Apps and services used by children

• Regulation (EU) 2016/679 — GDPR, Articles 8 and 27
• Regulation (EU) 2022/2065 — DSA, Article 28
• Regulation (EU) 2024/1689 — AI Act prohibitions
• Directive 2010/13/EU for audiovisual services

Who has to appoint one

Providers outside the Union whose services are used by children in the EU, whether or not children are the intended audience. The test authorities apply is whether the service is likely to be accessed by children, not whether the terms say it is for adults.

Thresholds and exemptions

The age of digital consent varies between 13 and 16 by member state, so a single threshold does not work across the Union. Below it, parental authorisation is required for consent-based processing.

What must appear on the label

Not physical. Privacy information written so a child can understand it, clear age gating, and the representative's identity in the notice.

Marketplace fields

App stores enforce age ratings and data-safety declarations, and the DSA prohibits advertising based on profiling to minors on platforms, which has forced design changes across the sector.

Documentation you must hold

Article 30 records, the Article 27 designation, a data protection impact assessment addressing children specifically, age assurance documentation proportionate to the risk, parental consent records where required, and default settings documentation showing high privacy by default.

Standards and testing

Age assurance methods must be assessed for accuracy and proportionality, and any system inferring age from behaviour or biometrics raises AI Act questions of its own.

Language requirements

Child-facing information in the language of the children concerned and at an appropriate reading level, which Article 12 requires explicitly.

When it applies

Before the service is available to children in the Union. DSA Article 28 obligations since February 2024.

How long records are kept

Minimised throughout, with profiles deleted when the account closes. Retaining behavioural data about children for future marketing has no defensible basis.

What happens if you do not comply

Up to €20 million or 4% of turnover, and this is the area where authorities have imposed some of the largest fines. DSA penalties up to 6% apply separately for platforms failing to protect minors.

Who enforces it

Data protection authorities, Digital Services Coordinators, and audiovisual regulators for video services.

Where the boundary lies

Profiling minors for advertising is prohibited on platforms under the DSA, and emotion inference and manipulative design exploiting age-related vulnerability are prohibited under the AI Act. Design choices that were merely questionable are now unlawful.

Questions we are asked

Our terms say users must be 18 — is that enough?

No. If the service is likely to be accessed by children, the obligations apply regardless of the terms, and authorities look at the actual audience.

What age is the threshold?

It varies by member state between 13 and 16 for consent-based processing, so a service across the Union must handle the highest applicable threshold per country.