The Devil is ALWAYS in the Details! EU's 16+ Consent Provision

COPPA began as a simple requirement. The law was short and sweet (or bitter, depending on your viewpoint :-)). The all encompassing "Rule" made sense of it. And years of seminars, workshops, comments and practice clarified the "Rule."

These same challenges arise in the EU, but without the Rule and the vast teams of practitioners, advocates and policy specialists who helped create it.

For the EU 16+ provision to work, the EU will have to define the defaults (are all users default kids or adults?), knowledge (actual/attributed/notice), process (how do you approach the age-verification flow? (COPPA prohibits asking users if they are "13 and over" and restricts certain drop-down choice ranges.) Who is the parent? (How can you confirm "adulthood," legal capacity, custodian authority and identity?)

With the enormous penalty provisions and heightened authority of the data protection officers, no one can afford to do it wrong. The cost of guessing is way too high. I can only hope that the member states spend more time fleshing out the provision, and hopefully recognize the danger to our youth of setting the age-bar too high.