The rule.
“the processing of the personal data of a child shall be lawful where the child is at least 16 years old”
Verbatim extract, read on 4 November 2026 from the source below. Everything else on this page is NorthPoint’s plain-English reading.
What it requires.
- Consent is valid at 16 or over. Below 16, processing is lawful only if consent is given or authorised by the holder of parental responsibility.
- Member States may set a lower age by law, not below 13 — so the threshold depends on the country.
Who it applies to.
Controllers relying on consent for information society services offered directly to children — games, apps, social features, youth-facing finance and crypto education products.
Common violations in marketing copy.
Youth-focused app collecting marketing consent with no age question
No way to know whether the consent is valid.
A single 13+ rule applied in every EU country
The default is 16; only national law lowers it.
Non-compliant vs compliant.
“Sign up at any age and get our weekly tips.”
“How old are you? (Under [national age]: we'll ask a parent or guardian to confirm before sending you anything.)”
Related rules.
-
GDPR Article 4(11) · European Union
-
GDPR Article 6(1)(a) · European Union
-
GDPR Article 7(4) · European Union
-
GDPR (Regulation (EU) 2016/679) and the ePrivacy Directive 2002/58/EC.
Source.
| Instrument | Regulation (EU) 2016/679 (General Data Protection Regulation) |
|---|---|
| Provision | GDPR Article 8(1) |
| Primary source | https://www.legislation.gov.uk/eur/2016/679/article/8/adopted |
| Official text | https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng |
| Read from | legislation.gov.uk's as-adopted copy of the Official Journal text (/eur/2016/679/article/N/adopted) |
| Checked |
This page is general, sourced information for marketing teams, not legal advice. The examples are written by NorthPoint to illustrate the rule; for a binding view on your own promotion, retain qualified counsel in the jurisdiction concerned.