Recommendation 4: Seek parental consent for children under 15

What the law says

Joint agreement between parents and children under 15

Article 45 of the French Data Protection Act states that, in the context of online services and for data processing based on the non-contractual consent of the user, the holder(s) of parental rights must give their consent jointly with that of their child if the latter is under 15 years of age. This means that consent for additional features such as setting the public/private status of a social network profile, or activating optional geolocation on an app should in theory be based on joint agreement between the child and the holder(s) of the parental rights. In other words, parents cannot go against their child's wishes for these types of processing and the child cannot override the parents' objection. However, for data processing based on an online contract with a service provider, the child can either enter into the contract him or herself (see Recommendation 1), or the holders of parental rights can enter into it for him or her.

This requirement for joint agreement must be both understood in principle and put into practice.

With regard to the child's consent, the child's level of maturity should obviously be taken into consideration. Naturally, what a child says should not be interpreted in the same way for a 7 year old as for a 14 year old. Using this same logic, the very existence of consent should be questioned up to a certain age: to take an extreme example, it would be absurd to think that a 3-year-old could "consent" to the processing of his or her personal data.

One solution to this problem could come from the concept of involving the child in decisions that concern him or her, a principle which stems from civil law. Asking the parent to give consent alongside their child then ensures the quality of the consent that is given, but also provides an incentive to seek and take into account the views of the child.

Do both holders of parental rights have to give their express consent?

After consulting with the Ministry of Justice, the conclusion is that this consent can in principle be classed as a "usual act" of parental authority within the meaning of civil law, meaning that only one of the parents has to give express consent, and the other parent is presumed to agree.

Help and Guidance from the CNIL for obtaining parental consent

Online service providers only need to obtain consent from one of the holders of parental rights, and the consent of the other holder, if any, is presumed.

However, that other holder must be given the opportunity to object if they so wish.