Gdpr Parental Consent

Consent Record Requirements

Every parental consent must be documented with the following fields to satisfy Art. 7(1) demonstration obligation:

BrightPath Learning Inc. — Implementation Example

BrightPath Learning Inc. operates an educational gaming platform targeting children aged 8-15 across the EU. The platform is available in France (threshold: 15), Germany (threshold: 16), Spain (threshold: 14), and Belgium (threshold: 13).

Implementation Steps

Step 1: Age Collection (Neutral Design)

• During account creation, the platform asks "What year were you born?" using a scrollable date selector (not a free-text field)
• The age prompt does not indicate why the question is asked or what the "correct" answer would be
• The platform calculates age based on the response and applies the threshold of the child's country of residence

Step 2: Threshold Routing

• Child in France aged 14 → Below threshold (15). Parental consent required.
• Child in Belgium aged 14 → Above threshold (13). Child can consent independently.
• Child in Germany aged 15 → Below threshold (16). Parental consent required.

Step 3: Parental Verification Flow

• Child enters parent's email address
• Platform sends verification email to parent with one-time link
• Parent clicks link, creates a parental oversight account
• Parent verifies identity via credit card micro-transaction (EUR 0.50 refunded within 48 hours)
• Parent reviews and approves specific processing purposes
• Parent receives confirmation with link to parental dashboard

Step 4: Ongoing Parental Oversight

• Parental dashboard displays all active consents with per-purpose granularity
• Parent can withdraw consent for any purpose at any time
• Platform sends annual consent renewal reminder
• When child reaches the applicable age threshold, the platform notifies both parent and child, and transitions consent authority to the child

Consent Record Example

{
  "consent_id": "PC-2026-0003891",
  "child_identifier": "child_bp_8f3a2d",
  "child_age_at_consent": 12,
  "applicable_threshold": 15,
  "applicable_country": "FR",
  "parent_identifier": "parent_bp_c7e4f1",
  "verification_method": "credit_card_micro_transaction",
  "verification_outcome": "verified",
  "verification_timestamp": "2026-03-14T14:22:00Z",
  "purposes": [
    {
      "purpose_id": "edu_content_delivery",
      "description": "Deliver educational gaming content appropriate to child's learning level",
      "consented": true
    },
    {
      "purpose_id": "progress_tracking",
      "description": "Track learning progress and generate reports for parent",
      "consented": true
    },
    {
      "purpose_id": "personalized_recommendations",
      "description": "Recommend games based on learning progress and preferences",
      "consented": false
    }
  ],
  "data_categories": ["name", "age", "learning_progress", "game_interactions"],
  "consent_text_version": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
  "timestamp": "2026-03-14T14:25:00Z",
  "withdrawal_mechanism": "parental_dashboard",
  "expiry_date": "2027-03-14",
  "controller": "BrightPath Learning Inc.",
  "controller_address": "200 Education Lane, Amsterdam, 1012 AB, Netherlands"
}

Enforcement Precedents

• TikTok (DPC Ireland, 2023): EUR 345 million fine for violations including failure to implement adequate parental consent mechanisms for children under 13, default public profiles for child accounts, and transparency failures under Articles 5(1)(a), 5(1)(c), 12, 13, 24, and 25.
• Instagram (DPC Ireland, 2022): EUR 405 million fine for allowing children aged 13-17 to operate business accounts with public-by-default settings, exposing children's contact information. Related to inadequate implementation of Art. 8 and Art. 25 obligations.
• Google/YouTube (FTC, 2019): USD 170 million settlement for collecting children's personal information (persistent identifiers) to serve targeted advertising without obtaining verifiable parental consent, violating COPPA.
• Fortnite/Epic Games (FTC, 2022): USD 275 million settlement for collecting personal information from children under 13 without parental notification or consent, and enabling real-time voice and text communications with strangers by default.
• CNIL France — TIKTOK (2022): EUR 5 million fine for making it difficult to refuse cookies on the platform, with aggravating consideration of the large number of child users.

Common Compliance Failures

1. Single age threshold for all EU operations: Controller applies one threshold (e.g., 16) across all Member States instead of the locally applicable threshold based on the child's country of residence
2. Self-declaration only: Relying solely on the child's statement of age without any verification mechanism
3. No parental verification: Collecting parent's email but not verifying that the email holder actually has parental responsibility
4. Consent bundling: Obtaining parental consent for all processing purposes in a single checkbox instead of granular per-purpose consent
5. No consent expiry: Failing to periodically refresh parental consent or transition authority when the child reaches the applicable threshold
6. Cookie walls for children: Denying access to the service unless all cookies (including analytics and advertising) are accepted

Integration Points

• Age Verification Methods: Art. 8(2) requires reasonable efforts to verify age before determining whether parental consent is needed
• Children's Privacy Notice: Art. 12 transparency obligation requires clear communication to both parent and child
• Children's Data Minimisation: Art. 5(1)(c) data minimisation is interpreted strictly when processing children's data per Recital 38
• UK AADC Implementation: The UK Age Appropriate Design Code supplements UK GDPR Art. 8 with 15 design standards
• COPPA Compliance: For services also targeting US children under 13, COPPA requirements run in parallel with GDPR Art. 8