When data of children under 18 is being processed, additional protection and custodial permission are required.
Custody Permission
- 0-13 years: Explicit consent of the custody holder
- 13-18 years: Consent of the child + custody holder (European standard)
- Limited to the benefit of the child. processing
In Educational Institutions
- School registration data (mandatory)
- Dining hall, transportation
- Health report
- Photo/video sharing: custodial permission is required
- Social media posts (Event photo): controversial
Social Media
- Instagram, TikTok minimum age is 13
- WhatsApp 13
- Facebook 13
- Age verification systems are weak
- Parents can be notified
Gaming Platforms
- Steam, Epic, PlayStation: age control is weak
- Micropayments (loot box) debate
- Use of child data for marketing purposes prohibited
KVKK Board Decision
The KVKK Board has imposed an additional duty of care on companies that process children's data, and especially demands the effective functioning of "age verification mechanisms".
GDPR Comparison
- GDPR Article 8: 16 years of age (member states can reduce it to 13)
- Heavily violated penalties
- Extra supervision of child-oriented companies
Practical Recommendations
- Prepare custody permission forms
- Minimize child data
- Do not use for marketing purposes
- Access control mechanisms
KVKK expert lawyer recommended.