[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F8":3},{"item":4,"lessons":16,"controls":66,"related":95},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","8","Article 8","Conditions applicable to child's consent in relation to information society services",19,"General Data Protection Regulation","**What it asks for.** Where consent is the basis for offering information society services directly to a child, processing is lawful if the child is at least 16. Below that age, consent must be given or authorised by the holder of parental responsibility. Member states may set a lower age, but not below 13. The controller must make reasonable efforts to verify parental consent, taking into account available technology.\n\n**In practice.** Organisations offering online services that children may use determine which national age thresholds apply, design age assurance proportionate to the risk and implement a parental consent process where needed. Evidence includes the age threshold analysis by country, age assurance design, consent records and a DPIA where children's data is processed at scale.\n\n**Common gaps.** Services often assume they are not used by children without checking. Thresholds differ by member state and are frequently applied as a single age.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_8","Read the article on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"764-network-leader-pleads-guilty-to-child-exploitation-conspiracy","764 Network Leader Pleads Guilty to Child Exploitation Conspiracy","2026-10-08T22:20:36.22+00:00",{"slug":23,"title":24,"published_at":25},"rfef-fined-100k-for-collecting-excessive-data-on-minor-soccer-players","RFEF Fined €100K for Collecting Excessive Data on Minor Soccer Players","2026-10-06T16:21:26.124+00:00",{"slug":27,"title":28,"published_at":29},"rfef-fined-100000-for-excessive-data-collection-from-minors","RFEF Fined €100,000 for Excessive Data Collection from Minors","2026-10-02T08:20:19.278+00:00",{"slug":31,"title":32,"published_at":33},"eu-warns-of-ai-powered-cyber-threats-and-moves-to-regulate-social-media-risks","EU Warns of AI-Powered Cyber Threats and Moves to Regulate Social Media Risks","2026-09-16T16:20:36.656+00:00",{"slug":35,"title":36,"published_at":37},"microsoft-sets-ai-privacy-bar-for-student-data-will-the-industry-follow","Microsoft Sets AI Privacy Bar for Student Data — Will the Industry Follow?","2026-09-15T22:21:02.413+00:00",{"slug":39,"title":40,"published_at":41},"first-federal-prosecution-of-minor-in-extremist-group-764-signals-enforcement-shift","First Federal Prosecution of Minor in Extremist Group 764 Signals Enforcement Shift","2026-09-02T22:20:20.563+00:00",{"slug":43,"title":44,"published_at":45},"sextortion-schemes-targeting-minors-lead-to-teen-deaths-and-international-arrests","Sextortion Schemes Targeting Minors Lead to Teen Deaths and International Arrests","2026-08-31T10:20:20.835+00:00",{"slug":47,"title":48,"published_at":49},"metas-18b-settlement-a-costly-lesson-in-child-data-protection-and-ethical-design","Meta's $18B Settlement: A Costly Lesson in Child Data Protection and Ethical Design","2026-08-26T18:21:02.226+00:00",{"slug":51,"title":52,"published_at":53},"tiktoks-400m-coppa-settlement-a-costly-lesson-in-childrens-data-privacy","TikTok's $400M COPPA Settlement: A Costly Lesson in Children's Data Privacy","2026-08-24T18:20:19.789+00:00",{"slug":55,"title":56,"published_at":57},"tiktoks-400m-fine-a-costly-lesson-in-childrens-privacy-compliance","TikTok's $400M Fine: A Costly Lesson in Children's Privacy Compliance","2026-08-24T10:21:03.502+00:00",{"slug":59,"title":60,"published_at":61},"764-extremist-leader-sentenced-77-years-for-child-exploitation-via-coercion-doxing","764 Extremist Leader Sentenced 77 Years for Child Exploitation via Coercion & Doxing","2026-08-20T20:20:21.642+00:00",{"slug":63,"title":64,"published_at":65},"online-predator-exploits-personal-data-to-coerce-117-victims-into-self-harm","Online Predator Exploits Personal Data to Coerce 117 Victims Into Self-Harm","2026-08-10T18:21:24.917+00:00",[67,72,77,82,87,91],{"slug":68,"name":69,"problem":70,"stories":71},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",6,{"slug":73,"name":74,"problem":75,"stories":76},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",5,{"slug":78,"name":79,"problem":80,"stories":81},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",2,{"slug":83,"name":84,"problem":85,"stories":86},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",1,{"slug":88,"name":89,"problem":90,"stories":86},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":92,"name":93,"problem":94,"stories":86},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[96,102,107,112,117,120,125,129],{"family":97,"item":98,"code":99,"title":100,"together":101},"cis","3","Control 3","Data Protection",12,{"family":97,"item":103,"code":104,"title":105,"together":106},"14","Control 14","Security Awareness and Skills Training",10,{"family":108,"item":109,"code":110,"title":111,"together":106},"nist-privacy","overview","Privacy Framework","NIST Privacy Framework",{"family":5,"item":113,"code":114,"title":115,"together":116},"5","Article 5(1)(f)","Principles relating to processing of personal data",8,{"family":118,"item":109,"code":119,"title":119,"together":116},"itil","ITIL",{"family":5,"item":121,"code":122,"title":123,"together":124},"25","Article 25","Data protection by design and by default",7,{"family":5,"item":126,"code":127,"title":128,"together":71},"35","Article 35","Data protection impact assessment",{"family":130,"item":131,"code":132,"title":133,"together":71},"iso","27701","ISO\u002FIEC 27701","ISO\u002FIEC 27701: Privacy information management systems"]