From consent-management-skills
Guides managing consent for children's personal data under GDPR Article 8 and COPPA, covering country-specific age thresholds (13-16), parental verification methods, and workflows.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin consent-management-skillsThis skill uses the workspace's default tool permissions.
GDPR Article 8 establishes special rules for processing children's personal data in the context of information society services offered directly to a child. Where processing is based on consent under Article 6(1)(a), the controller must make reasonable efforts to verify that consent is given or authorized by the holder of parental responsibility over the child. Member States may set the age thr...
Guides Next.js Cache Components and Partial Prerendering (PPR) with cacheComponents enabled. Implements 'use cache', cacheLife(), cacheTag(), revalidateTag(), static/dynamic optimization, and cache debugging.
Guides building MCP servers enabling LLMs to interact with external services via tools. Covers best practices, TypeScript/Node (MCP SDK), Python (FastMCP).
Generates original PNG/PDF visual art via design philosophy manifestos for posters, graphics, and static designs on user request.
GDPR Article 8 establishes special rules for processing children's personal data in the context of information society services offered directly to a child. Where processing is based on consent under Article 6(1)(a), the controller must make reasonable efforts to verify that consent is given or authorized by the holder of parental responsibility over the child. Member States may set the age threshold between 13 and 16 years.
In the United States, the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. Section 6501-6506) requires verifiable parental consent before collecting personal information from children under 13.
Member States may provide by law for a lower age threshold, provided it is not below 13 years:
| Country | Age Threshold | Legal Basis |
|---|---|---|
| Austria | 14 | Austrian Data Protection Act (DSG) Section 4(4) |
| Belgium | 13 | Law of 30 July 2018, Art. 7 |
| Croatia | 16 | GDPR default (no national derogation) |
| Czech Republic | 15 | Act No. 110/2019, Section 7 |
| Denmark | 13 | Danish Data Protection Act Section 12 |
| Estonia | 13 | Personal Data Protection Act Section 8 |
| Finland | 13 | Data Protection Act 1050/2018, Section 5 |
| France | 15 | Law No. 2018-493 (Loi Informatique et Libertés), Art. 45 |
| Germany | 16 | GDPR default (no national derogation) |
| Greece | 15 | Law 4624/2019, Art. 21 |
| Hungary | 16 | GDPR default (no national derogation) |
| Ireland | 16 | Data Protection Act 2018, Section 31 |
| Italy | 14 | Legislative Decree 101/2018, Art. 2-quinquies |
| Latvia | 13 | Personal Data Processing Law, Section 9 |
| Lithuania | 14 | Law on Legal Protection of Personal Data, Art. 5 |
| Luxembourg | 16 | GDPR default (no national derogation) |
| Netherlands | 16 | GDPR default (no national derogation) |
| Poland | 16 | GDPR default (no national derogation) |
| Portugal | 13 | Law 58/2019, Art. 16 |
| Romania | 16 | GDPR default (no national derogation) |
| Slovakia | 16 | GDPR default (no national derogation) |
| Slovenia | 16 | GDPR default (no national derogation) |
| Spain | 14 | Organic Law 3/2018, Art. 7 |
| Sweden | 13 | Data Protection Act (2018:218), Chapter 2 Section 4 |
| United Kingdom | 13 | Data Protection Act 2018, Section 9 (UK GDPR retained) |
Article 8(2) requires "reasonable efforts" to verify parental consent, "taking into consideration available technology." The EDPB and national supervisory authorities have identified the following methods ranked by assurance level:
CloudVault SaaS Inc. implements a tiered verification approach:
START: Child enters date of birth during CloudVault SaaS Inc. sign-up
│
├─► Calculate age based on date of birth
│
├─► Determine applicable age threshold based on country
│ (e.g., 16 for Ireland/Germany, 13 for UK/Denmark/Belgium)
│
├─► IF age >= threshold:
│ └─ Proceed with standard consent flow (child can consent independently)
│
└─► IF age < threshold:
│
├─► Step 1: Inform child that parental consent is required
│ "Because you're under [threshold] in [country], we need your
│ parent or guardian's permission before you can use CloudVault."
│
├─► Step 2: Collect parent/guardian email address
│ ├─ Validate email format
│ └─ Ensure parent email differs from child's email
│
├─► Step 3: Send verification email to parent
│ ├─ Subject: "CloudVault SaaS Inc. — Parental Consent Required"
│ ├─ Body includes:
│ │ ├─ What service the child wants to use
│ │ ├─ What personal data will be collected
│ │ ├─ Processing purposes (with per-purpose consent options)
│ │ ├─ Data retention periods
│ │ ├─ Child's rights under GDPR Article 8
│ │ ├─ Parent's right to withdraw consent at any time
│ │ └─ Link to consent form (expires in 48 hours)
│ └─ Verification link contains: child_id, timestamp, HMAC signature
│
├─► Step 4: Parent clicks verification link
│ ├─ Display full consent form with per-purpose options
│ ├─ For high-risk purposes: require credit card micro-transaction
│ └─ Parent reviews and grants/denies consent per purpose
│
├─► Step 5: Record parental consent
│ ├─ Parent subject_id (derived from email verification)
│ ├─ Child subject_id
│ ├─ Relationship: "parent_guardian"
│ ├─ Consent decisions per purpose
│ ├─ Verification method used
│ ├─ Timestamp, IP address, user agent
│ └─ Consent text version hash
│
├─► Step 6: Activate child's account
│ ├─ Enable only purposes for which parental consent was granted
│ └─ Apply age-appropriate default settings
│
└─► Step 7: Ongoing monitoring
├─ Age re-verification at appropriate intervals
├─ Parent can manage child's consent via parent dashboard
└─ When child reaches age threshold, transition to self-consent
The UK ICO Age Appropriate Design Code (Children's Code, effective September 2, 2021) establishes 15 standards for online services likely to be accessed by children: