The map shows the age at which children’s consent is sufficient to disclose their images and personal data. The map does not cover particularly sensitive circumstances, e.g. children involved in court proceedings or interviews carried out by press representatives, since these are subject to different rules.

National provisions will be replaced by new rules introduced with the General Data Protection Regulation (GDPR), which enters into force on 25 May 2018. However, the GDPR does leave some discretion to Member States. An outline of the current national rules therefore provides a helpful basis for comparing future national regulations enacted by Member States.

View full dataset in data explorer.

Key aspects

• Nine EU Member States never consider a child’s consent sufficient: Bulgaria, Croatia, Estonia, France, Greece, Italy, Latvia, Lithuania and Poland.
• In Croatia, France, Estonia, Greece, Italy and Latvia, only parental consent is necessary for children under 18. By contrast, both parental and the child’s consent is required in Poland for children aged 13 and up; in Bulgaria for children 14 or older; in Romania for children between 14 and 16; and in Lithuania, this depends on the child’s maturity.
• Only the child’s consent is required once the child reaches a certain age in Finland (15), Hungary (16), the Netherlands (16), Romania (16) and Spain (14). This depends on the child’s maturity in Belgium, the Czech Republic, Germany and Slovakia.
• Certain countries set a different minimum age for requiring children’s consent for disclosing their images than for disclosing their personal data. This is the case in Lithuania (where, for children under 18, parental consent to disclose their images suffices); Poland (where, for children under 18, only parental consent is required to disclose their images); and Romania (where, to disclose a child’s image, only parental consent is required for children under 16).

Legal background

EU law

Several provisions of the EU Charter of Fundamental Rights apply, particularly those concerning private and family life (Article 7), protection of personal data (Article 8), freedom of expression and information (Article 11), and the rights of the child (Article 24). Article 16 of the Treaty on the Functioning of the European Union (TFEU) reiterates the right to protection of personal data, calling for rules relating to “the protection of individuals with regard to the processing of personal data”.

International obligations

EU Member States’ international obligations stemming from the Convention on the Rights of the Child (CRC), the General Comments of the Committee on the Rights of the Child, and the European Convention on Human Rights have to be implemented, as well. Article 13 of the CRC, for instance, states that “the child shall have the right to freedom of expression” through any media. Access to the internet and social media is central to the child’s right to play, engage in recreational activities and participate in cultural life and the arts (protected by Article 31 of the CRC), as underlined by CRC General Comment No. 17. Particularly adolescents use the online environment to “explore their identity, learn, participate, express opinions, play, socialise, engage politically and discover employment opportunities” (CRC General Comment No. 20 on the implementation of the rights of the child during adolescence).

General Data Protection Regulation

Based on Article 16 of the TFEU, the European Parliament and the Council adopted the General Data Protection Regulation (GDPR), which applies as of 25 May 2018. Article 8 outlines rules regarding children’s consent to the processing of their personal data (including the data’s disclosure) in relation to information society services offered directly to children. In this regard, the regulation specifies that, for children under 16, the holder of parental responsibility shall give or authorise the consent. However, Member States may provide for a lower age, as long as this is not below 13 years. National legal provisions still apply if the matter falls outside of the GDPR’s scope.