When does Article 8 GDPR apply?

Article 8(1) applies where consent under Article 6(1)(a) is the lawful basis and an information society service is offered directly to a child. If you rely on another lawful basis, or your service is not offered directly to children, Article 8 itself does not apply, although children's data still merit specific protection (Recital 38).

What is the age limit for a child's own consent?

Article 8(1) sets 16 years. Member States may set a lower age by law, but not below 13 years. Below the applicable age, processing is lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility.

Do we have to check that a parent really consented?

Article 8(2) says the controller must make reasonable efforts to verify that consent is given or authorised by the holder of parental responsibility, taking into consideration available technology. GDPR does not prescribe one method, so record what you did and why it was reasonable for the risk.

Could children use your AI chatbot or app? A GDPR Article 8 child consent and age check sheet for small businesses

Updated 26 Oct 2026 · Disclosure: the EURO AI Register mentioned below is an Unadhi product with a free edition. This guide is for information only, not legal advice.

What you get: a finished child consent sheet in three tabs: a "does Article 8 apply?" test with one row per AI chatbot, app or sign-up form and a result formula, a country age tab you fill in from each country's national law, and a parental consent record with a status formula, plus AI Act red flags and two made-up example rows.

Short answer: if you rely on consent and offer an online service directly to children, for example a homework helper chatbot, a kids' coding class app or a game with an AI character, Article 8 GDPR says a child can only consent alone from 16 (or a lower national age, never below 13). Below that age you need consent given or authorised by a parent, and you must make reasonable efforts to verify it.

Step 1: tab 1, does Article 8 apply? (one row per service)

Column	What to write	Source
A. Service	"tutoring chatbot on our website", "class booking app", "AI photo filter in our game"	Art. 8(1)
B. Online service paid for or used at a distance	Yes or No: is it an online service people use themselves (an information society service)?	Art. 8(1), Art. 4(25)
C. Offered directly to children	Yes if children are a target or a likely audience: marketing to them, child-themed content, school-age features	Art. 8(1), Recital 38
D. Lawful basis is consent	Yes or No: do you rely on Art. 6(1)(a) for this processing?	Art. 6(1)(a)
E. Preventive or counselling service	Yes if it is, for example, a helpline offered directly to a child	Recital 38
F. Result	`=IF(AND(B2="Yes",C2="Yes",D2="Yes"),IF(E2="Yes","Art. 8 applies but parental consent may not be needed: check with an adviser","Art. 8 applies: fill tabs 2 and 3"),IF(C2="Yes","Art. 8 not triggered, but children need specific protection: check notice wording and profiling","Art. 8 not triggered"))`	Art. 8, Recital 38; our working rule

The formula is a first sort, not a legal conclusion. Recital 38 says the specific protection of children should apply in particular to marketing, to creating personality or user profiles, and to collecting data through services offered directly to a child, so look closely at any AI feature that profiles users.

Step 2: tab 2, the age that applies in each country

Column	What to write	Source
A. Country	Each EU country where you offer the service to children	Art. 8(1)
B. Age of digital consent	16 unless that country's law sets a lower age (13, 14 or 15). Fill it from the national law or your data protection authority's site, and write the link in column C	Art. 8(1)
C. Where we checked, and when	Link and date	Art. 5(2)
D. Age we use	`=IF(B2="",16,MAX(13,MIN(16,B2)))`. Leaving B blank uses 16, the GDPR default and the highest possible age, which is the safe choice until you have checked	Art. 8(1); our working rule

We have not listed national ages here because we only cite what we checked today. Fill column B yourself and keep the link.

Step 3: tab 3, the parental consent record (one row per child account)

Column	What to write	Source
A. Account or sign-up ID	Your internal ID, not the child's full name if you can avoid it	Art. 5(1)(c)
B. Country	Picks the age from tab 2	Art. 8(1)
C. Age stated	The age or year of birth given at sign-up	Art. 8(1)
D. Parental consent given on	Date, or blank	Art. 7(1), 8(1)
E. How we checked it	For example "confirmation email to parent's address, link clicked" or "parent signed form at our front desk". Choose a method in line with the risk	Art. 8(2)
F. Status	`=IF(C2="","Ask age",IF(C2>=VLOOKUP(B2,'Ages'!A:D,4,FALSE),"Child can consent alone",IF(D2="","Wait: no processing on consent yet",IF(E2="","Record how consent was checked","Parental consent recorded"))))`	Art. 8(1), (2); our working rule

Name tab 2 Ages and put the column letters in row 1; the formulas assume that layout. Article 8(3) adds that Article 8 does not change national contract law, so whether a child can sign up to a paid plan is a separate question.

AI Act red flags for services children use

Article 5(1)(b) of the EU AI Act bans AI systems that exploit vulnerabilities due to age to materially distort behaviour in a way that causes, or is reasonably likely to cause, significant harm. Remove any AI feature that pushes children into purchases or streaks by playing on their age
Write the privacy notice so a child can understand it: Article 12(1) GDPR asks for clear and plain language, in particular for information addressed specifically to a child. See the privacy notice wording sheet
If your chatbot talks to children, tell them they are talking to an AI: see the Article 50 chatbot disclosure checklist
Profiling children for marketing is the area Recital 38 names first. Run the DPIA screening sheet before you launch

Two example rows (made-up businesses, for illustration only)

Example 1, a small language school with an AI homework chatbot for pupils aged 10 to 15: tab 1: A. homework chatbot · B. Yes · C. Yes · D. Yes · E. No · F. Art. 8 applies: fill tabs 2 and 3. Tab 3: account S-104 · country left to look up in tab 2 (so 16 is used) · age 12 · parental consent 3 Oct · checked by "parent signed the enrolment form in person" · status Parental consent recorded.

Example 2, a bike shop with an AI product-finder chatbot for adults: tab 1: A. product finder · B. Yes · C. No · D. No (it relies on another basis for answering questions) · E. No · F. Art. 8 not triggered. The shop still adds a line to its notice saying the service is meant for adults.

Do this week

List every online service, chatbot and sign-up form that children could use
Run each through tab 1 and fill tab 2 for the countries you serve
Add an age question before any consent-based sign-up and start tab 3
Check the AI features against the red flags above

This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 4, 5, 6, 7, 8 and 12 and Recital 38, as published on gdpr-info.eu) and to Article 5 of Regulation (EU) 2024/1689 (the AI Act, as published on artificialintelligenceact.eu). The result formulas, the "use 16 until checked" rule and the layout are our own working rules. National laws set the age between 13 and 16, and authorities may take a stricter view, so check your data protection authority's guidance. Example rows are made up for illustration and do not describe any real business. Checked on 26 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.

For accountants and tax advisers

Tutoring centres, sports clubs and app studios among your clients may offer online services to children. Hand them tab 1 with the client AI inventory, stay inside your professional rules and refer legal questions on.

Keep child-facing AI tools in your AI register

The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. Mark each AI tool children can use, and attach this sheet as an evidence record.

When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.

Partner programme opening soon

Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.

Sources

← All guides

Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.