[Access official publication on EDPB Website]
<aside> đĄ
Context & Purpose
Key Principles
Implementation Requirements
Adopted on 11 February 2025
The European Data Protection Board has adopted the following statement:
The European regulatory framework calls for the increased protection of children in the digital environment. For example, the Audiovisual Media Services Directive, which Member States have transposed into their national laws, highlights the possibility to implement age verification measures (Articles 6a and 28b), the GDPR introduces minimum age requirements for consenting to the processing of personal data in the context of information society services (Article 8), the Digital Services Act references age verification as a risk mitigation measure (Article 35(1)), and a number of Member States have implemented minimum age requirements for performing legal acts, exercising certain rights or accessing certain goods and services into their own national
In addition, different national and European initiatives, such as Better Internet for Kids (BIK+), identify age assurance as one solution to improve childrenâs well-being online through a safe, age-appropriate digital environment in line with the European Digital Rights and Principles.
Based on the definition provided in the research report Mapping age assurance typologies and requirements, this document will use âage assuranceâ as âthe umbrella term for the methods that are used to determine the age or age range of an individual to varying levels of confidence or certaintyâ. The same report mentions three primary categories of age assurance: age estimation, age verification and self-declaration.
Age assurance poses specific risks to data protection with the potential to adversely impact not only natural personsâ right to the protection of their personal data, but also other rights and freedoms such as the right to non-discrimination, the right to the integrity of the person, the right to liberty and security, and the right to free expression and
In recognition of the importance of a consistent approach at EU level on the topic of age assurance, the EDPB wishes to provide specific guidance and high-level principles stemming from the GDPR that should be taken in consideration when personal data is processed in the context of age
The proposed principles seek to reconcile the protection of children and the protection of personal data in the context of age
Priority has been given to address the requirements concerning the main principles stated in Article 5 GDPR (lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, confidentiality, integrity, and accountability), and to ensure these data protection principles are properly implemented and remain robust over time, as set out under Article 25 GDPR âData protection by design and by defaultâ and Article 32 GDPR âSecurity of processingâ.
This statement is focused on the principles applicable to different online use cases, including when a minimum age is prescribed by law or otherwise for buying products, for using services that may harm children or for performing legal acts; and when there is a duty of care to protect children (for example, to ensure that services are designed or offered in an age- appropriate way).
The EDPB may also consider issuing â whenever relevant and in other documents â additional guidance on specific use
Age assurance must respect the full complement of natural personsâ fundamental rights and freedoms, and the best interests of the child should be a primary consideration for all parties involved in the
When implementing age assurance, service providers should ensure that they consider not only the impact on the right to the protection of personal data, but on all fundamental rights of natural
In the specific case of children, the best interests of the child should be a primary consideration for all parties involved in age It is important to note that there is no hierarchy in considering the best interests of the child, and regard should be had for all childrenâs rights including their right to the protection of personal data, to protection from violence and all other forms of exploitation to access information from a variety of sources and to have their views given due weight.
Age assurance should always be implemented in a risk-based and proportionate manner that is compatible with natural personsâ rights and freedoms.
Service providers should adopt a risk-based approach when designing and operating their services. The necessity and proportionality of using safety measures such as age assurance should be demonstrated, taking into account the associated risks. The necessity could be demonstrated by conducting an assessment to identify and evaluate the risks that a particular service poses for children, such as exposure to harmful contact or As part of this assessment, service providers may also consider the rights of children, the opportunities provided by the digital environment, the views of the children as well as their evolving capacities in order to ensure age-appropriate participation.
Service providers must also respect their usersâ rights and freedoms, including the right to the protection of their personal data, balancing these with the need for safety measures which should always be the least intrusive of those available and which should always be effective. In many cases, age assurance poses a high risk to the rights and freedoms of data subjects, which would therefore require that a Data Protection Impact Assessment (âDPIAâ, Article 35 GDPR) be conducted before processing, taking into account the nature, scope, context and purposes of the The DPIA should include a systematic description of the envisaged processing operations and the purposes of the processing, including, where applicable, the legitimate interest pursued by the controller. It should also contain an assessment of the necessity and proportionality of the processing, identify risks arising from processing personal data for the purpose of age assurance and contain measures to mitigate those risks.
The DPIA should guide the design and implementation of appropriate technical and organisational measures for data protection compliance. This risk-based approach is crucial when balancing the potential interference with natural personsâ rights and freedoms against the intended objective in this particular context, namely childrenâs safety. The scope, extent, and intensity of this interference in terms of impact on rights and freedoms must always be carefully assessed. For example, a service provider processing personal data to check the age of all their users when accessing all their content or services, even when the content or services are suitable for all audiences and devoid of any risk, would not pass the necessity and proportionality tests.