Does the GDPR enforce an age restriction?

Question

Many services limit the age of users in europe to 16+ bases on the GDPR. Does the GDPR really forces them to do this?

Answer 1

In short, I think it does not. Nothing in the GDPR makes it difficult to offer services to children, even if they are below 13.

The first sentence of Art. 8.1 GDPR contains a lot of information:

Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old.

So this only applies to an offer of information society services (ISS). The meaning of an ISS has been defined in Directive 2000/31/EC. This means that this article does not apply to for example the android app of the Uber ride-sharing service, because that is an transportation service, not a information society service.

This article applies to an ISS directly offered to a child. The word "directly" is important here. If it was not, it would be left out. So it does not apply to any ISS, but only if it has been targeted to children, or made attractive in any way to children. So this article would generally not apply to StackOverflow, but it might apply to StackOverflow during winter bash, because of the funny hats.

Finally it only applies to Article 6.1a; ie, when data is processed based on consent. In that case Article 8 has an additional condition:

Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.

The GDPR does not explicitly state how to verify this. It just specifies to make reasonable efforts to do this. (8.2)

Article 7 contains more conditions to the processing based on consent. For example consent must be freely given, it is always possible to withdraw, and the request for consent is presented separately from other manners.

So when data is processed based on consent, the consent can always been revoked without any other changes to the service. So instead of asking parents for consent, it is also possible to assume they don't. This might mean you can't show them personalised ads, but you can neither show them to adults who did not give consent. I can image parents are not happy with any additional data processing, so they might not give consent anyway.

Note that even though the GDPR does not enforce an age restriction, other laws still apply. Gambling sites have an age restriction of 18. The GDPR does not change that.

I found a very interesting related white-paper, GDPR Implementation In Respect of Children’s Data and Consent, I suggest to read that for more details.