IrelandData Protection Act 2018, section 31 (digital age of consent)
Data Protection Act 2018, No. 7 of 2018, s. 31
In force since .
A social media and minors rule binding private bodies.
- Private right of action
- No
- Audit expectation
- none
What it requires
- Applies to information society services, including social media platforms, offered directly to children in Ireland, where a child's consent is the basis for processing their personal data.
- Treat 16 as the minimum age at which a child can consent to the processing of their personal data, including when registering for a social media account; for a child under 16, consent must be given or authorised by a parent or guardian.
- You need not verify identity under this rule: it is a data protection consent rule, not a mandated identity verification requirement.
These lines are LexLint's reading of the law's text. Also read by: Data Protection Commission (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Data Protection Commission
Settledness
The Commission's Fundamentals add that the digital age of consent sets only the age at which a child can give their own consent, and does not restrict a child's access to a service.
- As of
- Guidance link
- https://www.dataprotection.ie/sites/default/files/uploads/2021-12/Fundamentals%20for%20a%20Child-Oriented%20Approach%20to%20Data%20Processing_FINAL_EN.pdf
- Guidance body
- Data Protection Commission
- Open questions
- Has the review of the operation of section 31(1) of the Data Protection Act 2018, which section 31(3) required the Minister to begin within 3 years of commencement and finish within a year after beginning, been completed, and did it change the age of 16?
- What counts as the "reasonable efforts" under Article 8(2) of the GDPR to verify that a parent or guardian authorized a child under 16, when the Data Protection Commission says no method is specified or suggested and only "available technology" must be considered?
What it reaches
Age threshold
16
Covered services
Information society services, including social media platforms, offered directly to children in Ireland
Verification methods
Self declaration, Parental consent
What it makes you log
Logging duty
Section 31 sets the age of digital consent under Article 8 at 16, excludes preventative and counselling services from Article 8, and requires the Minister to review the operation of the age within 3 years. It places no duty on a service provider to create, keep or produce a record.
- Kind
- None
- As of
What this law does
Sets 16 as Ireland's digital age of consent under Article 8 of the General Data Protection Regulation (GDPR), the minimum age at which a child can consent to the processing of personal data in the context of an information society service offered directly to the child, including registering for a social media account. For children under 16, consent must be given or authorised by a parent or guardian. This is a data protection consent rule rather than a mandated identity verification requirement.
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .