Idaho relies on federal COPPA for online children's-privacy protection and on its 2014 student-data statute (SB 1372) for education-sector protections. Idaho's 2026 chatbot legislation is reported to… [Profile →](/jurisdictions/idaho-usa/)[Brief](/reports/?t=entry&j=US-ID) [Illinois, USA](/jurisdictions/illinois-usa/) (US-IL) Americas Amber Illinois has no independent state-level age-of-consent or parental-consent statute for general data processing (COPPA, the applicable federal parental-consent instrument, belongs to the US-federal… [Profile →](/jurisdictions/illinois-usa/)[Brief](/reports/?t=entry&j=US-IL) [India](/jurisdictions/india/) (IN) Asia-Pacific Amber DPDPA defines a child as under 18 and mandates verifiable parental/guardian consent before processing a child's data, with the finalized Rules elaborating mechanisms including digital-locker-based… [Profile →](/jurisdictions/india/)[Brief](/reports/?t=entry&j=IN) [Indiana, USA](/jurisdictions/indiana-usa/) (US-IN) Americas Green Two Indiana statutes jointly govern minors' data: the ICDPA (parental exercise of a known child's rights; COPPA-aligned sensitive-data consent) and Senate Bill 11 (2025), which imposes a… [Profile →](/jurisdictions/indiana-usa/)[Brief](/reports/?t=entry&j=US-IN) [Iowa, USA](/jurisdictions/iowa-usa/) (US-IA) Americas Amber Beyond the ICDPA's general treatment of 'personal data collected from a known child' as sensitive data (opt-out model), Iowa has pursued child-specific legislation (House File 712) reported to… [Profile →](/jurisdictions/iowa-usa/)[Brief](/reports/?t=entry&j=US-IA) [Ireland](/jurisdictions/ireland/) (IE) Europe Amber Ireland set the GDPR Article 8 age of digital consent at 16 years -- the maximum permitted under the GDPR's 13-16 range -- and the DPC published dedicated child-oriented processing guidance… [Profile →](/jurisdictions/ireland/)[Brief](/reports/?t=entry&j=IE) [Isle of Man](/jurisdictions/isle-of-man/) (IM) Europe Red No Isle of Man-specific instrument confirming the exact digital age-of-consent figure, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adults protection was… [Profile →](/jurisdictions/isle-of-man/)[Brief](/reports/?t=entry&j=IM) [Italy](/jurisdictions/italy/) (IT) Europe Amber The Italian digital age of consent is 14 (Codice Privacy Art.2-quinquies), below which parental/guardian consent is required for information-society services; below-14 consent is invalid absent… [Profile →](/jurisdictions/italy/)[Brief](/reports/?t=entry&j=IT) [Ivory Coast](/jurisdictions/ivory-coast-uemoa-bloc/) (CI) Africa Red No CI-specific evidence was retrieved on age-of-consent thresholds, parental-consent mechanisms, minor-profiling bans, education-setting rules, or dependent-adult protections under Law No. 2013-450. [Profile →](/jurisdictions/ivory-coast-uemoa-bloc/)[Brief](/reports/?t=entry&j=CI) [Japan](/jurisdictions/japan/) (JP) Asia-Pacific Red The APPI currently contains no statutory definition of a 'child' and no explicit children's-data provisions; PPC Q&A guidance informally treats individuals aged roughly 12-15 and under as children… [Profile →](/jurisdictions/japan/)[Brief](/reports/?t=entry&j=JP) [Jersey](/jurisdictions/jersey/) (JE) Europe Red No Jersey-specific age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-setting rule, or dependent-adults protection was located in this research pass. [Profile →](/jurisdictions/jersey/)[Brief](/reports/?t=entry&j=JE) [Kansas, USA](/jurisdictions/kansas-usa/) (US-KS) Americas Amber Children's data protection in Kansas derives entirely from the federal COPPA regime (parental consent for under-13 data collection) and FERPA/PPRA for education settings. Kansas has no state-level… [Profile →](/jurisdictions/kansas-usa/)[Brief](/reports/?t=entry&j=US-KS) [Kazakhstan](/jurisdictions/kazakhstan/) (KZ) Asia-Pacific Red No confirmed Kazakhstan-specific age-of-consent threshold, parental-consent mechanism, minor-profiling ban, education-setting rule, or dependent-adult protection was located in available sources. [Profile →](/jurisdictions/kazakhstan/)[Brief](/reports/?t=entry&j=KZ) [Kentucky, USA](/jurisdictions/kentucky-usa/) (US-KY) Americas Amber The KCDPA treats data from a known child under 13 as 'sensitive data' requiring consent, giving Kentucky a COPPA-aligned baseline. Beyond that, several bills targeting minors online (Kentucky Kids… [Profile →](/jurisdictions/kentucky-usa/)[Brief](/reports/?t=entry&j=US-KY) [Kenya](/jurisdictions/kenya/) (KE) Africa Amber Section 33 of the Act provides detailed requirements for processing children's data, though the Act itself does not define 'child'; Article 260 of the Constitution sets the age of adulthood at 18… [Profile →](/jurisdictions/kenya/)[Brief](/reports/?t=entry&j=KE) [Laos](/jurisdictions/laos/) (LA) Asia-Pacific Red No age-of-consent threshold, parental-consent mechanism, minor-profiling ban, education-settings-specific rule, or dependent-adults protection specific to electronic/personal data processing was… [Profile →](/jurisdictions/laos/)[Brief](/reports/?t=entry&j=LA) [Latin America bloc](/jurisdictions/latin-america-bloc/) (LATAM) Americas Amber The 2026 RIPD Standards contain the bloc's strongest children-specific content: reinforced accountability, default protective settings, effective age verification, limits on profiling/behavioural… [Profile →](/jurisdictions/latin-america-bloc/)[Brief](/reports/?t=entry&j=LATAM) [Latvia](/jurisdictions/latvia/) (LV) Europe Amber GDPR Article 8 sets a default age of 16 for a child's own consent to information-society-service processing, with member states permitted to lower this to a minimum of 13; this research could not… [Profile →](/jurisdictions/latvia/)[Brief](/reports/?t=entry&j=LV) [Liechtenstein](/jurisdictions/liechtenstein/) (LI) Europe Amber Children's data processing follows GDPR Article 8 as incorporated via the EEA Agreement; the DSS has issued guidance on social-media age restrictions and flagged minors'/vulnerable individuals'… [Profile →](/jurisdictions/liechtenstein/)[Brief](/reports/?t=entry&j=LI) [Lithuania](/jurisdictions/lithuania/) (LT) Europe Amber GDPR Art. 8 sets a default digital-consent age of 16 with Member State discretion to lower to no less than 13; no confirmed Lithuanian national derogation was found in this research pass, so the GDPR… [Profile →](/jurisdictions/lithuania/)[Brief](/reports/?t=entry&j=LT) [Louisiana, USA](/jurisdictions/louisiana-usa/) (US-LA) Americas Amber Louisiana has enacted minor-specific online-safety statutes requiring parental consent for social-media use, alongside Arkansas, Texas and Utah: New laws in Arkansas, Louisiana… [Profile →](/jurisdictions/louisiana-usa/)[Brief](/reports/?t=entry&j=US-LA) [Luxembourg](/jurisdictions/luxembourg/) (LU) Europe Amber GDPR Article 8's default digital-consent age of 16 applies absent an identified LU derogation lowering it toward the permitted 13-16 range; no such derogation was located in this pass.… [Profile →](/jurisdictions/luxembourg/)[Brief](/reports/?t=entry&j=LU) [Maine, USA](/jurisdictions/maine-usa/) (US-ME) Americas Amber Children's online-data protection in Maine rests on the federal COPPA framework; Maine has no state-specific age-verification, parental-consent, or minor-profiling statute currently in force. The… [Profile →](/jurisdictions/maine-usa/)[Brief](/reports/?t=entry&j=US-ME) [Malaysia](/jurisdictions/malaysia/) (MY) Asia-Pacific Red No Malaysia-specific age-of-consent, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adult protection was confirmed via Malaysia-specific retrieval in this… [Profile →](/jurisdictions/malaysia/)[Brief](/reports/?t=entry&j=MY) [Malta](/jurisdictions/malta/) (MT) Europe Amber Malta has lowered the digital age of consent to 13 under the Processing of Personal Data (Protection of Minors) Regulations, a GDPR Article 8 national derogation. The same Regulations carve out a… [Profile →](/jurisdictions/malta/)[Brief](/reports/?t=entry&j=MT) [Marshall Islands](/jurisdictions/marshall-islands/) (MH) Asia-Pacific Red No age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-settings data rule, or dependent-adults protection exists in RMI law. Searched for an RMI minors'-data… [Profile →](/jurisdictions/marshall-islands/)[Brief](/reports/?t=entry&j=MH) [Maryland, USA](/jurisdictions/maryland-usa/) (US-MD) Americas Amber Maryland protects minors' data through two instruments: MODPA's ban on targeted advertising/sale for consumers a controller knew or should have known are under 18, and the separate Maryland Kids Code… [Profile →](/jurisdictions/maryland-usa/)[Brief](/reports/?t=entry&j=US-MD) [Massachusetts, USA](/jurisdictions/massachusetts-usa/) (US-MA) Americas Amber Children's data protection touching Massachusetts is driven primarily by the federal COPPA framework and its FTC enforcement (including age-verification policy activity in 2026), plus a pending… [Profile →](/jurisdictions/massachusetts-usa/)[Brief](/reports/?t=entry&j=US-MA) [Mexico](/jurisdictions/mexico/) (MX) Americas Red Detailed practitioner review of the enacted NLFPDPPP text confirms that the new law does not include specific provisions addressing the processing of personal data of minors, continuing a… [Profile →](/jurisdictions/mexico/)[Brief](/reports/?t=entry&j=MX) [Michigan, USA](/jurisdictions/michigan-usa/) (US-MI) Americas Amber Federal COPPA governs children's data nationally, including Michigan, requiring verifiable parental consent. Michigan has two significant pending minor-protection bills: the Kids Code Act (SB 758… [Profile →](/jurisdictions/michigan-usa/)[Brief](/reports/?t=entry&j=US-MI) [Minnesota, USA](/jurisdictions/minnesota-usa/) (US-MN) Americas Green The MCDPA requires parental/guardian consent before processing a 'known child's' personal data (with limited exceptions) and COPPA compliance, plus an opt-in consent requirement for targeted… [Profile →](/jurisdictions/minnesota-usa/)[Brief](/reports/?t=entry&j=US-MN) [Mississippi, USA](/jurisdictions/mississippi-usa/) (US-MS) Americas Amber Mississippi enacted the Mississippi Social Media Safety Act, which requires covered social-media platforms to verify users' ages and implement measures to reduce minors' exposure to harmful online… [Profile →](/jurisdictions/mississippi-usa/)[Brief](/reports/?t=entry&j=US-MS) [Missouri, USA](/jurisdictions/missouri-usa/) (US-MO) Americas Amber Children's and student data in Missouri are governed almost entirely by federal law: COPPA requires parental consent before online operators collect personal information from children under 13, and… [Profile →](/jurisdictions/missouri-usa/)[Brief](/reports/?t=entry&j=US-MO) [Montana, USA](/jurisdictions/montana-usa/) (US-MT) Americas Amber Rights under the MTCDPA may be invoked by a known child's parent or legal guardian on the child's behalf. Enhanced protections apply to consumers aged 13 to under 16 (consent required for targeted… [Profile →](/jurisdictions/montana-usa/)[Brief](/reports/?t=entry&j=US-MT) [Morocco](/jurisdictions/morocco/) (MA) Africa Red No statutory age-of-consent, parental-consent mechanism, or minor-profiling ban was found under Law 09-08. CNDP has, however, launched an awareness platform ('Koun3labal') targeting children… [Profile →](/jurisdictions/morocco/)[Brief](/reports/?t=entry&j=MA) [Mozambique](/jurisdictions/mozambique/) (MZ) Africa Red No age-of-consent, parental-consent mechanism, minor-profiling ban, education-setting-specific rule, or dependent-adult protection has been identified in Mozambican law. [Profile →](/jurisdictions/mozambique/)[Brief](/reports/?t=entry&j=MZ) [Myanmar](/jurisdictions/myanmar/) (MM) Asia-Pacific Red No age-of-consent, parental-consent mechanism, minor-profiling ban, education-settings-specific rule, or dependent-adults protection was identified for Myanmar in any reviewed source. [Profile →](/jurisdictions/myanmar/)[Brief](/reports/?t=entry&j=MM) [Nebraska, USA](/jurisdictions/nebraska-usa/) (US-NE) Americas Amber Nebraska adopted an Age-Appropriate Online Design Code Act (signed May 30, 2025, becoming the third state after California and Maryland), effective January 1, 2026, with AG enforcement beginning July… [Profile →](/jurisdictions/nebraska-usa/)[Brief](/reports/?t=entry&j=US-NE) [Nepal](/jurisdictions/nepal/) (NP) Asia-Pacific Red No age-of-consent-for-processing rule, parental-consent mechanism, minor-profiling ban, education-settings-specific rule, or dependent-adult protection regime was located for Nepal. [Profile →](/jurisdictions/nepal/)[Brief](/reports/?t=entry&j=NP) [Netherlands](/jurisdictions/netherlands/) (NL) Europe Green The Netherlands applies the GDPR default age of 16 for information-society-service consent (Article 8), requiring verifiable parental/guardian consent below that age, with controllers expected to… [Profile →](/jurisdictions/netherlands/)[Brief](/reports/?t=entry&j=NL) [Nevada, USA](/jurisdictions/nevada-usa/) (US-NV) Americas Red No Nevada-specific age-verification, parental-consent, minor-profiling-ban, education-settings, or dependent-adult data-protection statute was identified in this research pass. Protections for minors… [Profile →](/jurisdictions/nevada-usa/)[Brief](/reports/?t=entry&j=US-NV) [New Brunswick, Canada](/jurisdictions/new-brunswick-canada/) (CA-NB) Americas Red The clearest evidenced development is the November 2025 joint resolution by the federal Privacy Commissioner and provincial/territorial counterparts (including New Brunswick's) on protecting… [Profile →](/jurisdictions/new-brunswick-canada/)[Brief](/reports/?t=entry&j=CA-NB) [New Hampshire, USA](/jurisdictions/new-hampshire-usa/) (US-NH) Americas Green The NHDPA requires opt-in consent for processing personal data of a known child under 13 for sensitive-data purposes, and bars targeted advertising or sale of personal data for consumers aged 13 to… [Profile →](/jurisdictions/new-hampshire-usa/)[Brief](/reports/?t=entry&j=US-NH) [New Jersey, USA](/jurisdictions/new-jersey-usa/) (US-NJ) Americas Amber Children under 13 are governed by the federal COPPA regime; New Jersey layers an additional opt-in consent requirement for processing personal data of consumers aged 13-16 when the controller knows… [Profile →](/jurisdictions/new-jersey-usa/)[Brief](/reports/?t=entry&j=US-NJ) [New Mexico, USA](/jurisdictions/new-mexico-usa/) (US-NM) Americas Amber New Mexico has no state-level age-of-consent, parental-consent, minor-profiling-ban, or education-settings-specific data statute; federal COPPA supplies the operative parental-consent baseline for… [Profile →](/jurisdictions/new-mexico-usa/)[Brief](/reports/?t=entry&j=US-NM) [New Zealand](/jurisdictions/new-zealand/) (NZ) Asia-Pacific Red New Zealand's Privacy Act does not contain a GDPR Art 8/COPPA-style parental-consent regime or a general age-of-consent threshold for data processing. Age 16 is used only as a narrower ground… [Profile →](/jurisdictions/new-zealand/)[Brief](/reports/?t=entry&j=NZ) [Nigeria](/jurisdictions/nigeria/) (NG) Africa Amber Section 31 of the NDPA addresses 'Children or persons lacking the legal capacity to consent,' establishing a distinct legal basis category for processing data of minors and incapacitated persons.… [Profile →](/jurisdictions/nigeria/)[Brief](/reports/?t=entry&j=NG) [North Carolina, USA](/jurisdictions/north-carolina-usa/) (US-NC) Americas Amber North Carolina relies on the federal Children's Online Privacy Protection Act (COPPA) for age-of-consent and parental-consent mechanics; no NC-specific age-verification, minor-profiling-ban… [Profile →](/jurisdictions/north-carolina-usa/)[Brief](/reports/?t=entry&j=US-NC) [North Dakota, USA](/jurisdictions/north-dakota-usa/) (US-ND) Americas Amber North Dakota relies on federal COPPA for parental-consent and age-of-consent protections for children's online data; no ND-specific age-verification, parental-consent, or minor-profiling-ban statute… [Profile →](/jurisdictions/north-dakota-usa/)[Brief](/reports/?t=entry&j=US-ND) [Norway](/jurisdictions/norway/) (NO) Europe Amber Norway participates in Nordic-level joint DPA principles on children's data in online gaming, and Datatilsynet enforcement has specifically flagged unlawful collection/sharing of children's personal… [Profile →](/jurisdictions/norway/)[Brief](/reports/?t=entry&j=NO) [Ohio, USA](/jurisdictions/ohio-usa/) (US-OH) Americas Amber Ohio relies on the federal Children's Online Privacy Protection Act (COPPA), enforced with attorney-general involvement, as its operative children's-data framework; no Ohio-specific age-verification… [Profile →](/jurisdictions/ohio-usa/)[Brief](/reports/?t=entry&j=US-OH) [Oklahoma, USA](/jurisdictions/oklahoma-usa/) (US-OK) Americas Amber The federal COPPA regime applies nationally including Oklahoma, requiring parental consent for collection of personal information from children under 13. SB 546 explicitly does NOT add enhanced… [Profile →](/jurisdictions/oklahoma-usa/)[Brief](/reports/?t=entry&j=US-OK) [Ontario, Canada](/jurisdictions/ontario-canada/) (CA-ON) Americas Amber Ontario's most direct statutory protection for a vulnerable group is Part X of the CYFSA, which gives children in the child-welfare system a right to reasonable privacy and possession of personal… [Profile →](/jurisdictions/ontario-canada/)[Brief](/reports/?t=entry&j=CA-ON) [Oregon, USA](/jurisdictions/oregon-usa/) (US-OR) Americas Amber OCPA and its 2025 amendment (HB 2008) impose parental-consent requirements for under-13 processing and expanded sale/targeted-advertising/profiling bans for consumers under 16, effective January 1… [Profile →](/jurisdictions/oregon-usa/)[Brief](/reports/?t=entry&j=US-OR) [Pakistan](/jurisdictions/pakistan/) (PK) Asia-Pacific Red No enacted age-of-consent, parental-consent, minor-profiling-ban, education-setting, or dependent-adult data protection provision exists. The May 2023 draft Personal Data Protection Bill contains a… [Profile →](/jurisdictions/pakistan/)[Brief](/reports/?t=entry&j=PK) [Palau](/jurisdictions/palau/) (PW) Asia-Pacific Red No age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adults protection could be located for Palau under a dedicated DP… [Profile →](/jurisdictions/palau/)[Brief](/reports/?t=entry&j=PW) [Panama](/jurisdictions/panama/) (PA) Americas Red No age-of-consent, parental-consent mechanism, minor-profiling ban, education-settings-specific rule, or dependent-adults provision specific to Law 81 was located in the sources reviewed. [Profile →](/jurisdictions/panama/)[Brief](/reports/?t=entry&j=PA) [Pennsylvania, USA](/jurisdictions/pennsylvania-usa/) (US-PA) Americas Red No enacted PA statute sets an age of consent for data processing, mandates parental consent for minors' data, bans minor profiling, imposes education-setting-specific data rules, or protects… [Profile →](/jurisdictions/pennsylvania-usa/)[Brief](/reports/?t=entry&j=US-PA) [Peru](/jurisdictions/peru/) (PE) Americas Green Processing of minors' data generally requires parental/guardian (patria potestad/tutela) consent; minors between 14 and 18 years may consent directly provided information is given in comprehensible… [Profile →](/jurisdictions/peru/)[Brief](/reports/?t=entry&j=PE) [Philippines](/jurisdictions/philippines/) (PH) Asia-Pacific Amber NPC Advisory Opinion No. 2024-03 (issued December 17, 2024) establishes child-oriented transparency guidelines, defining 'child' broadly and requiring age-appropriate privacy notices, Child Privacy… [Profile →](/jurisdictions/philippines/)[Brief](/reports/?t=entry&j=PH) [Poland](/jurisdictions/poland/) (PL) Europe Amber Poland's Act of 10 May 2018 is described as containing no major derogations from the GDPR, and no Poland-specific lower age-of-consent provision under GDPR Article 8 was located in this research… [Profile →](/jurisdictions/poland/)[Brief](/reports/?t=entry&j=PL) [Portugal](/jurisdictions/portugal/) (PT) Europe Amber The digital consent age is 13, with secure-authentication verification for parental consent below that age. A pending Bill (398/XVII/1) seeks to strengthen online protection of minors by setting age… [Profile →](/jurisdictions/portugal/)[Brief](/reports/?t=entry&j=PT) [Qatar](/jurisdictions/qatar/) (QA) Middle East Red Mainland Law No. 13 of 2016 requires operators of websites related to children to publish a policy on managing minors' information and to obtain parental consent before processing a child's data. No… [Profile →](/jurisdictions/qatar/)[Brief](/reports/?t=entry&j=QA) [Quebec, Canada](/jurisdictions/quebec-canada/) (CA-QC) Americas Amber Quebec sets a parental-consent threshold at under-14 (differing from the federal PIPEDA/OPC-suggested under-13 benchmark), with a minor's-benefit exception, and CAI has advocated for stricter minors'… [Profile →](/jurisdictions/quebec-canada/)[Brief](/reports/?t=entry&j=CA-QC) [Rhode Island, USA](/jurisdictions/rhode-island-usa/) (US-RI) Americas Amber RIDTPPA's children's-data protections are tied directly to COPPA's under-13 'child' definition, with no separate 13-16 teen protections (unlike Connecticut/CPRA). 'Enhanced children's privacy… [Profile →](/jurisdictions/rhode-island-usa/)[Brief](/reports/?t=entry&j=US-RI) [Romania](/jurisdictions/romania/) (RO) Europe Amber GDPR Article 8 sets the EU default digital age of consent at 16, with Member States permitted to lower it to no less than 13. This research pass did not locate a definitive, authoritative… [Profile →](/jurisdictions/romania/)[Brief](/reports/?t=entry&j=RO) [Russia](/jurisdictions/russia/) (RU) Europe Red No GDPR Article 8-style age-of-consent threshold, parental-consent mechanism, minor-profiling ban, education-setting-specific rule, or dependent-adult protection specific to personal-data processing… [Profile →](/jurisdictions/russia/)[Brief](/reports/?t=entry&j=RU) [Rwanda](/jurisdictions/rwanda/) (RW) Africa Amber The final Law N°058/2021 retains a dedicated 'Child's consent' provision (Article 10) within Chapter II. A specific age-of-consent threshold (18 years, with parental-responsibility-holder consent… [Profile →](/jurisdictions/rwanda/)[Brief](/reports/?t=entry&j=RW) [Saudi Arabia](/jurisdictions/saudi-arabia/) (SA) Middle East Red The PDPL's data-subject definition extends to a representative or legal guardian, implying protection for minors and incapacitated persons, but no specific statutory age of consent, dedicated… [Profile →](/jurisdictions/saudi-arabia/)[Brief](/reports/?t=entry&j=SA) [Senegal](/jurisdictions/senegal/) (SN) Africa Red No minor-specific age-of-consent threshold, parental-consent mechanism, minor-profiling prohibition, education-setting-specific rule, or dependent-adult protection provision was identified in Law No.… [Profile →](/jurisdictions/senegal/)[Brief](/reports/?t=entry&j=SN) [Serbia](/jurisdictions/serbia/) (RS) Europe Red The LPDP assigns the Commissioner a statutory duty to promote public awareness of risks, rules, safeguards and rights in relation to processing, with particular reference to processing of data… [Profile →](/jurisdictions/serbia/)[Brief](/reports/?t=entry&j=RS) [Seychelles](/jurisdictions/seychelles/) (SC) Africa Red No age-of-digital-consent provision, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adults protection specific to the Seychelles Act was identified in this… [Profile →](/jurisdictions/seychelles/)[Brief](/reports/?t=entry&j=SC) [Singapore](/jurisdictions/singapore/) (SG) Asia-Pacific Amber Protections for minors are guidance-based rather than statutory. The PDPA does not define 'child' nor 'children'. Unlike the GDPR, the PDPA does not… [Profile →](/jurisdictions/singapore/)[Brief](/reports/?t=entry&j=SG) [Slovakia](/jurisdictions/slovakia/) (SK) Europe Amber GDPR Art. 8's digital-consent age threshold applies as the default in Slovakia. Where GDPR Art. 6(1)(a) applies to an offer of information-society services directly to… [Profile →](/jurisdictions/slovakia/)[Brief](/reports/?t=entry&j=SK) [Slovenia](/jurisdictions/slovenia/) (SI) Europe Amber The 2025 school enforcement case confirms operative protection of minors' data in the education setting. The specific national age-of-consent threshold under GDPR Article 8 was not confirmed in this… [Profile →](/jurisdictions/slovenia/)[Brief](/reports/?t=entry&j=SI) [South Africa](/jurisdictions/south-africa/) (ZA) Africa Amber POPIA defines a child as anyone under 18 and requires valid consent from a 'competent person' (parent/guardian) for processing a child's personal information under Sections 34-35, subject to… [Profile →](/jurisdictions/south-africa/)[Brief](/reports/?t=entry&j=ZA) [South Carolina, USA](/jurisdictions/south-carolina-usa/) (US-SC) Americas Amber South Carolina's most developed data-protection regime is minors-focused: H.3431 (effective Feb. 5, 2026, with an additional social-media age-verification duty from March 1, 2026) requires age… [Profile →](/jurisdictions/south-carolina-usa/)[Brief](/reports/?t=entry&j=US-SC) [South Dakota, USA](/jurisdictions/south-dakota-usa/) (US-SD) Americas Red South Dakota has not enacted a state-specific children's online privacy, age-verification, parental-consent, minor-profiling, education-settings, or dependent-adults data-protection statute. Federal… [Profile →](/jurisdictions/south-dakota-usa/)[Brief](/reports/?t=entry&j=US-SD) [South Korea](/jurisdictions/south-korea/) (KR) Asia-Pacific Red PIPA requires the consent of a guardian or legal representative to process children's personal information, paralleling GDPR Art 8, but the statute lacks provisions specifically targeted at… [Profile →](/jurisdictions/south-korea/)[Brief](/reports/?t=entry&j=KR) [Spain](/jurisdictions/spain/) (ES) Europe Amber LOPDGDD sets the digital age of consent at fourteen, among the lowest permitted under GDPR Art 8's 13-16 range. AEPD publishes extensive guidance on age verification/age-appropriate design… [Profile →](/jurisdictions/spain/)[Brief](/reports/?t=entry&j=ES) [Sri Lanka](/jurisdictions/sri-lanka/) (LK) Asia-Pacific Red No PDPA provision or Authority guidance addressing age of consent, parental-consent mechanisms, minor-profiling bans, education-setting-specific rules, or dependent-adult protections was located in… [Profile →](/jurisdictions/sri-lanka/)[Brief](/reports/?t=entry&j=LK) [Sweden](/jurisdictions/sweden/) (SE) Europe Amber Sweden exercised the GDPR Art 8 Member State option to set the digital age of consent at 13, with parental/guardian consent required below that age. Children and young people are a named 2026 IMY… [Profile →](/jurisdictions/sweden/)[Brief](/reports/?t=entry&j=SE) [Switzerland](/jurisdictions/switzerland/) (CH) Europe Red The revFADP's legislative history explicitly cites the protection of minors as one of the European-standard alignment goals of the revision. However, specific mechanisms — an age-of-consent threshold… [Profile →](/jurisdictions/switzerland/)[Brief](/reports/?t=entry&j=CH) [Taiwan](/jurisdictions/taiwan/) (TW) Asia-Pacific Red Unlike the GDPR, the PDPA does not address the processing of children's data or provide additional requirements for minors, and no parental-consent mechanism, minor-profiling ban… [Profile →](/jurisdictions/taiwan/)[Brief](/reports/?t=entry&j=TW) [Tanzania](/jurisdictions/tanzania/) (TZ) Africa Red No qualifying source was located covering age-of-consent thresholds, parental-consent mechanisms, minor-profiling bans, education-setting-specific rules, or dependent-adult protections under… [Profile →](/jurisdictions/tanzania/)[Brief](/reports/?t=entry&j=TZ) [Tennessee, USA](/jurisdictions/tennessee-usa/) (US-TN) Americas Red No Tennessee-specific age-verification, parental-consent mechanics, minor-profiling ban, education-setting rule, or dependent-adult protection was independently confirmed for TIPA in this research… [Profile →](/jurisdictions/tennessee-usa/)[Brief](/reports/?t=entry&j=US-TN) [Texas, USA](/jurisdictions/texas-usa/) (US-TX) Americas Amber Texas maintains overlapping minors-protection statutes: HB 1181 (age-verification for adult content, upheld by SCOTUS in Free Speech Coalition v. Paxton, June 27, 2025) with steep per-day/per-access… [Profile →](/jurisdictions/texas-usa/)[Brief](/reports/?t=entry&j=US-TX) [Thailand](/jurisdictions/thailand/) (TH) Asia-Pacific Amber Minors' consent capacity is governed by reference to Thai civil-law majority/sui-juris concepts rather than a fixed statutory age threshold as in GDPR Art.8: unlike the GDPR … [Profile →](/jurisdictions/thailand/)[Brief](/reports/?t=entry&j=TH) [Trinidad and Tobago](/jurisdictions/trinidad-and-tobago/) (TT) Caribbean Red The Data Protection Bill, 2024 defines 'child' by reference to the Children's Act but no explicit digital age-of-consent threshold, parental-consent mechanism, minor-profiling ban, education-settings… [Profile →](/jurisdictions/trinidad-and-tobago/)[Brief](/reports/?t=entry&j=TT) [Tunisia](/jurisdictions/tunisia/) (TN) Africa Red No age-of-consent, parental-consent mechanism, minor-profiling ban, education-setting-specific rule, or dependent-adults protection specific to Tunisia's data-protection framework was identified in… [Profile →](/jurisdictions/tunisia/)[Brief](/reports/?t=entry&j=TN) [Turkey](/jurisdictions/turkey/) (TR) Europe Red Unlike the GDPR (Article 8), the LPPD does not grant special statutory protection to children's personal data, does not set an age of consent, and does not specify whether parental/guardian consent… [Profile →](/jurisdictions/turkey/)[Brief](/reports/?t=entry&j=TR) [Uganda](/jurisdictions/uganda/) (UG) Africa Amber Section 8 of the Act requires prior parental/guardian consent for processing a child's personal data, and Regulation 11 requires collectors/controllers/processors to establish an age-ascertainment… [Profile →](/jurisdictions/uganda/)[Brief](/reports/?t=entry&j=UG) [Ukraine](/jurisdictions/ukraine/) (UA) Europe Amber Ukraine has no dedicated children's-online-privacy statute; the 2010 Law applies to minors on a general basis. Civil-capacity rules (under-18 = child; 14+ can enter minor contracts) determine when… [Profile →](/jurisdictions/ukraine/)[Brief](/reports/?t=entry&j=UA) [United Arab Emirates](/jurisdictions/united-arab-emirates/) (AE) Middle East Red Free-zone instruments provide limited, inconsistent coverage of children's data: ADGM defines a child as under 18 (versus GDPR's 16, adjustable to 13) but does not set explicit parental-consent… [Profile →](/jurisdictions/united-arab-emirates/)[Brief](/reports/?t=entry&j=AE) [United Kingdom](/jurisdictions/united-kingdom/) Expert reviewed (UK) Europe Amber The Children's code (Age Appropriate Design Code), a statutory code under DPA 2018 s.125 in force since 2 September 2020, sets 15 standards for online services likely accessed by children, including… [Profile →](/jurisdictions/united-kingdom/)[Brief](/reports/?t=entry&j=UK) [United States](/jurisdictions/united-states/) (US) Americas Amber COPPA remains the anchor federal children's-privacy statute, applying to children under 13 and requiring verifiable parental consent; its 2025 amendments strengthen opt-in consent for third-party… [Profile →](/jurisdictions/united-states/)[Brief](/reports/?t=entry&j=US) [United States — California](/jurisdictions/united-states-california/) (US-CA) Americas Amber California layers multiple children's-privacy statutes: the CCPA/CPRA's opt-in consent requirement for selling/sharing the personal information of consumers under 16 (with heightened penalties for… [Profile →](/jurisdictions/united-states-california/)[Brief](/reports/?t=entry&j=US-CA) [United States — New York](/jurisdictions/united-states-new-york/) (US-NY) Americas Amber New York has two dedicated children's-data statutes: the Child Data Protection Act (CDPA), restricting collection/use/sale of minors' (under-18) personal data absent consent, and the SAFE for Kids… [Profile →](/jurisdictions/united-states-new-york/)[Brief](/reports/?t=entry&j=US-NY) [Uruguay](/jurisdictions/uruguay/) (UY) Americas Red No Uruguay-specific provisions on age of consent for data processing, parental-consent mechanisms, minor-profiling bans, education-settings-specific DP rules, or dependent-adult protections were… [Profile →](/jurisdictions/uruguay/)[Brief](/reports/?t=entry&j=UY) [Utah, USA](/jurisdictions/utah-usa/) (US-UT) Americas Amber The UCPA aligns its under-13 parental-consent threshold with COPPA. Utah's more consequential minors' protections sit outside the UCPA in the Minor Protection in Social Media Act (SB 194/HB 464)… [Profile →](/jurisdictions/utah-usa/)[Brief](/reports/?t=entry&j=US-UT) [Vanuatu](/jurisdictions/vanuatu/) (VU) Asia-Pacific Red No Vanuatu-specific age-of-consent, parental-consent mechanism, minor-profiling ban, education-settings rule, or dependent-adult protection was located in available sources. Searches run: 'Vanuatu… [Profile →](/jurisdictions/vanuatu/)[Brief](/reports/?t=entry&j=VU) [Venezuela](/jurisdictions/venezuela/) (VE) Americas Red The Ley Orgánica para la Protección de Niños, Niñas y Adolescentes (LOPNNA) governs child-welfare matters generally, including identity/registration rights, but contains no data-protection-specific… [Profile →](/jurisdictions/venezuela/)[Brief](/reports/?t=entry&j=VE) [Vermont, USA](/jurisdictions/vermont-usa/) (US-VT) Americas Amber Vermont's Age-Appropriate Design Code Act (S.69, signed 2025-06-12, effective 2027-01-01) governs minors' online experience via a 2%-of-users threshold rather than direct age verification; S.71… [Profile →](/jurisdictions/vermont-usa/)[Brief](/reports/?t=entry&j=US-VT) [Vietnam](/jurisdictions/vietnam/) (VN) Asia-Pacific Red Despite targeted searches, no PDPL/Decree 356 provisions specifying a minimum age of consent, a parental-consent mechanism, or minor-specific profiling bans were located in the secondary sources… [Profile →](/jurisdictions/vietnam/)[Brief](/reports/?t=entry&j=VN) [Virginia, USA](/jurisdictions/virginia-usa/) (US-VA) Americas Amber Virginia has rapidly expanded children's-data protections: known-child (<13) data is VCDPA sensitive data requiring consent; a 2026 amendment (effective January 1, 2026) requires social-media… [Profile →](/jurisdictions/virginia-usa/)[Brief](/reports/?t=entry&j=US-VA) [Washington State, USA](/jurisdictions/washington-state-usa/) (US-WA) Americas Red No Washington state-specific statute establishing an age-of-consent threshold, parental-consent mechanism, minor-profiling ban, education-settings privacy rule, or dependent-adults protection was… [Profile →](/jurisdictions/washington-state-usa/)[Brief](/reports/?t=entry&j=US-WA) [West Virginia, USA](/jurisdictions/west-virginia-usa/) (US-WV) Americas Amber Children's data protection in West Virginia is governed by the federal COPPA regime; the state itself has not enacted comprehensive minors'-privacy legislation, though a bill on online privacy… [Profile →](/jurisdictions/west-virginia-usa/)[Brief](/reports/?t=entry&j=US-WV) [Wisconsin, USA](/jurisdictions/wisconsin-usa/) (US-WI) Americas Amber Federal COPPA and FERPA provide the operative protections for children and students affecting Wisconsin, in the absence of any Wisconsin-specific enhancement. COPPA requires verifiable parental… [Profile →](/jurisdictions/wisconsin-usa/)[Brief](/reports/?t=entry&j=US-WI) [Wyoming, USA](/jurisdictions/wyoming-usa/) (US-WY) Americas Amber Children's data protections in Wyoming derive entirely from federal law: COPPA's verifiable-parental-consent regime for online operators, and FERPA's parental-rights structure for education records.… [Profile →](/jurisdictions/wyoming-usa/)[Brief](/reports/?t=entry&j=US-WY) [Zambia](/jurisdictions/zambia/) (ZM) Africa Red No T1/T2 material on age-of-consent thresholds, parental-consent mechanisms, minor-profiling bans, education-setting rules, or dependent-adult protections under Zambia's Act was retrievable via… [Profile →](/jurisdictions/zambia/)[Brief](/reports/?t=entry&j=ZM)