--- title: "Germany — Children & Vulnerable Groups | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/germany/children-and-vulnerable-groups/ source_html: /jurisdictions/germany/children-and-vulnerable-groups/index.html description: "Germany — Children & Vulnerable Groups: children_and_vulnerable_groups Children & Vulnerable Groups 5 sub-modules 3 claims Amber ▾ # The core Art 8 consent-age rule is settled and green, but minor-profiling-specific bans" generated_at: 2026-10-25T04:46:50Z content_sha256: 62304314867407e90e7aeb4c48d931429ab89eb71e1d09636d8ed1e5f30577d0 generator: "fe-fleet/md-twin@1.0" --- # Germany — Children & Vulnerable Groups | Data Protection Monitor ### D9Children & Vulnerable Groups5 sub-modules3 claimsAmber▾# The core Art 8 consent-age rule is settled and green, but minor-profiling-specific bans, education-settings-specific rules, and dependent-adult-specific protections were not identified as distinct DE statutory sub-regimes, and BfDI itself flags the EU reform track as currently under-addressing children's data protection. Primary framework GDPR Article 8 (digital consent age fixed at 16 in Germany) Supervisory authority [BfDI](https://www.bfdi.bund.de/) Traffic-light rationale — Amber The core Art 8 consent-age rule is settled and green, but minor-profiling-specific bans, education-settings-specific rules, and dependent-adult-specific protections were not identified as distinct DE statutory sub-regimes, and BfDI itself flags the EU reform track as currently under-addressing children's data protection. #### Sub-modules (5) #### Age VerificationAmber Digital-consent age of 16 diverges from the age-7 threshold for general contractual capacity under German civil law, complicating age-verification design. Claims (1): - Germany's GDPR Art 8 digital-consent age (16) diverges from the age-7 threshold for general 'everyday' contractual capacity under German civil law, complicating age-verification design. #### Parental ConsentGreen Below age 16, parental consent is required for information-society-service processing of a child's data. Claims (1): - Parental consent is required for information-society-service processing of a child's data below the age of 16. #### Minor Profiling BansAmber No standalone statutory ban on profiling of minors beyond general Art 22 GDPR exists; BfDI criticizes the EU Digital Omnibus for insufficient children's-data safeguards. Claims (1): - BfDI criticizes the EU Digital Omnibus reform proposal for not adequately strengthening children's-data protection. No standalone DE minor-profiling ban beyond general Art 22 GDPR was identified. #### Education SettingsRed No DE-specific federal education-settings DP statute was identified; school data protection is generally a Land-law matter outside this federal-focused pass. Absence provenance: unavailable . Searched: Schuldatenschutz Bund Deutschland, education settings DP Germany federal. #### Dependent AdultsRed No DE-specific dependent-adult DP statute distinct from general GDPR/BDSG was identified. Absence provenance: unavailable . Searched: Betreuungsrecht Datenschutz Deutschland, dependent adults data protection Germany. #### Key findings (3) - — source on file - — source on file - — source on file Category narrative 71 words Germany fixes the GDPR Art 8 digital-consent age at 16; below that age, parental consent is required for information-society-service processing. This diverges from general German civil-law contractual capacity, under which minors may conclude 'everyday' contracts from age 7, creating friction in age-verification design. No standalone minor-specific profiling ban or dedicated education/dependent-adult DP statute was identified; BfDI has publicly criticized the EU Digital Omnibus reform proposal for not adequately strengthening children's-data protection. no periodic updates on record for this sub-brief Evidence 3 Sources and claims (3) - Probable[BfDI](https://www.bfdi.bund.de/EN/Buerger/Inhalte/Allgemein/Datenschutz/Einwilligung.html) — Germany's GDPR Art 8 digital-consent age (16) diverges from the age-7 threshold for general 'everyday' contractual capacity under German civil law, complicating age-verification design.observed 2026-07-29 - Probable[BfDI](https://www.bfdi.bund.de/EN/Buerger/Inhalte/Allgemein/Datenschutz/Einwilligung.html) — Parental consent is required for information-society-service processing of a child's data below the age of 16.observed 2026-07-29 - Probable[BfDI](https://www.bfdi.bund.de/SharedDocs/Kurzmeldungen/DE/2026/09_High_Level_Debatte-KM.html) — BfDI criticizes the EU Digital Omnibus reform proposal for not adequately strengthening children's-data protection. No standalone DE minor-profiling ban beyond general Art 22 GDPR was identified.observed 2026-07-29