Skip to content

'We Take Your Word For It' — A Review of Methods of Age Verification and Parental Consent in Digital Services

Simone van der Hof, Sanne Ouburg


The GDPR provides a high level of protection for children's personal data. This protection is reflected in various recitals and provisions in the GDPR and results in two practical challenges. First, the (implicit) need for age verification, or at least determining whether someone is not a child. This obligation would apply as soon as personal data are processed and there is no evidence to the contrary that the personal data of children are processed. Secondly, in the more specific case that consent is one of the lawful grounds, there is a need to verify that consent has been given by a parent (or guardian) when a data subject has not reached the age of digital consent. In our research, we studied whether apps popular among children have implemented adequate methods to meet both verification obligations by analysing the registration process of these apps. No apps that we investigated met the requirements of the GDPR at the time of our research. The level of assurance of age was too low or the method not privacy-friendly or inclusive. Parental consent mechanisms were generally lacking - while consent was a lawful ground in all apps we investigated. If a parent was involved in the registration process, the actual verification of that status was mostly missing.
Keywords: Data Protection | Age Verification | Parental Consent

Simone van der Hof, Full Professor of Law and Digital Technologies, Center for Law and Digital Technologies (eLaw), Leiden University, for Correspondence: <>; Sanne Ouburg, Privacy Consultant, Privacy Company. This research is funded by the EU project euCONSENT, Electronic Identification and Trust Services for Children in Europe ( We thank our project partners in the euCONSENT consortium for their wonderful cooperation. We especially thank the members of WP2 for their great support and the many extremely inspiring and helpful discussions we had with each other during the research. Special thanks go to Abhilash Nair (Aston University), Sonia Livingstone, Mariya Stoilova (both London School of Economics and Political Science), Tony van Rooij (Trimbos Institute) and Bart Schermer and Bart Custers (both Leiden University) for reviewing our research for eu CONSENT and providing valuable suggestions. This article is an adaptation of that research.


Lx-Number Search

(e.g. A | 000123 | 01)

Export Citation