Compliance with the requirements of the Office for Personal Data Protection regarding consent to the processing of personal data of minors

Children in the Digital World: Why Their Protection is Crucial for Your Business

Many companies mistakenly believe that if their services are not primarily aimed at children, strict data protection rules do not apply to them. However, this is a dangerous misconception. The key criterion introduced by modern legislation, such as the UK's Age Appropriate Design Code or the EU's Digital Services Act (DSA), is whether the service is "likely to be accessed" by minors.

This standard dramatically expands the range of companies that must actively address this issue. It applies not only to games and social networks, but also to news portals with discussion forums, e-shops with general goods, or even B2B tools that students might use for school projects. The scope of obligations is therefore much broader than it seems at first glance.

The General Data Protection Regulation (GDPR)  explicitly states that children merit specific protection because they may be less aware of the risks, consequences and their rights in relation to the processing of personal data. Their psychological vulnerability makes them more susceptible to manipulative design elements, known as "dark patterns", which can nudge them into providing more data than necessary or choosing less private settings. The long-term impacts of excessive data collection and online interactions on their development, including the risk of addiction or reduced empathy, are subjects of serious concern for both psychologists and regulators.

The fundamental legal principle arising from this situation is the lawfulness of processing. For many online services, especially those involving marketing, personalization, or community features, the only valid legal basis for processing personal data is the consent of the data subject. However, this is where a major complication arises for companies: a child's capacity to provide legally valid consent is restricted under Czech legislation. Illegally obtained consent means that all subsequent data processing is unlawful, with all the resulting consequences.

While astronomical fines attract the most media attention, reputational damage can be even more devastating for a company. Being publicly labeled as a company that neglects child protection can lead to a loss of customer trust, investor outflow, and difficulties in recruiting talented employees. 

Nowadays, with an increasing emphasis on corporate social responsibility, protecting the data of the most vulnerable users is becoming a key indicator of corporate culture and integrity. The Prague-based legal team at ARROWS helps companies not only navigate complex legislation but also understand these broader business and reputational risks, and set up processes that protect both the users and the company itself.

Age of Digital Consent: Key Sections You Need to Know

For every operator of online services, it is absolutely essential to know the exact age limit from which a minor user can independently and legally provide consent for the processing of their personal data. It is precisely at this point that general European regulations clash with national legislation, creating one of the most common traps for both international and domestic companies. Precise knowledge of local rules is the foundation of any compliance program.

At the core of the European regulation is Article 8 of the GDPR. This states that where the processing of personal data is based on consent in relation to the offer of information society services directly to a child, such processing is lawful if the child is at least 16 years old. This is the default rule applicable across the European Union. However, the regulation also allows member states to lower this limit, but not below 13 years.

The Czech Republic took advantage of this option and established its own specific age limit. The key provision here is Section 7 of Act No. 110/2019 Coll., on Personal Data Processing, which states: "A child shall acquire the capacity to grant consent to the processing of personal data in connection with the offer of information society services directly to them upon reaching the age of fifteen.".

Therefore, for all companies operating on the Czech market, the binding limit is 15 years. Applying the general 16-year limit from the GDPR in the Czech Republic is incorrect and leads to the unlawful processing of data of fifteen-year-old users.

It is important to practically define what is meant by "information society services". This term covers a wide range of online activities that are typically provided for remuneration or contain commercial communications. These typically include social networks, content-sharing platforms, online games, e-shops, streaming services, mobile apps with personalized content, or sending marketing newsletters. The age limit rule applies whenever consent is the legal basis for processing.

Conversely, if the processing is necessary for the performance of a contract (for example, a one-time purchase in an e-shop without subsequent marketing), consent is not required and these specific rules do not apply.

The legal consequence is clear: if a child is under 15 years old, their independent consent is invalid. For the processing of their personal data to be lawful, consent must be given or authorized by the holder of parental responsibility (typically a parent or legal guardian).

This 15-year limit was not set randomly. It reflects the Czech legislator's effort to align "digital consent" with other significant legal milestones in an adolescent's life, such as acquiring partial legal capacity and criminal liability. It is therefore not an arbitrary number, but a deliberate choice reflecting the Czech legal and social context, as evidenced by previous discussions on this limit.

In addition to the age limit itself, however, the broader principle of Czech civil law, which is the "mental maturity" of the child, must also be taken into account. Even though a fifteen-year-old user can already grant consent on their own, this consent must still be informed and freely given. This means that information about data processing must be presented in a language that is understandable to an adolescent, and the consent process must not be manipulative. 

This principle resonates with the European Data Protection Board's (EDPB) emphasis on transparency and the prohibition of deceptive practices. 

ARROWS therefore advises clients not only on how to meet the formal age limit, but also on how to set up the entire consent acquisition process so that it is legally defensible in terms of its quality.

How to Verify Age and Obtain Parental Consent? A Practical Guide for Your Platform

One of the greatest practical challenges that the GDPR poses to online platform operators is the obligation to make "reasonable efforts" to verify the user's age and, if applicable, the validity of parental consent. The law deliberately does not prescribe one specific method, recognizing that what is "reasonable" varies depending on the nature of the service and the risks associated with data processing. The key to a successful and defensible implementation is therefore to choose a risk-based approach.

There is no one-size-fits-all solution. The correct age verification method depends on what data you process and what you do with it. This risk-oriented approach can be divided into several levels:

Low risk:

For services that do not pose a significant risk to the rights and freedoms of children – such as content websites without registration, blogs without interactive elements, or forums with minimal data collection – a simple, neutral age-gate may be a sufficient measure. The user is asked to enter their date of birth upon entry. 

However, it is necessary to realize that this mechanism is very easily bypassed, and the European Data Protection Board (EDPB) has expressed considerable skepticism about its use in any scenarios other than low-risk ones.

Medium risk:

This includes standard e-shops, social networks with limited features, or online communities. Here, a simple declaration of age is no longer sufficient. It is necessary to use more robust methods that increase the likelihood that consent is given by an adult. 

Such methods include, for example, sending a verification email or message to the parent's phone number, making a micro-payment with a credit card (which is subsequently refunded) since it is assumed that a child does not possess their own card, or using third-party services such as mojeID or bank identity (BankID).

High risk:

If your platform processes sensitive data, performs extensive profiling for advertising purposes, allows free interaction between users, or provides content unsuitable for children (e.g., gambling, alcohol sales, dating sites), the age verification requirements are the highest. Here, it is necessary to deploy reliable and difficult-to-forge methods. This may involve verification using a valid official document (ID card, passport) where the user uploads a photo of the document, or using biometric facial analysis that estimates the user's age based on a selfie. 

Although these methods are the most accurate, they also bring additional legal complications, particularly in connection with the processing of special categories of personal data.

When choosing a method, companies face the so-called data minimization paradox. The most reliable verification methods (document scanning, biometrics) require the collection of the most sensitive personal data, which can be in direct conflict with the GDPR principle of collecting only data strictly necessary for the given purpose.

Choosing the right mechanism is therefore always about finding a balance between the robustness of verification and the protection of user privacy.

In this context, it is also important to monitor technological developments. As a modern Prague-based law firm, ARROWS monitors emerging trends, such as zero-knowledge proofs (ZKPs) or the European digital identity (eID) project. In the future, these systems will make it possible to confirm a fact (e.g., "the person is over 15 years old") without having to reveal the data itself (the exact date of birth) or the person's identity, thereby elegantly resolving the aforementioned paradox.

In the event of an audit by the Office for Personal Data Protection (ÚOOÚ), the key question will not be whether you have a verification system, but whether you are able to justify why you chose that particular system. The documentation of your decision-making process, especially the Data Protection Impact Assessment (DPIA), thus becomes crucial evidence. 

A company that has used only a simple age-gate for a high-risk service will not be able to defend its choice. The legal work associated with risk analysis and documenting decisions is therefore just as important as the technical implementation.

ARROWS does not just provide legal opinions, but actively cooperates with your IT and product teams on the design and implementation of solutions that comply with the "compliance-by-design" principle. We will help you conduct a Data Protection Impact Assessment (DPIA) and select a verification method that is proportionate to your business model, technically feasible, and, above all, legally defensible.

Operating Abroad? Beware of Different Age Limits in the EU

For companies whose ambitions extend beyond the borders of the Czech Republic, the issue of minor consent brings another, significantly more complex dimension. The flexibility that the GDPR provided to member states in Article 8 has led to the creation of an inconsistent and fragmented legal map across the European Union. What is legal in one country may be unlawful in another. Operating a single pan-European platform without taking these national variations into account is a recipe for serious legal trouble.

While the Czech Republic has set the age limit at 15, the situation with our neighbors and key business partners is different. This fragmentation requires companies to have not only legal knowledge but also advanced technical capabilities.

Age limits vary significantly across Europe. The default limit of 16 under GDPR applies, for example, in Germany, Poland, Slovakia and Ireland. Austria and Spain have lowered the limit to 14, France, like the Czech Republic, has set it at 15 (in our case under Act No. 110/2019 Coll.), and Belgium and Sweden have opted for the lowest possible limit of 13.

The business impact of this legal mosaic is fundamental. For any company with a pan-European user base, a uniform approach to obtaining consent is simply contrary to the law. Your platform must be technically capable of identifying the user's location and dynamically applying different rules based on that. 

In practice, this requires the implementation of reliable geolocation technology and the development of flexible mechanisms for displaying different versions of registration forms and consents. This legal fragmentation thus directly translates into increased costs for development, maintenance, and overall technical complexity of the system.

This complexity is precisely why we have spent ten years building the ARROWS International network. Our clients do not have to laboriously search for and coordinate local experts in each country. Thanks to our network, we ensure consistent and effective legal advice across jurisdictions, whether you are dealing with launching a new service in Germany, France, or Sweden. We handle matters with an international element practically every day.

The situation is further complicated if you use services of providers based outside the EU, for example in the United States, to operate your platform (which is common for cloud storage, analytical tools, or marketing platforms). In such a case, the highly risky issue of transferring personal data to third countries is added to the problem of differing age limits. 

Especially when it comes to the data of minors, the level of vigilance and scrutiny by European supervisory authorities is extremely high. Examples include cases from Germany and Denmark, where data protection authorities criticized the use of tools from Google and Microsoft in schools precisely because of the transfer of students' data to the US, where the same level of protection as in the EU is not guaranteed.

Risk Analysis: The TikTok Case and What Threatens Your Business

Abstract legal sections and theoretical risks often only take on real shape when looking at specific practical cases. Nothing illustrates the potential consequences of misconduct in the area of children's personal data protection better than the TikTok case, which has become a warning example for the entire digital industry. The fine of EUR 345 million (approximately CZK 8.5 billion), imposed on TikTok in 2023 by the Irish Data Protection Commission (DPC), was not just a punishment for a single mistake, but for a whole set of systemic failures.

The analysis of this decision provides insight into what supervisory authorities focus on and which practices they consider to be the most serious violations of the GDPR. For your company, this is essentially a manual on what to avoid:

1. Public by Default: Accounts of child users (aged 13-17) were automatically set to public. This meant that anyone on and off the platform could see and comment on the content these children created. This was a flagrant violation of the key principle of the GDPR – privacy by design and by default, enshrined in Article 25. Platforms must configure all settings for minors to the highest possible level of privacy protection by default.

2. Unsecured "Family Pairing" Feature: This feature allowed an adult user to link their account with a child's account for parental control purposes. The problem was that TikTok did not verify whether the adult was actually the child's parent or legal guardian. This opened the door to potential abuse and risk to children. This was a failure to ensure data integrity and confidentiality under Article 5 of the GDPR.

3. Inadequate Transparency: Information on the processing of personal data, terms of use, and privacy settings were presented to child users in a way that was not sufficiently clear, understandable, and tailored to their age. This violated Article 12 of the GDPR, which requires transparent communication.

4. Use of Manipulative Techniques ("Dark Patterns"): The investigation revealed that the design of the registration process and other parts of the application utilized "dark patterns" – deceptive design elements that subtly but effectively nudged users toward choosing less private and more company-favorable options. This manipulative behavior is in direct conflict with the principle of fairness and lawfulness of processing under Article 5 of the GDPR.

These failures led to a massive fine. Under Article 83 of the GDPR, violations of rules regarding children's consent, processing principles, and data subject rights fall into the category for which a fine of up to EUR 20 million or 4% of the company's total worldwide annual turnover, whichever is higher, can be imposed. 

Although the Czech adaptation act sets lower national limits for some offenses, the Office for Personal Data Protection (ÚOOÚ) has full authority to impose substantial sanctions on the Czech market as well.

To help you better navigate specific threats and our solutions, we have prepared the following clear risk overview table:

Final Summary

As the previous chapters have shown, ensuring compliance with the law when processing the personal data of minors is a complex and dynamic discipline. It is not a one-time task that can be checked off and forgotten. It is an ongoing process that requires deep legal knowledge, an understanding of technology, and strategic risk management. The stakes are too high for this area to be underestimated.

Data protection is not just one of many fields we focus on. It is a key specialization of our team and the backbone of our practice. Our extensive experience speaks for itself: we have successfully helped set up and manage GDPR compliance for more than 150 joint-stock companies, 250 limited liability companies, and 51 municipalities and regions. These numbers represent hundreds of hours of analysis, consultation, and implementation of solutions in real business environments, from small startups to large corporations.

We understand that every company is unique. Therefore, we do not offer one-size-fits-all templates, but tailor-made solutions that reflect your specific business model, technical capabilities, and risk profile. Our Czech legal team can help you at every stage of your journey to full compliance:

• Audit and risk assessment: We will conduct an in-depth analysis of your platform and identify weak points and potential risks.

• Preparation and review of documentation: We will create or review all necessary documentation – from internal guidelines and records of processing activities, through contracts with processors, to clear and legally watertight privacy policies and terms of use.

• Consultation for your teams: We will provide practical advice to your product managers, developers, and marketing specialists so that privacy principles are integrated directly into the design of your services.

• Employee training: We will train your employees so they understand their obligations and know how to handle sensitive data correctly.

• Representation in proceedings: In the event of an audit or incident, we will professionally represent you in communication and proceedings before the Office for Personal Data Protection.

Underestimating the rules for protecting the personal data of minors is not a strategy, but a risk that a successful company cannot afford. Investing in a robust compliance program is an investment in your customers' trust, the stability of your business, and peace of mind for your future.

Contact us today to arrange a non-binding consultation. We will find out how your platform is doing and suggest specific steps to ensure full compliance and security for your business.