European Economic Area: Children & Vulnerable Groups

Under Art. 8(1) GDPR, the default digital age of consent for the direct offer of Information Society Services (ISS) to a child is 16 years, with an opening clause allowing Member States to set a lower threshold not below 13 years. Across the 30 EEA states, national thresholds span the full 13–16 range (e.g., 13 in Belgium, Denmark, Estonia, Finland, Latvia, Malta, Norway, Portugal, Sweden; 14 in Austria, Bulgaria, Cyprus, Italy, Lithuania, Spain; 15 in Czechia, France, Greece, Slovenia; 16 in Croatia, Germany, Hungary, Ireland, Liechtenstein, Luxembourg, Netherlands, Poland, Romania, Slovakia). Beyond Art. 8 consent, the Digital Services Act (Regulation (EU) 2022/2065) imposes directly applicable Union-wide child protection rules on all online platforms accessible to minors: Art. 28(1) DSA requires providers to ensure a high level of privacy, safety, and security of minors by design (amplified by the European Commission's Article 28(4) DSA Guidelines on Protection of Minors and the EU privacy-preserving age-verification blueprint released in July 2025), and Art. 28(2) DSA imposes an absolute prohibition on presenting advertisements based on profiling (as defined in Art. 4(4) GDPR) using personal data of a recipient when the platform is aware with reasonable certainty that the recipient is a minor.