---
title: "European Economic Area — Children & Vulnerable Groups | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/european-economic-area-bloc/children-and-vulnerable-groups/
source_html: /jurisdictions/european-economic-area-bloc/children-and-vulnerable-groups/index.html
description: "European Economic Area (Bloc) — Children & Vulnerable Groups (Amber, 5 sub-modules, 2 claims): Core Article 8 mechanism is well-established law, but dedicated children"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 9ef29872962e3045b9ea88f332c694b2986f715b8b11bc1ba2591d90ba9ddeb8
generator: "fe-fleet/md-twin@1.0"
---
# European Economic Area — Children & Vulnerable Groups | Data Protection Monitor

### D9Children & Vulnerable Groups5 sub-modules2 claimsAmber▾#

Core Article 8 mechanism is well-established law, but dedicated children's-data guidelines remain in development and several sub-areas (age verification specifics, education settings, dependent adults) lack direct 2026 sourcing in this pass.

Primary framework GDPR Article 8 (Regulation (EU) 2016/679)

Supervisory authority [EDPB (developing dedicated Guidelines on children's data)](https://www.edpb.europa.eu/)

Traffic-light rationale — Amber Core Article 8 mechanism is well-established law, but dedicated children's-data guidelines remain in development and several sub-areas (age verification specifics, education settings, dependent adults) lack direct 2026 sourcing in this pass.

#### Sub-modules (5)

Category narrative 198 words

Under Art. 8(1) GDPR, the default digital age of consent for the direct offer of Information Society Services (ISS) to a child is 16 years, with an opening clause allowing Member States to set a lower threshold not below 13 years. Across the 30 EEA states, national thresholds span the full 13–16 range (e.g., 13 in Belgium, Denmark, Estonia, Finland, Latvia, Malta, Norway, Portugal, Sweden; 14 in Austria, Bulgaria, Cyprus, Italy, Lithuania, Spain; 15 in Czechia, France, Greece, Slovenia; 16 in Croatia, Germany, Hungary, Ireland, Liechtenstein, Luxembourg, Netherlands, Poland, Romania, Slovakia). Beyond Art. 8 consent, the Digital Services Act (Regulation (EU) 2022/2065) imposes directly applicable Union-wide child protection rules on all online platforms accessible to minors: Art. 28(1) DSA requires providers to ensure a high level of privacy, safety, and security of minors by design (amplified by the European Commission's Article 28(4) DSA Guidelines on Protection of Minors and the EU privacy-preserving age-verification blueprint released in July 2025), and Art. 28(2) DSA imposes an absolute prohibition on presenting advertisements based on profiling (as defined in Art. 4(4) GDPR) using personal data of a recipient when the platform is aware with reasonable certainty that the recipient is a minor.

Evidence 2

Sources and claims (2)
- Confirmed[CNIL](https://www.cnil.fr/sites/cnil/files/2025-01/guide_tia.pdf) — Article 8 GDPR sets a default minimum age of 16 for a child to consent to processing in relation to information-society services, permitting Member States to lower this threshold by law to no less than 13 years, with parental-responsibility-holder consent required below the applicable age.observed 2026-08-05
- Confirmed[EDPB](https://www.edpb.europa.eu/system/files/documents/2026-02/edpb_work-programme_2026-2027_en.pdf) — The EDPB's 2026-2027 work programme includes the development of dedicated Guidelines on children's data as one of its Pillar I harmonisation priorities.observed 2026-08-05