ItalyCodice in materia di protezione dei dati personali (Data Protection Code), Art. 2-quinquies, minimum age for social media consent
D.Lgs. 196/2003 (Codice Privacy), Art. 2-quinquies, inserted by D.Lgs. 101/2018
In force since .
A social media and minors rule binding private bodies.
- Audit expectation
- none
What it requires
- Applies to providers of information society services, including social media platforms, offered directly to minors in Italy, where a minor's consent is the basis for processing their personal data.
- Treat 14 as the minimum age at which a minor can independently consent to processing of personal data for the service, including registering for a social media account.
- Obtain parental consent for users under 14.
- You need not verify identity under this rule: it is a data protection consent rule, not a mandated identity verification requirement.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Garante per la protezione dei dati personali (Italian Data Protection Authority)
Settledness
- As of
- Open questions
- Does the first paragraph of Article 2-quinquies, which lets a minor who "ha compiuto i quattordici anni" (has turned fourteen) consent to processing for the direct offer of information society services, reach a social media account that the provider offers under a contract rather than on consent under Article 6(1)(a) of the GDPR?
- What must a controller do to show that consent for a user under fourteen was given by "chi esercita la responsabilità genitoriale" (whoever exercises parental responsibility), when Article 2-quinquies names no verification method?
What it reaches
Age threshold
14
Covered services
Information society services, including social media platforms, offered directly to minors in Italy
Verification methods
Self declaration, Parental consent
What it makes you log
Logging duty
Article 2-quinquies sets 14 as the age at which a minor may consent to processing for an information society service, requires parental consent below it, and requires the controller to write information for minors in clear and simple language. It requires no log or record of the consent or of the age.
- Kind
- None
- As of
What this law does
Sets 14 as the minimum age at which a minor can independently consent to processing of personal data for an information society service, including registering for a social media account. Providers must obtain parental consent for users under 14. This functions as Italy's de facto minimum social media registration age, though it is a data protection consent rule rather than a mandated identity verification requirement.
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .