#
No codified statutory age-of-consent, parental-consent mechanism, minor-profiling ban, or dependent-adults regime currently exists; all children's-data protections are at the proposal stage pending the 2026/2027 reform.
Sub-modules (5)
Age VerificationRed
No statutory age-verification requirement exists; the APPI does not currently define a child's age, though PPC Q&A informally references ages 12-15 and under, and reform proposes codifying under-16 as the child threshold.
Claims (2):
- Under current law there are basically no explicit statutory provisions regarding the handling of children's personal information, and the APPI does not define the age of a child; PPC Q&A guidance indicates the applicable age can vary by data type and business nature, generally referencing ages 12-15 and under.
- The PPC's triennial-review reform proposes formally defining those under 16 years old as children for APPI purposes.
Parental ConsentRed
No statutory parental-consent mechanism analogous to COPPA or GDPR Article 8 currently exists under the APPI.
Claims (1):
- Under current law there are basically no explicit statutory provisions regarding the handling of children's personal information, and the APPI does not define the age of a child; PPC Q&A guidance indicates the applicable age can vary by data type and business nature, generally referencing ages 12-15 and under.
Minor Profiling BansRed
No minor-specific profiling ban currently exists; reform proposes a best-interests-of-the-child standard for safety-control measures applied to children's data.
Claims (1):
- The reform proposes strengthening safety-control-measure obligations specific to children's personal data, including a requirement that operators prioritise and give special consideration to the best interests of children.
Education SettingsRed
No education-setting-specific data-protection statute was identified; the reform discussion balances children's-data protection against the utility of student learning data.
Claims (1):
- The PPC's reform discussion explicitly weighs the vulnerability and need for protection of children's data against the usefulness of student education and learning data, without proposing a dedicated education-sector statute.
Dependent AdultsRed
No dedicated dependent-adults (elderly/incapacitated) data-protection regime was identified; the closest policy analogue is PPC concern over opt-out-scheme misuse enabling elder-targeted financial fraud.
Claims (1):
- No dedicated dependent-adults data-protection regime exists; the PPC has instead flagged demand to regulate malicious personal-information list providers as a countermeasure against criminal groups using elderly individuals' financial information to commit fraud.
Children & Vulnerable Groups
Act No. 56/2026 is reported to introduce, for the first time, statutory provisions specifically addressing the treatment of minors' personal data, together with a newly-defined relevant age threshold. This is a notable structural development because the APPI has not previously contained bespoke statutory provisions on minors' data; the PPC's prior approach relied on non-binding Q&A guidance, which treated children aged 12 to 15 or younger as generally lacking the capacity to consent on their own behalf, assessed case-by-case rather than by a fixed statutory age line. The move to a defined statutory age threshold, once Act No. 56/2026's main body commences, would replace this case-by-case guidance-based approach with a clearer, legislatively-fixed standard, though the precise age threshold adopted in the enacted text was not established in the material available this cycle.
This development is reported in secondary law-firm commentary rather than the amendment's own text, and the practical content of the new minors'-data provisions, including what additional obligations or restrictions attach to processing a minor's personal data once the threshold is crossed or not crossed, was not established this cycle. The provision is enacted but not yet in force, subject to the same Cabinet-order commencement mechanism applicable to the amendment's main body generally, with likely effect around mid-2028.
Outlook
The specific statutory age threshold adopted by Act No. 56/2026, and the substantive content of the obligations or restrictions tied to it, remain to be established from the amendment's own text or from PPC explanatory guidance; this is the clearest open item for this module. Businesses operating services directed at or accessed by minors in Japan would be the primary population affected once these provisions commence, though the lack of detail on the threshold and substantive content limits what can currently be said about practical compliance implications.
2 earlier distinct update(s)
Children & Vulnerable Groups
Act No. 56 of 2026 introduces new APPI Article 40-2, Japan's first-ever minors-specific provision under the Act. This provision requires that, where APPI consent or notification is required and concerns an individual under 16 years of age, it must in principle be obtained from, or given to, that individual's legal representative rather than the minor directly. The pre-amendment APPI contained no provision of this kind, making this a genuinely new structural feature of Japan's data-protection law rather than an adjustment to an existing minors framework.
This provision is enacted but not yet in force, forming part of the broader Act No. 56/2026 package. The PPC's September 2026 discussion of its implementing-rules basic concept specifically flagged youth-data protection as a rulemaking focus area, suggesting that further implementing detail on how the legal-representative-consent requirement will operate in practice is likely to follow as the Cabinet Order process develops.
Outlook
Commencement is expected by Cabinet Order no later than July 2028. Given the PPC's stated focus on youth-data protection in its implementing-rules discussion, further guidance on the practical operation of the Article 40-2 legal-representative-consent requirement, including any age-verification expectations, is a likely area for near-term regulatory attention ahead of that deadline.
Children & Vulnerable Groups
The 2026 amendment introduces Japan's first dedicated statutory provisions for minors within the APPI: a parental-consent requirement for processing the personal data of individuals under 16, coupled with enhanced deletion and suspension rights specifically for children.
Outlook
These minors' protections await Cabinet-order commencement, due no later than July 2028. Once active, they will require operators serving Japanese users under 16 to establish parental-consent mechanisms where none were previously mandated under the APPI.
Sources and claims (5)
- ConfirmedIAPP — Under current law there are basically no explicit statutory provisions regarding the handling of children's personal information, and the APPI does not define the age of a child; PPC Q&A guidance indicates the applicable age can vary by data type and business nature, generally referencing ages 12-15 and under.observed
- ProbableIAPP — The PPC's triennial-review reform proposes formally defining those under 16 years old as children for APPI purposes.observed
- ProbableIAPP — The reform proposes strengthening safety-control-measure obligations specific to children's personal data, including a requirement that operators prioritise and give special consideration to the best interests of children.observed
- UncertainIAPP — The PPC's reform discussion explicitly weighs the vulnerability and need for protection of children's data against the usefulness of student education and learning data, without proposing a dedicated education-sector statute.observed
- ConfirmedIAPP — No dedicated dependent-adults data-protection regime exists; the PPC has instead flagged demand to regulate malicious personal-information list providers as a countermeasure against criminal groups using elderly individuals' financial information to commit fraud.observed