Children’s Wellbeing and Schools Act 2026

72 Age of consent in relation to processing of a child’s personal data: information society services

(1) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data is amended as follows.

(2) In Article 8 (child’s consent in relation to information society services), after paragraph 2 insert—

“2A. The Secretary of State may by regulations—

(a) amend paragraph 1 so as to change the age for the time being specified in that paragraph (but not to an age lower than 13 years or higher than 16 years);

(b) make provision in relation to services specified, or of a description specified, in the regulations for a different age to apply for the purposes of paragraph 1 (but not lower than 13 years or higher than 16 years).

2B. Regulations under paragraph 2A are subject to the affirmative resolution procedure.”

(3) After Article 8, insert—

“Article 8ZA Child’s consent in relation to information society services: age verification

1. The Secretary of State may by regulations make provision about verifying—

(a) that a data subject who has given consent to the processing of his or her personal data in relation to the offer of information society services is at least the age for the time being specified in Article 8(1);

(b) in the case of a service specified, or of a description specified, in regulations under Article 8(2A)(b), that a data subject who has given consent to the processing of his or her personal data in relation to the offer of information society services is at least the age for the time being applicable by virtue of those regulations in relation to that service or description of service.

2. The provision that may be made by regulations under paragraph 1 includes—

(a) provision imposing requirements on persons specified, or of a description specified, in the regulations;

(b) provision about the steps that must or may be taken by such persons for the purposes of complying with a requirement imposed by the regulations;

(c) provision about the monitoring of compliance with a requirement imposed by the regulations;

(d) provision about the enforcement of a requirement imposed by the regulations.

3. Regulations under paragraph 1 may—

(a) make provision amending, repealing, revoking or applying (with or without modifications) any provision of the data protection legislation (within the meaning given by section 3(9) of the Data Protection Act 2018);

(b) make provision for exceptions to requirements imposed by the regulations;

(c) make provision about the time by which, or period within which, a thing must be done;

(d) make provision by reference to standards, arrangements, specifications or technical requirements as published from time to time;

(e) confer functions on a person, including functions involving the exercise of a discretion, and make provision in connection with the procedure for exercising the functions.

4. Regulations under this Article are subject to the affirmative resolution procedure.

5. In paragraph 1, the reference to information society services does not include preventive or counselling services.”