General Data Protection Regulation

Article 8

Conditions applicable to child's consent in relation to information society services

1. Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child.

Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.

2. The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology.

3. Paragraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child.

Holdings

/
C-484/2418 Jun 2026

NTH Haustechnik GmbH v EM

1. Point (c) of the first subparagraph of Article 6(1) and Article 6(3) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read in the light of Article 8(2) and Article 52 of the Charter of Fundamental Rights of the European Union,

must be interpreted as not precluding national legislation which, as regards the processing of personal data, undertaken in the context of a court examining the facts and taking evidence, merely prescribes that it is for the parties to submit detailed factual evidence which is truthful and requires that court to take such evidence fully into consideration, before, as the case may be, assessing that evidence, without providing any indication as to the circumstances and conditions under which the facts stated and the evidence adduced by the parties containing personal data may be used by that court, provided that (i) there is clear and precise national case-law, the application of which is foreseeable, and which itself establishes the circumstances and conditions under which the facts stated and the evidence adduced by the parties containing personal data may be used by a court, (ii) that case-law meets an objective of public interest and (iii) that case-law is proportionate to that objective.

C-484/2418 Jun 2026

NTH Haustechnik GmbH v EM

4. Articles 7 and 8 of the Charter of Fundamental Rights, Article 5(1) of Regulation 2016/679, point (c) of the first subparagraph of Article 6(1) of that regulation, read in conjunction with Article 6(3) thereof, and the principle of 'data minimisation'

must be interpreted as not precluding a national court from using evidence containing personal data obtained in breach of the right to privacy and the right to the protection of personal data by the party which transmitted such data to that court, where that party's legitimate interest in such processing does not outweigh the interest in simply adducing the facts on which it relies. By contrast, before disclosing those data to the parties or third parties, that court must verify that such data are limited to what is necessary in relation to the purposes for which such disclosure is made and, as appropriate, take certain measures to minimise the impediment to the right to the protection of personal data which such disclosure is likely to entail.