Data Protection Monitor
Global Privacy & Data Protection Intelligence

Germany (DE) · Module Detail

Germany: Children & Vulnerable Groups

#

The core Art 8 consent-age rule is settled and green, but minor-profiling-specific bans, education-settings-specific rules, and dependent-adult-specific protections were not identified as distinct DE statutory sub-regimes, and BfDI itself flags the EU reform track as currently under-addressing children's data protection.

Primary frameworkGDPR Article 8 (digital consent age fixed at 16 in Germany)
Supervisory authorityBfDI
Traffic-light rationale — AmberThe core Art 8 consent-age rule is settled and green, but minor-profiling-specific bans, education-settings-specific rules, and dependent-adult-specific protections were not identified as distinct DE statutory sub-regimes, and BfDI itself flags the EU reform track as currently under-addressing children's data protection.

Sub-modules (5)

Age VerificationAmber

Digital-consent age of 16 diverges from the age-7 threshold for general contractual capacity under German civil law, complicating age-verification design.

Claims (1):

  • Germany's GDPR Art 8 digital-consent age (16) diverges from the age-7 threshold for general 'everyday' contractual capacity under German civil law, complicating age-verification design.

Minor Profiling BansAmber

No standalone statutory ban on profiling of minors beyond general Art 22 GDPR exists; BfDI criticizes the EU Digital Omnibus for insufficient children's-data safeguards.

Claims (1):

  • BfDI criticizes the EU Digital Omnibus reform proposal for not adequately strengthening children's-data protection. No standalone DE minor-profiling ban beyond general Art 22 GDPR was identified.

Education SettingsRed

No DE-specific federal education-settings DP statute was identified; school data protection is generally a Land-law matter outside this federal-focused pass.

Absence provenance: unavailable. Searched: Schuldatenschutz Bund Deutschland, education settings DP Germany federal.

Dependent AdultsRed

No DE-specific dependent-adult DP statute distinct from general GDPR/BDSG was identified.

Absence provenance: unavailable. Searched: Betreuungsrecht Datenschutz Deutschland, dependent adults data protection Germany.

Key findings (3)

  • — source on file
  • — source on file
  • — source on file
Category narrative71 words

Germany fixes the GDPR Art 8 digital-consent age at 16; below that age, parental consent is required for information-society-service processing. This diverges from general German civil-law contractual capacity, under which minors may conclude 'everyday' contracts from age 7, creating friction in age-verification design. No standalone minor-specific profiling ban or dedicated education/dependent-adult DP statute was identified; BfDI has publicly criticized the EU Digital Omnibus reform proposal for not adequately strengthening children's-data protection.

no periodic updates on record for this sub-brief

Sources and claims (3)
  1. ProbableBfDI — Germany's GDPR Art 8 digital-consent age (16) diverges from the age-7 threshold for general 'everyday' contractual capacity under German civil law, complicating age-verification design.observed
  2. ProbableBfDI — Parental consent is required for information-society-service processing of a child's data below the age of 16.observed
  3. ProbableBfDI — BfDI criticizes the EU Digital Omnibus reform proposal for not adequately strengthening children's-data protection. No standalone DE minor-profiling ban beyond general Art 22 GDPR was identified.observed