What it asks for. Where consent is the basis for offering information society services directly to a child, processing is lawful if the child is at least 16. Below that age, consent must be given or authorised by the holder of parental responsibility. Member states may set a lower age, but not below 13. The controller must make reasonable efforts to verify parental consent, taking into account available technology.
In practice. Organisations offering online services that children may use determine which national age thresholds apply, design age assurance proportionate to the risk and implement a parental consent process where needed. Evidence includes the age threshold analysis by country, age assurance design, consent records and a DPIA where children's data is processed at scale.
Common gaps. Services often assume they are not used by children without checking. Thresholds differ by member state and are frequently applied as a single age.