Under GDPR Article 8, when you rely on consent and offer an online service directly to a child, processing is lawful from age 16. Below that, a parent or guardian must give or authorise consent. Member states may set a lower age, but not below 13. You must make reasonable efforts to verify parental consent.
What the article says
Article 8 applies where consent under Article 6(1)(a) is the legal basis and the service is offered directly to a child. The default threshold is 16. National law may lower it, provided the lower age is not below 13. The controller has to make reasonable efforts to verify that a parent or guardian gave or authorised consent, taking available technology into account.
The article also states that it does not affect general contract law of member states, such as rules on whether a contract with a child is valid. Check your own terms with counsel for that side.
What this means for game signups
The threshold depends on the country. A studio with players across the EU cannot assume one number. Practical options are:
- Apply the highest age you need across the countries you serve, which is simplest but may exclude more players.
- Apply the age per country, using the player's country at signup. This needs care because location signals can be wrong.
- Reduce reliance on consent. If another legal basis genuinely applies to a processing purpose, the Article 8 rule may not be the deciding one. That is a legal question to settle with advisors, not a shortcut.
Which features rely on consent
Think through where consent is your legal basis. Typical candidates in games include marketing messages, optional analytics, personalised advertising and some social features. Features that are strictly needed to run the game may rest on a different basis. Mapping this feature by feature is the real work.
Verification is a design problem
"Reasonable efforts" depends on the technology available and the risk. A low risk feature may justify a lighter check than a feature that shares data publicly. The wording of the article ties the effort to available technology, so what was reasonable years ago may not be now.
Engineering checklist
- Record the player's declared age band and country at signup, and keep only what you need.
- Gate consent based features behind that check.
- Store consent records: what was agreed, when, and by whom.
- Make withdrawal as easy as giving consent, and make sure the withdrawal reaches downstream tools.
- Review SDKs and analytics so nothing collects data before consent where consent is needed.
Safeguard offers compliance and evidence automation and SBOM based inventory of third party components, which can help you see what runs in your builds. It is not a consent management tool. Free scan: https://gold.safeguard.sh/scan.
Quick check
Is the age of digital consent 16 everywhere in the EU?
No. Article 8 sets 16 as the default but lets member states choose a lower age, not below 13. Check the rule for each country you serve.
Sources
Last reviewed: 19 October 2026.
