Children's Personal Data in 2026: GDPR, DSA and Privacy by Design

Children’s personal data requires particular care on digital platforms, games, apps, educational services and social media. A child user affects privacy information, product design, advertising, profiling and default settings.

As of 2026, protection of child data in the European Union is not limited to GDPR. The Digital Services Act (DSA) also introduces additional obligations for children's online safety and targeted advertising.

How does the GDPR protect children?

The GDPR recognizes that children's personal data deserves special protection.

This protection matters particularly in the following areas:

marketing,
profile creation,
online services,
information for the child

These areas deserve particular care.

GDPR Article 8: The Age 16 Rule

For information society services offered directly to children based on consent under Article 6(1)(a), GDPR Article 8 sets the default age threshold at 16 years.

If the child is under 16 years of age, consent must be granted or approved by the person who bears parental responsibility.

Age 16 in each EU Country?

No. Member states may lower this threshold in national law, but cannot lower it below 13 years.

Therefore, automatic implementation of a single age rule for the entire EU in multi-country digital products may not be correct.

Does Article 8 Apply to Every Data Processing?

No. Article 8 specifically concerns consent under Article 6(1)(a) for information society services offered directly to children.

It is not right to automatically reduce each process involving child data to the Article 8 age limit.

How Should Parental Consent Be Confirmed?

The GDPR requires that the data controller make reasonable efforts to verify the consent of the person carrying parental responsibility, taking into account existing technology.

It is also important that the verification mechanism does not collect too much personal data.

Privacy Information for Children

Provide clear, simple information that children can understand.

Publishing long and technical legal text alone does not provide meaningful transparency.

Additional Protection With DSA

The Digital Services Act includes product and platform obligations that go beyond the GDPR to protect children on online platforms.

Profiled-Based Targeted Advertising for Children

Under the DSA, platforms must not serve profiling-based targeted ads when they know with reasonable certainty that the user is a minor.

This rule directly affects platform models that segment advertising with child data.

Protection of Minors Guidelines

On July 14, 2025, the European Commission published a guide to protecting children under the DSA.

The guidance particularly addresses:

High privacy protection by default,
safe design,
Risks of addictive design,
unwanted contact,
harmful content

These are key areas of focus.

Privacy by Default

More protective options need to be evaluated instead of setting up the default settings of the child account at the most open sharing level possible.

Having to manually change dozens of settings to protect user privacy is not a good privacy-by-design approach.

Dark Pattern Risks

Manipulative interfaces that lead the child to share more data, relax the privacy setting, or spend more time in the service should also be evaluated.

Age Assurance

In order for children to be protected, some services may require determining the age group of the user.

Age assurance must not itself become excessive data collection.

Data Minimization

Collecting data “just in case it is needed later” creates greater risk in children’s products.

For each data field:

Why it is necessary,
How long it will be retained,
Who can access it

must be determined.

Profiling and Recommender Systems

If content recommendation systems are heavily using children's behavior to create profiles, both data protection and DSA risks can be raised.

When Does DPIA Come to the agenda?

Data protection impact assessment should be examined under the GDPR Article 35 in high-risk profiling, systematic monitoring, or similar procedures that process child data.

The need for a DPIA depends on the risks of the specific processing activity.

Child Data Checklist

Have usage scenarios been determined that the user may be a child?
Is Article 8 really implemented?
Has the age limit been checked in the country concerned?
Is there reasonable confirmation if parental consent is required?
Can privacy information be understood by the child?
Are the default account settings protective?
Has the profiling-based ad been checked?
Were DSA minors obligations assessed?
Is data minimization being implemented?
Has the need for a DPIA been assessed?

The B10 Approach

B 10 Digital Agency assesses children’s data protection beyond legal text: UX, defaults, tracking, profiling, analytics and technical data flows are examined together.

Official reference framework

This guide has been updated with regard to the GDPR Article 8, Digital Services Act's protection provisions for children, and the European Commission's Protection of Minors Guidelines document dated July 14, 2025.

Conclusion

In children's data, compliance is not just adding the correct age box. Consent, profiling, advertising, default privacy, interface design and data minimization should be evaluated together from the design stage of the product.

This content is for general information only.