---
title: "Spain — Children & Vulnerable Groups | Data Protection Monitor"
canonical: https://dataprotection.gi/jurisdictions/spain/children-and-vulnerable-groups/
source_html: /jurisdictions/spain/children-and-vulnerable-groups/index.html
description: "Spain — Children & Vulnerable Groups: children_and_vulnerable_groups Children & Vulnerable Groups 5 sub-modules 2 claims Amber ▾ # Consent-age and parental-consent framework is clear and GDPR-aligned; minor-specific pr"
generated_at: 2026-10-25T04:46:50Z
content_sha256: 17ebb4d4fb14493cc9303e99cd0174086bd5cdf476218eb86cb21ba34117a555
generator: "fe-fleet/md-twin@1.0"
---
# Spain — Children & Vulnerable Groups | Data Protection Monitor

### D9Children & Vulnerable Groups5 sub-modules2 claimsAmber▾#

Consent-age and parental-consent framework is clear and GDPR-aligned; minor-specific profiling bans and dependent-adult protections beyond general GDPR safeguards were not evidenced in this pass.

Primary framework GDPR Art 8 + LOPDGDD Art 7 + LOPDGDD Art 34

Supervisory authority [Agencia Española de Protección de Datos (AEPD)](https://www.aepd.es)

Traffic-light rationale — Amber Consent-age and parental-consent framework is clear and GDPR-aligned; minor-specific profiling bans and dependent-adult protections beyond general GDPR safeguards were not evidenced in this pass.

#### Sub-modules (5)

#### Age VerificationAmber

AEPD's technical note on 'safe internet by default' for children stresses that age verification alone is insufficient and must be designed to meet all GDPR principles while avoiding new risks (e.g. enabling minors to be located).

Claims (1):

- AEPD's technical note on a safe internet by default states that age verification, per se, is not sufficient and must be designed and implemented consistently with all GDPR principles while avoiding new risks such as enabling minors' location to be tracked.

#### Parental ConsentGreen

LOPDGDD Art 7 requires express consent, given by parents/guardians for children under fourteen; those fourteen and above may consent themselves absent a specific rule requiring parental assistance.

Claims (1):

- LOPDGDD Art 7 provides that processing of a minor's data may be based on the minor's own consent from age fourteen; below that age, parental or guardian consent is required, and consent must in all cases be express.

#### Minor Profiling BansAmber

No explicit Spain-specific ban on profiling of minors beyond GDPR's general recitals/Art 22 objection right was identified in this research pass.

Absence provenance: unavailable . Searched: AEPD prohibicion perfilado menores.

#### Education SettingsGreen

Schools must designate a DPD when GDPR Art 37 criteria apply and, in all cases, when offering teaching at any level under regulating legislation; online classes/exams in regulated education are legitimised without requiring separate consent.

Claims (1):

- Educational institutions are obliged to designate a DPD in the cases covered by GDPR Art 37 and, in all cases, when they offer teaching at any level established under regulating legislation; online classes/exams delivered as part of regulated education do not require separate student/parental consent.

#### Dependent AdultsAmber

No ES-specific dependent-adult (elderly/mentally incapacitated) data-protection instrument beyond general GDPR safeguards was identified in this research pass.

Absence provenance: unavailable . Searched: AEPD proteccion datos personas dependientes mayores.

Category narrative 50 words

LOPDGDD sets the digital age of consent at fourteen, among the lowest permitted under GDPR Art 8's 13-16 range. AEPD publishes extensive guidance on age verification/age-appropriate design ('tudecideseninternet.es'), mandatory DPO designation for schools and youth-data-processing sports federations, and lawful processing of minors' data in regulated education without requiring separate consent.

Evidence 2

Sources and claims (2)
- Probable[Agencia Española de Protección de Datos](https://www.aepd.es/guides/technical-note-safe-internet-by-default-for-children.pdf) — AEPD's technical note on a safe internet by default states that age verification, per se, is not sufficient and must be designed and implemented consistently with all GDPR principles while avoiding new risks such as enabling minors' location to be tracked.observed 2026-08-03
- Confirmed[Agencia Española de Protección de Datos](https://www.aepd.es/preguntas-frecuentes/10-menores-y-educacion) — LOPDGDD Art 7 provides that processing of a minor's data may be based on the minor's own consent from age fourteen; below that age, parental or guardian consent is required, and consent must in all cases be express.observed 2026-08-03