A child asking to open a social media profile, a game app asking for a date of birth, a school platform collecting pupils' data: children's presence online raises practical questions for parents, teachers and young people themselves. European and Italian law provide precise answers worth knowing.
The age of digital consent
Article 8 of Regulation (EU) 2016/679 concerns information society services offered directly to children, meaning social networks, apps, online games and video platforms. When processing is based on consent, a child can give it alone only from a certain age; below that age, consent or authorisation from the holder of parental responsibility is required.
The GDPR sets this threshold at 16 but allows Member States to lower it to as little as 13. Italy has set it at 14 through Article 2-quinquies of the Personal Data Protection Code. The same article requires information addressed to minors to be written in particularly clear and simple language that they can understand.
What this means in practice
- Under 14, a service relying on consent must obtain the parent's consent and make reasonable efforts to verify it, taking available technology into account.
- From 14, the young person can give consent alone for these services.
- Platforms' terms of use may set their own minimum ages, often different: these are contractual rules of the service that apply on top of the legal ones.
The age-14 threshold concerns consent to data processing, not the general capacity to enter into contracts, which is still governed by civil law.
Stronger safeguards for children
The GDPR recognises at several points that children deserve specific protection, because they may be less aware of the risks.
- Erasure. Article 17 lists among the grounds for erasure the fact that data was collected in connection with services offered to children. Someone who created a profile as a teenager can ask for it to be deleted as an adult too.
- Advertising. The Digital Services Act, Regulation (EU) 2022/2065, in Article 28 prohibits online platforms from showing advertising based on profiling when they are aware with reasonable certainty that the user is a minor, and requires appropriate measures to ensure a high level of privacy, safety and security for minors.
Cyberbullying
In Italy, Law no. 71 of 29 May 2017 allows a minor aged 14 or over, or a parent, to ask the operator of a website or social network to hide, remove or block content about them spread for the purpose of cyberbullying. If the operator does not act within the required time, they can turn to the Italian data protection authority.
The parents' role
Before signing up
| Question | Why it matters |
|---|---|
| Is the service suitable for the age? | Terms of use often set minimum thresholds |
| Can the profile be private? | It reduces contact with strangers |
| Who can send messages? | It is the main channel for unwanted contact |
| Are supervision tools available? | Many platforms offer linked family accounts |
| What does the privacy notice say about minors? | It sets out specific limits and safeguards |
Practical tools
- Family accounts on mobile operating systems: they let you approve apps before installation, limit screen time and filter content.
- Profile settings: private account, messages only from approved contacts, location turned off in posts.
- Conversation: no setting replaces explaining why you do not share your address, school, schedule or swimsuit photos with strangers.
Children's privacy starts with parents
Much of the information about children online is not posted by them but by adults. First-day-of-school photos with the school's name visible, birthday videos, anecdotes about health: added up over the years, they build a detailed portrait of a person who had no say.
A few simple precautions:
- avoid posting details that reveal places visited regularly;
- share photos in small groups rather than on public profiles;
- ask your children's opinion, once they are old enough, before posting something about them;
- remember that a person's image is also protected under Italian law by Article 10 of the Civil Code, which concerns misuse of another's image.
At school and in sports activities
Schools, sports clubs and summer camps process a lot of children's data. You are entitled to a clear privacy notice and can exercise the rights of access, rectification and objection just as for your own data. Publishing group photos on these organisations' websites or social profiles requires an appropriate legal basis, usually parental consent.
In short
- In Italy a minor can consent alone to online services from age 14, under Article 2-quinquies of the Privacy Code.
- Below that threshold parental consent is required, and the service must try to verify it.
- The Digital Services Act bans profiled advertising aimed at minors on online platforms.
- Data collected while someone was a minor can be erased even in adulthood.
- Protecting children's privacy starts with what parents post.