European UnionDigital Services Act (DSA), Article 28 (Online protection of minors)
Regulation (EU) 2022/2065, Article 28
In force since .
A social media and minors rule binding private bodies.
- Audit expectation
- none
What it requires
- Applies to providers of online platforms accessible to minors (including social media, marketplaces and app stores) operating in the EU, other than micro and small enterprises, which Article 19 excludes unless they are designated very large online platforms.
- Put in place appropriate and proportionate measures to ensure a high level of privacy, safety and security for minors on your service.NIST Privacy FrameworkGV.PO-P2
- Do not present advertisements based on profiling using a minor's personal data when you are aware with reasonable certainty that the recipient is a minor.NIST Privacy FrameworkCT.PO-P1
- You are not obliged to process additional personal data in order to assess whether a recipient of the service is a minor.
These lines are LexLint's reading of the law's text. Also read by: European Commission (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Article 74(1) lets the Commission fine the provider of a very large online platform or search engine up to 6 % of its total worldwide annual turnover in the preceding financial year for an infringement of the Regulation, and Article 52(3) requires each Member State to set the maximum fine for a failure to comply with an obligation at 6 % of the provider's annual worldwide turnover. Lower ceilings apply to incorrect or missing information and refusal of an inspection (1 % of annual income or worldwide turnover, Articles 52(3) and 74(2)) and to a periodic penalty payment (5 % of average daily worldwide turnover per day, Article 52(4)).
- Rule
- Turnover pct only
- As of
- Turnover percentage cap
- 6
Who enforces it
Enforcement body
European Commission (for very large online platforms and search engines) and national Digital Services Coordinators
Settledness
The Commission's page for the guidelines says it will use them to assess compliance with Article 28(1) and that they may inform national regulators, but that following them is voluntary and does not automatically guarantee compliance.
- As of
- Guidance link
- https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-protection-minors
- Guidance body
- European Commission
- Open questions
- Must a Digital Services Coordinator or a national court treat a platform whose terms and conditions bar minors as 'accessible to minors' under Article 28(1) on the Commission's reading in paragraph 6 of its guidelines (no effective measures to keep minors out), when paragraph 13 of the guidelines says only the Court of Justice can give an authoritative interpretation of Article 28(1)?
- Does Article 28(1) require age verification rather than age estimation on a platform whose terms and conditions set a minimum age of 18 because of identified risks to minors, as paragraph 37(b) of the Commission's guidelines recommends, and until when may age estimation serve as the temporary alternative that paragraph 38 allows before the guidelines' first review?
What it reaches
Age threshold
18
Covered services
Online platforms accessible to minors, including social media, marketplaces, and app stores operating in the EU. Micro and small enterprises, and providers that lost that status within the previous 12 months, are excluded unless designated as very large online platforms (Article 19).
Obligation class
Design code, Prohibition
Applicability criteria
Article 19(1) takes providers of online platforms that are micro or small enterprises out of Section 3 of Chapter III, which holds Article 28; Article 19(2) keeps a provider designated a very large online platform inside it whatever its size.
- As of
- Combinator
- All of
- Criteria
- is not a provider of an online platform that qualifies as a micro or small enterprise as defined in Recommendation 2003/361/EC, nor one that previously qualified for that status during the 12 months following its loss of that status, except where it is a very large online platform in accordance with Article 33
What it makes you log
Logging duty
Article 28 requires measures for the privacy, safety and security of minors and bars profiling-based advertising to known minors; it states no duty to create or keep a log or record.
- Kind
- None
- As of
Also on the record
EEA status
- Status
- Pending
- Source link
- https://www.efta.int/eea-lex/32022r2065
What this law does
Requires providers of online platforms accessible to minors to put in place appropriate and proportionate measures to ensure a high level of privacy, safety, and security for minors on their service, and bans presenting advertisements based on profiling using a minor's personal data when the provider is aware with reasonable certainty the recipient is a minor.
Compliance with Article 28 does not oblige providers of online platforms to process additional personal data in order to assess whether a recipient of the service is a minor. Whether a provider is excluded as a micro or small enterprise turns on Article 19, which the applicability criteria set out.
The Digital Services Act (DSA) applied to providers of very large online platforms and search engines from four months after their designation where that date fell before , which gave for the first designations, listed at , and to all other in scope providers from .
When LexLint raises it
When your app profile says your app operates a social platform.
Back to the example · Lint your app
Page updated .