Recommendation 4: Seek parental consent for children under 15
The law does to a certain degree accept a child's consent to the processing of data, accompanied by parental consent when the child is under 15. The CNIL has provided further clarification on the implication and scope of the child's consent and that of his or her parents.
What the law says
Joint agreement between parents and children under 15
Article 45 of the French Data Protection Act states that, in the context of online services and for data processing based on the non-contractual consent of the user, the holder(s) of parental rights must give their consent jointly with that of their child if the latter is under 15 years of age. This means that consent for additional features such as setting the public/private status of a social network profile, or activating optional geolocation on an app should in theory be based on joint agreement between the child and the holder(s) of the parental rights. In other words, parents cannot go against their child's wishes for these types of processing and the child cannot override the parents' objection. However, for data processing based on an online contract with a service provider, the child can either enter into the contract him or herself (see Recommendation 1), or the holders of parental rights can enter into it for him or her.
This requirement for joint agreement must be both understood in principle and put into practice.
With regard to the child's consent, the child's level of maturity should obviously be taken into consideration. Naturally, what a child says should not be interpreted in the same way for a 7 year old as for a 14 year old. Using this same logic, the very existence of consent should be questioned up to a certain age: to take an extreme example, it would be absurd to think that a 3-year-old could "consent" to the processing of his or her personal data.
One solution to this problem could come from the concept of involving the child in decisions that concern him or her, a principle which stems from civil law. Asking the parent to give consent alongside their child then ensures the quality of the consent that is given, but also provides an incentive to seek and take into account the views of the child.
Do both holders of parental rights have to give their express consent?
After consulting with the Ministry of Justice, the conclusion is that this consent can in principle be classed as a "usual act" of parental authority within the meaning of civil law, meaning that only one of the parents has to give express consent, and the other parent is presumed to agree.
Help and Guidance from the CNIL for obtaining parental consent
Online service providers only need to obtain consent from one of the holders of parental rights, and the consent of the other holder, if any, is presumed.
However, that other holder must be given the opportunity to object if they so wish.
Discover the 8 recommendations from the CNIL
1 - Regulate the capacity of children to act online
2 - Encourage children to exercise their rights
3 - Support parents with digital education
4 - Seek parental consent for children under 15
5 - Promote parental controls that respect the child's privacy and best interests
6 - Strengthen the information and rights of children by design
7 - Check the age of the child and parental consent while respecting the child's privacy
8 - Provide specific safeguards to protect the interests of the child