Children’s Data Protection Under GDPR and the UK Code

Last updated: 30 October 2026

Quick answer: Children’s data protection under the GDPR means giving children specific protection, getting parental consent below the national age of digital consent (16 by default, 13 at the lowest) when relying on consent for online services, and explaining processing in child-friendly language. In the UK, the age is 13 and the Children’s Code sets 15 design standards.

Children’s data is now one of the most actively enforced areas of privacy law. In 2026 the UK Information Commissioner’s Office fined Reddit £14.47 million, new UK statutory duties on children’s protection came into force, and EU regulators continued to tighten expectations on age assurance and default settings.

This guide is for DPOs and privacy teams at organisations whose apps, games, websites or connected products may be used by children in the EU or UK. It covers GDPR Article 8, the UK Children’s Code, recent enforcement and a practical compliance checklist.

What does children’s data protection require under the GDPR?

The GDPR treats children as needing extra care rather than setting a separate regime. Recital 38 says children merit specific protection because they may be less aware of the risks, consequences, safeguards and their rights in relation to processing.

That principle shows up in several places in the GDPR text on EUR-Lex:

• Article 8: conditions for a child’s consent to information society services.
• Article 12(1): information must be concise, transparent, intelligible and in clear and plain language, in particular for any information addressed specifically to a child.
• Article 6(1)(f): legitimate interests can be overridden by the data subject’s interests or rights, in particular where the data subject is a child.
• Article 17(1)(f): a right to erasure for data collected in relation to information society services offered to a child.
• Article 35: data protection impact assessments for high-risk processing, which supervisory authorities often expect where services target or attract children.

Our GDPR compliance overview covers the wider obligations these articles sit within.

What does GDPR Article 8 actually say?

Article 8 applies only when you rely on consent under Article 6(1)(a) to offer an information society service directly to a child. In that case, processing is lawful if the child is at least 16. Below 16, consent must be given or authorised by the holder of parental responsibility.

Member States may set a lower age by law, but not below 13. As a result, the age of digital consent varies between 13 and 16 across the EU, so services offered in several countries need to check the national rule in each one.

Article 8(2) adds that the controller must make reasonable efforts to verify that consent is given or authorised by the parent, taking into account available technology. Article 8(3) confirms that Article 8 does not affect general contract law, such as rules on the validity of a contract with a child.

Common mistake: Assuming Article 8 means you always need parental consent for children. It applies only where consent is your lawful basis for an online service offered directly to a child. If you rely on another basis, such as contract or legitimate interests, Article 8 does not apply, but you still need to assess the child’s interests carefully.

How does the UK approach children’s data?

The UK keeps the same structure under the UK GDPR but sets the age of digital consent at 13. According to ICO guidance on information society services and consent, children aged 13 or over can consent for themselves, and section 9 of the Data Protection Act 2018 excludes online preventive or counselling services from the parental consent requirement.

The ICO also says what counts as “reasonable efforts” to verify parental consent depends on risk. A simple declaration may be enough for a low-risk newsletter, while higher-risk features such as unmoderated chat call for stronger checks.

The Children’s Code

The Age Appropriate Design Code, known as the Children’s Code, applies to information society services likely to be accessed by children under 18 in the UK, not only services aimed at them. It has been fully enforceable since September 2021 and sets 15 standards:

The ICO’s Children’s Code expects high-privacy default settings, geolocation off by default, minimal data collection and no nudge techniques that push children to weaken their privacy.

What changed for children’s data in the UK in 2026?

Two things: a new statutory duty and major enforcement.

Section 81 of the Data (Use and Access) Act 2025 came into force on 5 February 2026. It amends Article 25 of the UK GDPR so that providers of information society services likely to be accessed by children must take into account “children’s higher protection matters” when designing data protection by design and default. Those matters include how children can best be protected and supported when using the service, and the fact that children have different needs at different ages and stages of development.

Enforcement followed quickly. On 24 February 2026 the ICO announced a £14.47 million fine against Reddit. The ICO found Reddit applied no robust age assurance before July 2025 and so lacked a lawful basis for processing the data of children under 13, and had not carried out a DPIA on risks to children before January 2025. The ICO also told Reddit that relying on self-declared ages is easy to bypass. Reddit appealed on 1 April 2026. Earlier the same month, the ICO fined Imgur’s owner MediaLab £247,590.

The ICO’s August 2026 progress update on its children’s code strategy lists social media and video sharing platforms, mobile games, age assurance and location sharing among its focus areas.

What is the EU doing on children’s data?

EU regulators are working on three fronts: GDPR enforcement, the Digital Services Act and age assurance.

• GDPR enforcement: in September 2023 the Irish Data Protection Commission announced a €345 million fine against TikTok over public-by-default settings for child accounts, its Family Pairing feature, transparency failures and design practices found to breach the fairness principle.
• Digital Services Act: on 14 July 2025 the European Commission published guidelines on the protection of minors under Article 28 of the DSA, recommending private-by-default accounts for minors, safer recommender systems and effective age assurance.
• EDPB: in February 2025 the EDPB adopted a statement on age assurance setting ten principles for compliant processing, and it says it is working on guidelines on processing children’s data.

How do EU and UK rules on children’s data compare?

How should you approach age assurance?

Match the strength of age assurance to the risk of the service, and collect as little data as possible to do it. Neither the ICO nor EU regulators expect hard identity checks for every service, but both expect more than a tick box where the risks to children are high.

1. Assess the audience: use market research, analytics and complaints to decide whether children are likely to use the service, whatever your terms say.
2. Rate the risk: features such as public profiles, messaging, live streaming, location sharing and targeted advertising raise it.
3. Pick a proportionate method: self-declaration for low risk, estimation or verified age attributes for higher risk.
4. Minimise: prefer “over 13: yes or no” attributes to storing identity documents.
5. Record the decision in a DPIA and review it when features change.

In practice: The Reddit decision shows the risk of relying on terms of service. If your terms ban under-13s but your data suggests they use the service anyway, regulators will judge you on the reality.

Keeping DPIAs, processing records and design decisions linked makes this far easier to evidence. Enactia’s AI-powered GRC platform connects DPIAs, records of processing and GDPR and UK GDPR requirements in one place. To try it on your own services, start your 14-day free trial.

Children’s data protection checklist for DPOs

• Decide whether children are likely to access each service, and document the evidence.
• Confirm the lawful basis for each processing activity involving children, and where consent is used, apply the correct national age.
• Run a DPIA covering risks to children, following our DPIA guide and using a structured DPIA workflow.
• Set high-privacy defaults: private profiles, geolocation off, profiling and targeted advertising off unless there is a compelling reason.
• Write child-friendly privacy information and just-in-time notices for each age range.
• Remove nudge techniques that encourage children to share more data or weaken settings.
• Implement proportionate age assurance and parental consent verification.
• Flag children’s data in your record of processing activities.
• Make it easy for children and parents to exercise rights, including erasure, through your data subject request process.
• Review suppliers, SDKs and advertising partners that receive children’s data.

Key takeaways

• Children’s data protection is built into the GDPR through Recital 38 and Articles 6, 8, 12, 17, 25 and 35.
• Article 8 sets 16 as the default age of digital consent, with Member States able to lower it to 13; the UK uses 13.
• The UK Children’s Code’s 15 standards apply to services likely to be accessed by under-18s, not only children’s services.
• Since 5 February 2026, UK services likely to be accessed by children must consider children’s higher protection matters by design.
• Regulators judge real usage, so proportionate age assurance and a DPIA are essential.

Frequently asked questions

What is the age of digital consent under the GDPR?
The default is 16 under Article 8. Member States can lower it by law to any age not below 13, so it ranges from 13 to 16 across the EU. The UK sets it at 13. The age only matters where you rely on consent to offer an information society service directly to a child.

Does the UK Children’s Code apply if my service is not aimed at children?
It can. The Code applies to information society services likely to be accessed by children under 18 in the UK, even if children are not the intended audience. Use evidence such as user research, analytics and the nature of your content to decide, and document the outcome and your reasoning.

Do we need a DPIA for processing children’s data?
Very often, yes. The Children’s Code makes a DPIA one of its 15 standards for in-scope services, and the ICO’s Reddit decision criticised the lack of a DPIA on risks to children. In the EU, processing children’s data at scale or with profiling is commonly treated as high risk under Article 35.

How do we verify parental consent?
Article 8(2) requires reasonable efforts, taking available technology into account. What is reasonable depends on risk: a declaration may suit a low-risk service, while higher-risk features call for stronger checks. Prefer privacy-friendly methods that confirm age or parental status without collecting unnecessary identity documents.

What are children’s higher protection matters in the UK?
They were added to Article 25 of the UK GDPR by section 81 of the Data (Use and Access) Act 2025, in force since 5 February 2026. Providers of services likely to be accessed by children must consider how children can best be protected and supported, and that their needs differ by age and development stage.

Putting children’s interests first

Children’s data protection is no longer a niche concern for toy and education companies. Any service that children realistically use needs a clear view of its audience, proportionate age assurance, high-privacy defaults and a DPIA that holds up to scrutiny. Start with the checklist above and revisit it whenever you add features.

If you want support managing DPIAs, records and rights requests across the EU and UK, contact us or book a demo or start your 14-day free trial.

This article is for general information and is not legal advice.