GDPR Art. 8 EN
LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this article. Contains: the article text, related recitals, cases citing it, enforcement stats and top fines, guidance, and related topics. Everything links back to its source on overview.legal — legal information, not advice.

Conditions applicable to child's consent in relation to information society services

Child Consent Minors Consent
In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗
Version history 2
  • 2016-05-04in force CELEX 02016R0679-20160504
  • 2016-04-27 CELEX 32016R0679
  1. 1.

    Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.

    Child Consent Consent Personal Data 212
    1. Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.
  2. 2.

    The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology.

    Consent Controllers 160
  3. 3.

    Paragraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child.

    39

Enforcement

Cited in 9 fines totalling €20.2M

Top authority: 🇪🇺Icelandic data protection authority ('Persónuvernd') (3) · median fine €51,000 · see all enforcement for Art. 8 →

Connections by provision

8(1) 154 Case Law 29 Enforcement 26 Guidance 3 Literature .md
Case Law 154
European Commission v Republic of Poland European Commission v Republic of Poland CJEU - C-205/21 - Ministerstvo na vatreshnite raboti European Commission v Republic of Poland European Commission v Hungary Criminal proceedings against Unknown individuals Criminal proceedings against HYA and Others ND v DR +146 more
Enforcement 29
Online Services: Insufficient fulfilment of information obligations Persónuvernd (Iceland) - 2025010364 Icelandic DPA opens formal proceedings against Isavia over ANPR parking cameras at Persónuvernd: Icelandic Farmers’ Association breached GDPR by disclosing owner data to Slovenian DPA: Controller breached Art. 32, 15 and 34 GDPR over data breach and access Icelandic DPA: City of Reykjavik cannot request bank statements from NPA disabled service Website providing legal information: Insufficient fulfilment of information obligations ¶155 Slovenian DPA: Controller breached Art. 32, 15 and 34 GDPR over data breach and access +21 more
Guidance 26
Guidelines 02/2021 on virtual voice assistants Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation Opinion 39/2021 on whether Article 58(2)(g) GDPR could serve as a legal basis for a supervisory authority to order ex officio the erasure of personal data, in a situation where such request was not submitted by the data subject Opinion 07/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the European Patent Organisation Opinion 3/2025 on the draft decision of the French Supervisory Authority (FR SA) regarding the “Lexing GDPR certification criteria” Guidelines 3/2018 on the territorial scope of the GDPR (Article 3) Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement Guidelines 05/2020 on consent under Regulation 2016/679 +18 more
Literature 3
Tracking Walls, Take-It-Or-Leave-It Choices, the GDPR, and the ePrivacy Regulation If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation General Data Protection Regulation (GDPR) – Revolution Coming to European Data Protection Laws in 2018. What’s New for Ordinary Citizens?
8(2) 109 Case Law 4 Enforcement 45 Guidance 1 Literature 1 News .md
Case Law 109
CJEU - C‑769/22 - European Commission v Hungary European Commission v Hungary Lisa Ballmann v European Data Protection Board OVG Saarlouis - 2 A 165/24 CJEU - C-247/23 - Deldits VG Munich: university may be GDPR controller for professors' editorial work emails RL v Landeshauptstadt Wiesbaden Norges Høyesterett - 2019-1226-A +101 more
Enforcement 4
Slovenian DPA: Controller breached Art. 32, 15 and 34 GDPR over data breach and access Persónuvernd (Iceland) - 2025010364 ¶21 Persónuvernd (Iceland) - 2025010364 ¶142 Slovenian DPA: Controller breached Art. 32, 15 and 34 GDPR over data breach and access
Guidance 45
EDPB-EDPS Joint Opinion 01/2023 on the Proposal for a Regulation of the European Parliament and of the Council laying down additional procedural rules relating to the enforcement of Regulation (EU) 2016/679 Opinion 07/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the European Patent Organisation Coordinated Enforcement Action, implementation of the right of access by controllers Guidelines 10/2020 on restrictions under Article 23 GDPR Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision Recommendations 02/2020 on the European Essential Guarantees for surveillance measures EDPB-EDPS Joint Opinion 04/2021 on the Proposal for a Regulation of the European Parliament and of the Council on a framework for the issuance, verification and acceptance of interoperable certificates on vaccination, testing and recovery Statement 02/2021 on new draft provisions of the second additional protocol to the Council of Europe Convention on Cybercrime (Budapest Convention) +37 more
Literature 1
General Data Protection Regulation (GDPR) – Revolution Coming to European Data Protection Laws in 2018. What’s New for Ordinary Citizens?
News 1
Netflix, Spotify & YouTube: Eight Strategic Complaints filed on “Right to Access”
8(3) 21 Case Law 18 Guidance .md
Case Law 21
Tele2 Sverige AB v Post- och telestyrelsen and Secretary of State for the Home Department v Tom Watson and Others UF and AB v Land Hessen A. G. v Lietuvos Respublikos generalinė prokuratūra High Court examines DPA inquiry into Meta's refusal of raw data access and portability CJEU - C-362/14 - Schrems I KPN BV v Autoriteit Consument en Markt (ACM) Data Protection Commissioner v. Facebook Ireland Ltd, and Maximillian Schrems Verein für Konsumenteninformation v Amazon EU Sàrl +13 more
Guidance 18
Opinion 2/2026 on the Proposal for a Directive amending Directives (EU) 2016/2341 and 2016/97 as regards the strengthening of the framework for occupational retirement provision Guidelines 3/2025 on the interplay between the DSA and the GDPR EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework ( Guidelines 02/2022 on the application of Article 60 GDPR EDPB-EDPS Joint Opinion 03/2022 on the Proposal for a Regulation on the European Health Data Space Opinion 07/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the European Patent Organisation EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) ¶139 EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework ( +10 more

Related across sources

C-136/17 GC and Others v CNIL C-136/17 (GC and Others) CJEU Sep 24, 2019 Right to be Forgotten Legitimate Interest Criminal Data
C-507/17 Google LLC v CNIL C-507/17 (Google Territorial Scope) CJEU Sep 24, 2019 Territorial scope (GDPR) Right to be Forgotten Direct Marketing
Guidelines 05/2020 consent under Regulation 2016/679 Guidelines on consent Guidelines ·EDPB May 4, 2020 Consent Data Portability Personal Data
Guidelines 2/2019 processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects 1 Adopted Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects Version 2.0 8 October… Guidelines ·EDPB Oct 16, 2019 Personal Data Processing Child Consent
C-769/22 European Commission v Hungary The Court of Justice of the European Union (Full Court) ruled on whether Hungary's national legislation restricting content related to gender identity, gender reassignment, and… CJEU ·Full Court Apr 21, 2026 Child Consent Criminal Data Minors
C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… CJEU ·Fifth Chamber May 4, 2023 Right to Restriction Right to be Forgotten Personal Data