Hacker News Reader

Comment by GordonS | Hacker News Reader

> Age checks – you should ask for the user’s age, and if the user is a child (below 16), you should ask for parent permission

Please tell me this is only required when age is relevant, such as for sale of alcohol and tobacco?

Otherwise, surely most data holders don't need a customer's age, and this would be forcing them to collect more personal information!

And personally, as a consumer, I don't want to provide information that isn't relevant, so I'm more likely to use a competitor that doesn't ask for such needless PI.

View on HN

If you use “consent” as your “legal basis” and you are asking for consent that is related to the offering of services over the internet (such as a web shop, a social media web site, discussion forum, ...), you need to somehow verify age (16 years normally) or be very clear that under 18 years olds (“children”) are not to access your service (and not have evidence pointing to that this is undermined)

Note that the 16 years old rule applies to “consent” only. As I stated in a separate comment “consent” is often not the way to do things. I, and many EU data protection lawyers I have met, believe consent to be a “last resort” legal basis of processing personal data. Instead, the legal basis called “legitimate interest” should normally be used where you as a company decides what is resonable, you think is needed to achieve the purposes you are processing data for, and, what the data subject would reasonable expect.

There is no under 16 age limit or age verification requirement in general for “legitimate interest”

In my own case, we only need customer PI as contacts for billing and support, so from what I've read, that doesn't need consent.

Thinking about it, I suppose it does make sense to ask users if they are over 16 if you are going to be processing data in a way that does require consent, just so you know that they can legally give that consent.

I believe this is true. In my country (Sweden) it appears like consent outside of offering internet services may require the data subject to be 18, not 13 (Sweden has made a local adjustment to 13 years of the 16-years old rule referred to). So this rule may actually be a relief of who can consent to what.

Reply on news.ycombinator.com