ItalySenate Bill S.1136, Protection of Minors in the Digital Dimension
A social media and minors rule binding private bodies.
As of .
What it requires
- A provider of an online social network or a video-sharing platform must allow a minor to activate an account only after the minor has completed 15 years of age.
- Pending uniform European technical measures, verify users' age through the national mini-wallet that implements the European Union age-verification solution, taking account of the arrangements set by the communications authority.
- A contract for an account already created and held by a minor aged 15 or under remains valid only if the minor has completed 15 years of age when the law enters into force; any other such contract is void and cannot be the legal basis for processing the minor's personal data under Article 6(1)(b) of Regulation (EU) 2016/679.
Who enforces it
Enforcement body
The Data Protection Authority (Garante per la protezione dei dati personali) for violations by providers, and the communications authority (Autorità per le garanzie nelle comunicazioni), which monitors implementation and sets the age-verification arrangements.
What it reaches
Age threshold
15
Covered services
Online social networks and video-sharing platforms, as defined by Article 2(7) of Regulation (EU) 2022/1925 and Article 3(1), points (c) and (c-bis), of Legislative Decree 208 of .
Obligation class
Age verification, Consent
Verification methods
Digital ID
What this law does
The rapporteur's new text of the bill would allow a minor to activate an account on an online social network or a video-sharing platform only after the minor has completed 15 years of age. Pending uniform European technical measures, providers of those services would verify the age of users through a national mini-wallet that implements the European Union age-verification solution, taking account of the arrangements set by the communications authority.
The text provides that the mini-wallet is to be made available by . Contracts for accounts already created and held by minors aged 15 or under would remain valid only if the minor has completed 15 years of age when the law enters into force. Outside that case the contracts would be void and could not be a lawful basis for processing personal data under Article 6(1)(b) of the General Data Protection Regulation.
Where a provider violates the article, the Data Protection Authority would adopt, where the conditions are met, the measures under Articles 58(2) and 83 of that Regulation. The communications authority would monitor the implementation of the age rules and publish an annual report on the data acquired. The text would replace the age of 14 with the age of 16 in the first sentence of Article 2-quinquies(1) of the Privacy Code.
The communications authority would, within 180 days of entry into force, define guidelines on minors over 15 who work as influencers. The law would enter into force six months after its publication in the Gazzetta Ufficiale. The bill was presented in the Senate on . The bill was assigned to the 8th Committee in drafting session on . The Senate's page for the bill records it as under examination in committee as of .
When LexLint raises it
When your app profile says your app operates a social platform.