Recital 38
General Data Protection Regulation · UE 2016/679
| (38) | Children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and their rights in relation to the processing of personal data. Such specific protection should, in particular, apply to the use of personal data of children for the purposes of marketing or creating personality or user profiles and the collection of personal data with regard to children when using services offered directly to a child. The consent of the holder of parental responsibility should not be necessary in the context of preventive or counselling services offered directly to a child. |
In Luxembourg, the digital age of consent for minors is set at 16 years by the law of 1 August 2018 on the organisation of the CNPD, unlike France which lowered it to 15. Below 16, consent must be given or authorised by the holder of parental responsibility, and the CNPD expects a real verification mechanism (email to parent with validation link, symbolic payment via parental card, parental ID document).
Luxgap practice: if you operate a consumer service from Luxembourg with simultaneous FR, BE, DE users, configure Luxgap Minor Shield to apply the highest threshold detected by geolocation (16 LU/DE, 15 FR, 13 BE) to avoid an interface patchwork and guarantee multi-jurisdictional compliance in a single rule.
