A child-directed online service relies on the child’s consent alone without considering age thresholds or holder-of-parental-responsibility rules. What is the compliance problem?
Select an answer to reveal the explanation.
Short Explanation
Kids’ consent is not a simple checkbox copy-pasted from adult signup flows. You have to respect the age line and when a parent or guardian must authorise. Skipping that is how child-directed consent falls apart.
Full Explanation
Information-society services offered directly to a child that rely on consent must respect applicable age thresholds and holder-of-parental-responsibility authorisation rules for consent to be valid. Relying on the child’s consent alone without considering those thresholds or parental rules risks invalid consent, unfair processing, and weak transparency toward families. Children’s data deserve heightened care in interface design and lawful-basis analysis.
Children may be data subjects under the GDPR; they are not excluded as a class. Schools are not the only entities that may collect children’s personal data in Europe. Parental-responsibility rules are not postponed until age twenty-one; Member State ages for digital consent sit within the GDPR’s framework at much lower ages.
Exam caveat: child consent for ISS ⇒ check age gating and parental authorisation rules before treating a tap as valid consent. Operational check: implement robust age-gating, parental-consent flows where required, data minimisation, child-appropriate notices, and restrictions on profiling for marketing where applicable. Civic learning and youth apps should protect minors as a public duty, documenting why “kids can just click yes” was rejected as incompatible with safeguarding and privacy law.