--- title: "Netherlands — Children & Vulnerable Groups | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/netherlands/children-and-vulnerable-groups/ source_html: /jurisdictions/netherlands/children-and-vulnerable-groups/index.html description: "Netherlands — Children & Vulnerable Groups: children_and_vulnerable_groups Children & Vulnerable Groups 5 sub-modules 4 claims Green ▾ # Age-of-consent and parental-consent framework is clear and GDPR-aligned; a minor pendin" generated_at: 2026-10-25T04:46:50Z content_sha256: 341de00d8f4ea83760dfebc28ca0e56deae619dcee44361e987d346916991e9d generator: "fe-fleet/md-twin@1.0" --- # Netherlands — Children & Vulnerable Groups | Data Protection Monitor ### D9Children & Vulnerable Groups5 sub-modules4 claimsGreen▾# Age-of-consent and parental-consent framework is clear and GDPR-aligned; a minor pending legislative refinement does not affect current binding status. Primary framework GDPR Article 8; UAVG Article 5 Supervisory authority [Autoriteit Persoonsgegevens (AP)](https://autoriteitpersoonsgegevens.nl/) Traffic-light rationale — Green Age-of-consent and parental-consent framework is clear and GDPR-aligned; a minor pending legislative refinement does not affect current binding status. #### Sub-modules (5) #### Age VerificationGreen Controllers must make reasonable efforts, given available technology, to verify that parental/guardian consent has been given for children under 16. Claims (1): - Data controllers must take reasonable efforts, using available technology, to verify that a person consenting on behalf of a child under the applicable age threshold actually holds parental responsibility. #### Parental ConsentGreen Below age 16, consent for information-society-service processing must be given or authorised by the holder of parental responsibility. Claims (1): - Children aged 16 and above may give their own consent for information-society-service processing in the Netherlands; for children below 16, consent must be obtained from the child's legal guardian or parent, consistent with the GDPR Article 8 default and reiterated in the UAVG. #### Minor Profiling BansAmber No NL-specific blanket ban on profiling of minors distinct from GDPR Article 22/Recital 71 general caution was identified. Absence provenance: unavailable . Searched: Netherlands minor profiling ban AP guidance. #### Education SettingsAmber UAVG special-category exceptions extend to schools processing pupil data for defined educational purposes; no separate education-specific DP statute was identified. Claims (1): - UAVG Chapter 3 exceptions extending to schools permit processing of certain special-category pupil data for defined educational purposes, alongside similar exceptions for hospitals and insurers. #### Dependent AdultsGreen UAVG Article 5 requires the consent of a legal representative instead of the data subject where the data subject is under guardianship or subject to an administration or protection order and lacks legal capacity to consent. Claims (1): - Under UAVG Article 5(2), if a data subject is under guardianship or subject to an administration or protection order, the consent of the legal representative is required instead of the data subject's own consent, to the extent the data subject lacks legal capacity. Category narrative 71 words The Netherlands applies the GDPR default age of 16 for information-society-service consent (Article 8), requiring verifiable parental/guardian consent below that age, with controllers expected to make reasonable efforts to verify parental authority given available technology. UAVG Article 5 extends analogous legal-representative consent requirements to adults under guardianship or subject to an administration/protection order. A pending Dutch bill (Data Protection Collective Act) would adjust children's-data consent provisions but is not yet enacted. Periodic update · new data 2026-09-28 #### Children & Vulnerable Groups A proposed amendment to the UAVG, reported to be in consultation as of 2026, would allow children aged 12 and above to make independent data-subject requests under Dutch data protection law. This proposal is not yet enacted, and reports suggest it remains at consultation stage without a confirmed timeline for entry into force. If adopted, this would represent a structural shift in how Dutch law treats the data-protection agency of minors, granting a defined age cohort, 12 and above, the standing to exercise data-subject rights independently rather than through a parent or guardian. This is a notable departure from data-protection frameworks that set the age of independent digital consent higher, and its progress is worth tracking distinctly from the general data-subject-rights item given its specific focus on the vulnerable-groups dimension of Dutch law. #### Outlook The UAVG amendment's consultation status means no confirmed effective date exists yet for the children's independent-request provision. Its progression toward enactment is the key marker to watch for this module, alongside any further detail on how the narrowed criminal-personal-data definition referenced in the same proposal would apply to minors specifically. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Evidence 4 Sources and claims (4) - Confirmed[EUR-Lex](https://eur-lex.europa.eu/legal-content/NL/TXT/HTML/?uri=CELEX%3A02016R0679-20160504) — Data controllers must take reasonable efforts, using available technology, to verify that a person consenting on behalf of a child under the applicable age threshold actually holds parental responsibility.observed 2026-08-03 - Confirmed[IAPP](https://iapp.org/news/a/dutch-government-introduces-gdpr-implementation-bill) — Children aged 16 and above may give their own consent for information-society-service processing in the Netherlands; for children below 16, consent must be obtained from the child's legal guardian or parent, consistent with the GDPR Article 8 default and reiterated in the UAVG.observed 2026-08-03 - Probable[IAPP](https://iapp.org/news/a/dutch-government-introduces-gdpr-implementation-bill) — UAVG Chapter 3 exceptions extending to schools permit processing of certain special-category pupil data for defined educational purposes, alongside similar exceptions for hospitals and insurers.observed 2026-08-03 - Confirmed[DataGuidance](https://www.dataguidance.com/sites/default/files/dutch_general_general_data_protection_regulation_implemention_act.pdf) — Under UAVG Article 5(2), if a data subject is under guardianship or subject to an administration or protection order, the consent of the legal representative is required instead of the data subject's own consent, to the extent the data subject lacks legal capacity.observed 2026-08-03