Part 2: General processing Chapter 2: The GDPR Section 9: Child’s consent in relation to information society services
Where an information society service chooses to rely on ‘consent’ as the basis for processing personal data, Article 8 of the GDPR sets the age of the data subject below which it is the parent’s, not the child’s, consent that they must obtain. Information society services are defined as any service provided by electronic means, at a distance and at the individual request of a recipient of services and normally provided for remuneration, "remuneration" is likely to include receipt of revenues from advertising. "Information society services" cover more than just sites that involve buying and selling online. Most websites would meet this definition, ranging from online banking to search engines and social media.
	The GDPR gives Member States the flexibility to set this age provided that the age decided upon does not fall below age 13.
	This section sets the age at which a child can give consent to the processing of data for the purposes of the provision of information society services at 13 years old. Any reference to age 16 in Article 8 of the GDPR, should be read as age 13 for the purposes of its application in the UK. This is in line with the minimum age set as a matter of contract by some of the most popular information society services which currently offer services to children (e.g. Facebook, Whatsapp, Instagram). This means children aged 13 and above would not need to seek consent from a guardian when accessing, for example, information society services which provide educational websites and research resources to complete their homework.
	This section clarifies the position in relation to preventative and counselling services and provides that references to information society services in Article 8 of the GDPR do not include preventative and counselling services.
	The 1998 Act did not contain equivalent provision. As long as a child is capable of understanding the processing to which they are consenting and is capable of making a free and informed decision, then it is considered that the child is capable of consenting to any processing of personal data.
	Likewise, the 1998 Act did not contain a reference to information society services, as this concept was first defined in the E-commerce Directive (2000/31/EC).