Regulation (EU) 2016/679 as retained in UK law (UK GDPR) – Article 8 – Conditions applicable to child's consent in relation to information society services
Articles
Article 8Conditions applicable to child's consent in relation to information society services
1. Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least [F113 years old]. Where the child is below the age [F2of 13 years], such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.
F3...
2. The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology.
2A. [F4 The Secretary of State may by regulations—
- (a)amend paragraph 1 so as to change the age for the time being specified in that paragraph (but not to an age lower than 13 years or higher than 16 years);
- (b)make provision in relation to services specified, or of a description specified, in the regulations for a different age to apply for the purposes of paragraph 1 (but not lower than 13 years or higher than 16 years).
3. Paragraph 1 shall not affect the general contract law [F5as it operates in domestic law] such as the rules on the validity, formation or effect of a contract in relation to a child.
4. [F6 In paragraph 1, the reference to information society services does not include preventive or counselling services.]
Annotations and footnotes
Textual Amendments
- F1 Words in Art. 8(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 8(2)(a) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
- F2 Words in Art. 8(1) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 8(2)(b) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
- F3 Words in Art. 8(1) omitted (31.12.2020) by virtue of The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 8(2)(c) (with reg. 5, Sch. 1 para. 80); 2020 c. 1, Sch. 5 para. 1(1)
- F4 Art. 8(2A)(2B) inserted (29.4.2026) by Children’s Wellbeing and Schools Act 2026 (c. 21), ss. 72(2), 78(1)(b)
- F5 Words in Art. 8(3) substituted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 8(3) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
- F6 Art. 8(4) inserted (31.12.2020) by The Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (S.I. 2019/419), reg. 1(2), Sch. 1 para. 8(4) (with reg. 5); 2020 c. 1, Sch. 5 para. 1(1)
https://uk-gdpr.digiphile.law/article/article-8.html
Text as at 17 September 2026.
This is an unofficial convenience version of the UK GDPR (Regulation (EU) 2016/679 as retained in UK law). It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.