Online Child Data Protection in Spain 2026

LOPDGDD (Organic Law 3/2018) and the GDPR establish a special regime for processing personal data of minors. In 2026, with the rise of social media, educational platforms and online gaming, this is one of the most active enforcement areas for Spain's AEPD.

Age of consent for data processing

Spain's Art. 7 LOPDGDD sets the digital consent age at 14 years. Minors under 14 require parental consent for any consent-based processing. Those 14 and over may consent themselves with age-appropriate information.

The AEPD has clarified that a checkbox stating "I am over 14" is not sufficient. Reasonable technical measures to verify age are required: identity document verification (with subsequent anonymisation), verifiable parental declaration, or third-party age verification.

Privacy by design for minors (Art. 25 GDPR)

Services accessible to minors must apply more restrictive defaults: private profiles, no behavioural advertising, geolocation disabled, and direct messaging limited by default.

Information must be adapted to the child's comprehension level: simple language, visual elements, layered notices.

What data protection authorities typically sanction

European authorities and the AEPD have fined, among other things, lack of effective age verification, processing minors' data without verified parental consent, geolocation enabled by default for minors, public profiles by default for 13-17 year olds and behavioural advertising directed at minors. Check the decisions published by the AEPD and the competent authority for the actual amounts.

Compliance checklist

• Determine if your service can be accessed by minors
• Implement age verification (not just self-declaration)
• Ensure under-14s cannot consent without parental validation
• Apply most restrictive defaults for minor users
• Adapt privacy notices to children's comprehension level

Research AEPD case law on minors with Lexiel →