Minors in Chat: What Article 8 GDPR Requires

A chat assistant does not ask how old someone is, and most of the time that is a good thing. Yet on the websites of a music school, a sports club, a tutoring service or a shop for games and sporting goods, children and young people regularly type into the chat window. For this situation the General Data Protection Regulation has a rule of its own: Art. 8 GDPR ties a child’s consent in relation to information society services to a minimum age and requires the parents to be involved below it. This article shows when the provision applies at all, what it requires of the operator, what a consent gate in the chat window can and cannot do, and how an assistant deals with young users in everyday operation. It explains the legal position and does not replace professional advice in an individual case.

Enlarge graphic

Labels in the illustration

• Child under EU law (DSK): any person under 18
• DATA PROTECTION, ART. 8 GDPR
• Under 16: consent given or authorised by the parents
• The controller makes reasonable efforts to verify this (para. 2).
• 16 and over
• the child’s own consent
• LEEWAY FOR MEMBER STATES
• A law may lower the threshold, but not below 13.
• national limit 13 to 16
• AGE THRESHOLDS (NOT TO SCALE)
• 0
• 7
• 13
• 16
• 18
• Sec. 106 BGB
• lowest limit
• Art. 8(1)
• Sec. 2 BGB
• CONTRACT LAW, BGB
• Art. 8(3)
• contract law unaffected
• From 7 limited legal capacity (Sec. 106 BGB)
• Of age at 18 (Sec. 2 BGB); the chat does not assess contracts.
• What the chat window learns from this
• A click on Accept states no age. What is recorded is the time and a fingerprint of the wording, not who clicked.

Age thresholds around chats with minors

Where children and young people use the chat

The question does not only arise for services aimed explicitly at children. A music school answers questions about lesson times that are often asked by the pupils themselves. A sports club explains training times and membership fees, and some of the enquiries come from young people who want to join. A provider of tutoring or coding courses has young participants, a driving school has teenagers shortly before their licence, and a shop for games, fashion or sporting goods has customers whose age it does not know. The term matters here: as the supervisory authorities set out, Union law understands a child to be any person who has not yet reached the age of 18 (DSK). This covers not only primary school children but all minors.

For the operator of an assistant, this leads to two separate questions. The first is whether Art. 8 GDPR applies to the service at all; that depends on three conditions, which the next section takes apart. The second arises regardless: what data does the assistant collect when a child writes, and how does it handle that data? This second question concerns every assistant with a young audience, even one that does not ask for consent at all.

What Art. 8 GDPR actually governs

Art. 8(1) GDPR opens with a condition that is easily overlooked when reading. The provision applies where processing is based on consent under point (a) of Art. 6(1), where an offer of information society services is involved, and where that offer is made directly to a child. If any of the three conditions is missing, the age threshold of the provision does not apply. That does not mean nothing applies, only that other rules take over.

If the three conditions are met, the child’s own consent is valid once the child has reached the age of 16 (Article 8(1) GDPR). If the child is younger, processing is lawful only to the extent that the holder of parental responsibility gives consent or authorises the child’s consent. The Regulation leaves the Member States some leeway: they may provide by law for a lower age, but not below the age of 13 (Article 8(1), second subparagraph, GDPR). The European Commission sums up the result by saying that the threshold varies between 13 and 16 years (European Commission) depending on what each Member State has set, and advises businesses to check with their national data protection authority. According to a resolution of the German supervisory authorities of November 2025, the majority of Member States have lowered the threshold. This article works throughout with the threshold set in the Regulation; anyone running a service for several countries clarifies the national threshold in each case.

The term information society service does not come from the General Data Protection Regulation itself. Art. 4(25) GDPR refers to Directive (EU) 2015/1535, which defines a service as any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient. A chat on a website typically meets the technical features: it runs electronically, without simultaneous presence and on request. Whether the remuneration criterion is met when a club or a school offers the chat free of charge, and whether the offer is aimed directly at children, is a matter for assessment in the individual case. In practice a cautious assumption makes sense: anyone who expects children and young people on their website sets up the assistant so that it works properly even if Art. 8 GDPR applies.

Consent is only one legal basis

Many chat assistants do not ask for consent at all. For a question about opening hours, the start of a course or the status of an order, other conditions in Art. 6(1) GDPR often come into consideration, such as steps taken at the request of the data subject prior to entering into a contract, or legitimate interests. Which basis applies in a specific case is determined and documented by the operator as the controller; what that looks like for contact details is described in Contact data from chat: getting consent right. For minors, one point in this list is particularly important, because it applies precisely when Art. 8 does not.

The balancing test under point (f) therefore shifts when there is a child on the other side. Recital 38 gives the reason: children merit specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards concerned and of their rights. According to the recital, this protection should apply in particular to the use of children’s data for marketing and for personality or user profiles. For an assistant this means: what passes as a justifiable evaluation for adults, such as a marker for a later proactive message or a collection of interests for recommendations, deserves a considerably stricter look with a young audience.

A click is not proof of age

Where Art. 8 GDPR applies, the obligation does not end with a switch. Paragraph 2 requires the controller to make reasonable efforts, taking into consideration available technology, to verify that consent is given or authorised by the parents. The European Commission is more explicit in its answers for businesses: this means age verification measures, for example control questions or measures on the website. What is reasonable depends on the service and on the data involved.

This is exactly where the limit of a consent gate in the chat window lies. Such a gate can record that someone pressed Accept, when that happened and which wording was shown. It cannot establish who pressed it: a twelve-year-old and a parent produce the same click. Asking for the person’s age in the chat changes little. It is a self-declaration that can neither be verified nor attributed to a parent, and at the same time it collects one more piece of data about the person writing.

What the consent gate in XICBOT does

What the gate cannot do does not make it worthless. For a young audience, what matters most is what happens before agreement, namely as little as possible. If the operator switches on consent in the widget section of the admin area and embeds the current embed code that carries the gate, no conversation, no message and no database entry is created without agreement. Before agreement the window stores nothing in the visitor’s browser, and the notice appears before the first message. How this interacts with a website’s cookie banner is described in detail in Chat widget and cookie banner.

• Accept and Decline sit side by side in the window with equal weight. Declining creates no conversation and keeps the input locked.
• Consent is attached to the conversation on the server, not to a value in the browser, together with the time and a fingerprint of the wording, the version of the privacy policy and the embedding page.
• The operator sets the wording. It can, for example, ask young visitors to talk to their parents before agreeing; that is not a verification.
• Withdrawal in the window needs no account. It is recorded before anything else happens, an answer in progress stops, and afterwards the window accepts nothing more.
• Visitors can view and delete their conversation without an account.

Whether the gate is switched on for an assistant with a young audience is a decision taken before embedding, and it cannot be made up for later; the page Privacy and hosting describes both cases. For Art. 8 GDPR the gate is only part of the answer. If processing rests on consent and the service is aimed directly at children, the route to the parents is needed in addition. Which combination of legal basis, gate and parental route fits a particular case belongs in the assessment of that case.

Answering with little data when children ask

The most effective protection in a chat with a young audience is not a form but restraint in collecting data. Art. 5(1)(c) GDPR requires data to be adequate, relevant and limited to what is necessary for the purpose. Most of the questions children and young people type into a chat window can be answered without any personal details: when is training, what do I bring to the first lesson, does the course also run in the holidays, is the jacket available in my size. Answering these questions requires neither a name nor an age nor a school.

• Do not ask for contact details if the answer is possible without them; for follow-up questions, point to the route the parents use.
• Do not ask for age, school, class or place of residence unless a specific purpose requires it.
• Do not take registrations or contracts in the chat, but lead to the form or registration completed by a parent or guardian.
• No markers for later proactive messages and no interest profiles for recommendations aimed at a young audience.
• Do not go into health details, medical certificates or family circumstances in the conversation, but refer to a responsible person.
• Choose short retention periods for conversations so that details that come up anyway do not stay around for long.

These rules belong in the configuration of the assistant, not in the hope of good behaviour. How role, boundaries and fallback answers are worded in a system instruction is shown in System instruction: boundaries for an AI assistant. Any assistant that takes down contact details deserves a second look: if it asks for a name and phone number as soon as someone shows interest, that request should be dropped on pages with a young audience or addressed explicitly to the parents. If a specific purpose does require a detail, such as the age in an enquiry to a driving school, that one detail is enough; for follow-up with minors, the parents’ contact route is preferable where possible, and the contract itself stays outside the chat.

Involving parents without talking down

In the chat, a pointer to the parents is usually the most helpful sentence an assistant can offer when a request needs data or a contract. It should sound matter-of-fact and name a route, not a refusal. A sentence such as “For the sign-up we need a parent’s signature, you can find the form here” moves things forward. A sentence such as “You are not allowed to do that” usually leads nowhere. Whether the assistant uses a formal or an informal form of address is up to the operator and its audience. What this looks like in a club is described in Club member questions, and for course providers in Pre-course questions.

The last row calls for particular care. An assistant is not a counselling service and should not present itself as one. It can, however, hand over to a person when a request goes beyond a knowledge question, as described in When your AI assistant should hand off to a human. For services that themselves provide counselling to young people, Recital 38 contains a specific assessment: the consent of the holder of parental responsibility should not be necessary in the context of preventive or counselling services offered directly to a child. The European Commission describes such services as exempt from parental consent; the German supervisory authorities, acting jointly as the Data Protection Conference, point out by contrast that this objective has found no foothold in the text of the Regulation. Anyone operating such a service should therefore have the legal basis checked professionally.

Buying and signing up: contract law

Art. 8 GDPR governs only consent under data protection law. Paragraph 3 makes clear that the general contract law of the Member States remains unaffected, such as the rules on the validity, formation or effect of a contract in relation to a child. Whether a young person can validly place an order in a shop or validly join a club is therefore not answered by the General Data Protection Regulation but, in Germany, by the Civil Code (BGB).

Thresholds of its own apply there. A person comes of age on completing their 18th year (Sec. 2 BGB), and a minor who has reached the age of 7 (Sec. 106 BGB) has limited legal capacity in accordance with Sections 107 to 113 BGB. For the chat this results in a simple division of labour: the assistant answers questions about products, courses and procedures, but it is not meant to judge whether a contract with a minor comes into being or to make a commitment that anticipates this question.

Clear notices, clean erasure

For notices to children, the Regulation tightens the general standard. Art. 12(1) GDPR requires information in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. Recital 58 is even more specific: where processing is addressed to a child, information should be in such clear and plain language that the child can easily understand it. For the notice in the chat window and the consent text this means short sentences, no technical terms without explanation and a clear answer to the question of what happens to the conversation. How an assistant itself answers simply and clearly is described in Plain language in the assistant.

• Who is answering: a machine on behalf of the operator, not a person.
• What is stored and for how long, in one sentence.
• What the visitor can do: accept, decline, withdraw later and delete the conversation.
• A request to young visitors not to type names, addresses or phone numbers into the chat.
• Whom parents can contact with questions about data protection.

Alongside clear notices, the right to take back what was said matters particularly for children. Art. 17(1)(f) GDPR lists, as a ground for erasure of its own, data collected in relation to the offer of information society services referred to in Art. 8(1). Recital 65 explains why: the right to erasure is relevant in particular where someone gave consent as a child and was not fully aware of the risks involved by the processing, and it should remain exercisable once the person is no longer a child. In XICBOT a visitor can delete their conversation in the window without an account. Which retention periods make sense for chat logs is covered in Setting retention periods for chat logs.

Checklist before going live

Whether an assistant with a young audience is set up properly can be checked in a fixed order before going live. This does not replace a legal assessment, but it shows which questions are still open and who needs to answer them.

• Define the audience: on which pages does the assistant sit, and do minors evidently write there?
• Set the legal basis: does processing of the conversation content rest on consent or on another condition in Art. 6(1) GDPR?
• Check Art. 8: is an information society service offered directly to children involved? If so, define the route to parental agreement outside the chat.
• Cut collection: remove every question the assistant asks about name, age, contact details or health that the request does not require.
• Check the notices: word the notice in the window and the consent text so that a child understands them.
• Run test conversations: play through a sign-up, a purchase, a health question and a worry from a teenager’s point of view, and approve the answers.

Frequent questions