Children’s rights on the internet are unevenly enforced
The EU’s General Data Protection Regulation (GDPR) imposes requirements on service providers to determine whether users of their services are children. However, studies have shown that current age verification tools are unreliable. The most commonly used method is self-declaration, where the user has to declare their age, for example by entering their date of birth during registration. It is easy to see that such a method involves uncertainties. Children can easily bypass age verification by giving the wrong age. In practice, this means that parental consent to use the app is generally not obtained, even if it is required under Article 8 of the GDPR. As a result, the processing of personal data based on consent may be unlawful for children. The issue of age verification techniques has also been raised in case law. For example, in its binding decision on TikTok in August 2023, the European Data Protection Board has criticised the app’s age verification measures and questioned their effectiveness. To ensure that children’s rights are respected, applications need to be able to reliably identify the age of their users.
Susanna Lindroos-Hovinheimo, Professor of Public Law
Faculty of Law, University of Helsinki
SEE ALSO: processing of personal data in primary school privacy guide
