Age of Digital Consent by Country: What Sports Clubs Need to Know

The age of digital consent is the age at which a child can agree, on their own, to an online service processing their personal data. Under GDPR Article 8 it is 16 by default, but each EU country may lower it to 13, 14 or 15, and most have. In Croatia, Germany and the Netherlands it is 16; in France and the Czech Republic 15; in Spain and Italy 14; in Belgium, Denmark and Sweden 13. Below that age, a parent has to give or approve the consent.

For a sports club, this matters most in one place: a child creating their own account on the club's website or app. The full table is below. After it is the part most summaries leave out, which is what the rule does not cover.

This article explains the rule as it applies to club software. It is not legal advice. National laws change, so check your country's data protection authority before relying on any age here.

Age of digital consent by country

The ages below are those set by each country's GDPR implementing law, as of October 2026.

Outside the EU but often asked about:

• United Kingdom: 13 (Data Protection Act 2018, s. 9).
• Norway: 13 (Personal Data Act, §5). In 2025 the Norwegian government proposed raising it to 15, so check whether that has passed.

In summary: 9 countries use 16, 4 use 15, 6 use 14 and 8 use 13. The cut-off depends on where the service is offered. A club in Ljubljana works to 15, a club in Zagreb to 16.

What Article 8 actually covers

This is where most clubs get it wrong, in both directions. Article 8 applies only when all three of these are true:

1. The service is an "information society service", meaning something provided online, at a distance, on request. A club's website or app where members create an account and book courts is one. A paper membership form handed in at reception is not.
2. It is offered directly to the child. A junior booking page, a kids' camp sign-up, or an app open to anyone who downloads it counts. A service only parents can use does not.
3. Consent is the legal basis for that processing. If the club processes the data because it is needed to run the membership the family signed up for (the "contract" basis), Article 8 is not what governs it.

Two more parts of the article matter to clubs:

• Article 8(2): when parental consent is required, the club must make reasonable efforts to check that the consent really came from someone with parental responsibility, "taking into consideration available technology". A ticked box saying "my parent agrees" is weak evidence. A confirmation from a separate, verified parent account is much stronger.
• Article 8(3): the rule does not change national contract law. Whether a 12-year-old can validly sign up for a paid membership is a question of the country's civil law on minors, not of the GDPR. In most countries the answer for anything beyond pocket-money amounts is that a parent has to agree.

So the age of digital consent is not a general "age at which a child's data needs parental approval". It is narrower than that. In practice, though, the situation it covers — a child signing themselves up online — is exactly the one a club with online registration faces every week.

The situation clubs actually face

Most junior members come in through a parent: the parent fills in the form, pays the fee, and the coach adds the child to a group. That route rarely raises an Article 8 question, because the parent is the one acting.

The problem is the self sign-up. A 12-year-old tries a taster session, goes home, and creates an account on the club's booking site. Then:

• The club now holds a child's name, email, birth date and perhaps a phone number, and their parent may not know.
• If the site asks for marketing consent at sign-up, that consent from a child under the national age is not valid on its own.
• If the child books and pays for something, the contract question from Article 8(3) arises too.

Clubs usually handle this in one of three ways:

• Do nothing. The sign-up form doesn't ask for a date of birth, so the club never knows. This is the most common approach and the hardest to defend.
• Ask for a birth date and block under-age sign-ups. Better, but the child is turned away with nowhere to go, and often comes back with a false year of birth.
• Ask for a birth date, then route the child to a parent. The account is created on hold, the parent gets a request, and the account only becomes active once the parent approves. This is the approach Article 8 describes.

A recommended approach

1. Ask every self sign-up for a date of birth. You cannot apply an age rule without it. Include sign-ups through Google or Apple, which usually skip it. Ask on first sign-in instead.
2. Use the age for your country, or a higher one. Nothing in Article 8 stops a service setting a stricter age than the national one. Slovenia's law says so explicitly: a provider's terms may set a higher limit. If the club operates in several countries, one higher age is simpler than several.
3. Under that age, hold the account until a parent approves. Ask for a parent's email, send them a request, and let the account sign in only once they have approved, signed in as themselves.
4. Record the consent. Who approved, for which child, and when. Article 7(1) requires you to be able to show that consent was given.
5. Delete what never got approved. An on-hold child account whose parent never answers should be erased after a fixed period, not kept indefinitely.
6. Treat health data separately. A medical certificate is special-category data under Article 9. Its legal basis is a separate question from the age of digital consent, and it deserves its own look with your data protection adviser.
7. Keep marketing consent separate. Whatever the age rule, consent to club promotions should be its own unticked choice. See how to run a sports club email newsletter for how to split news from promotions.

Example

A hypothetical club, to show the flow.

A padel club in Italy (age of digital consent 14) lets anyone create an account on its website to book courts and join open-play sessions. It sets its own sign-up age at 14, matching the national rule.

• Matteo, 15, signs up. He is over the age, so nothing changes.
• Giulia, 12, signs up after a junior clinic. The site asks for her date of birth, sees she is under 14, and asks for a parent's email. She gives her mother's. Her account exists but cannot sign in. Her mother receives a request, signs in to her own account, and approves. The club now has a record of who consented and when, and Giulia's account is linked to her mother, who can book and pay on her behalf.
• Luca, 13, signs up and gives an address his parents never check. Nobody approves the request. After 30 days, the club deletes the account automatically.

The same club opening a second venue in Croatia would face a 16 limit there. If it used 16 everywhere, it would be stricter than required in Italy but never too lenient in either country, and it would not have to change if a country raised its age.

How SportyPlus handles the age of digital consent

SportyPlus asks for a date of birth at every self sign-up on the club website and in the member app. Accounts created through social sign-in are asked on first sign-in. Under the consent age, the sign-up asks for a parent's email. The account is created on hold and cannot sign in until the parent signs in as themselves and approves. Approval links the child to the parent and records when and from where the consent was given. On-hold accounts that nobody approves are deleted after 30 days. Once linked, the parent can book, sign up and pay for the child from My family, as described in how to manage junior members and their parents.

The consent age is currently 16 for every club on the platform, which is the Croatian age and the minimum age in SportyPlus's terms. That meets or exceeds the national age in every EU country, but it is stricter than required in countries that use 13, 14 or 15. Per-country ages are on the roadmap. Members a club registers itself from the admin side, such as a coach entering a new academy student, are not held for approval, because the club is collecting that data directly. The club's own membership terms cover it.

Practical recommendations

• Find your country in the table, then confirm it on your data protection authority's site.
• Check whether your website or app lets a child sign up without a parent. If it does and doesn't ask for a birth date, fix that first.
• If you operate in more than one country, pick one age that satisfies all of them.
• Make parental approval come from the parent's own account, not a checkbox on the child's form.
• Keep a record of every approval, and delete unapproved accounts on a schedule.
• Ask your data protection adviser about medical certificates and photos of juniors separately. They raise different questions.

Related questions

Is the age of digital consent the same as the age of consent for membership?

No. Article 8 covers consent to online data processing. Whether a minor can join a club or enter a paid contract is decided by national civil law, which Article 8(3) leaves untouched. Most clubs need a parent's agreement for a junior membership regardless of the digital consent age.

Can a club require parental consent above the national age?

Nothing in Article 8 forbids it, and Slovenia's law expressly allows a provider's own terms to set a higher age. A higher age makes the club more cautious, not less compliant. The cost is that more teenagers need a parent to approve their account.

Does the age of digital consent apply to photos of junior players?

Not directly. Publishing photos of children usually rests on a different basis and often needs its own permission from the parent. Treat it as a separate question.

What counts as verifying a parent's consent?

Article 8(2) asks for "reasonable efforts … taking into consideration available technology", not certainty. Requiring the parent to approve from their own account, separate from the child's, is a reasonable standard for a sports club. A checkbox the child can tick is not.

Does this apply to clubs outside the EU?

The UK applies 13 under its own Data Protection Act, and Norway 13 under its Personal Data Act. Elsewhere, local law applies. The United States has COPPA, with a threshold of 13, for example.

Related SportyPlus guides

• How to manage junior members and their parents: linked parent accounts, managed child profiles, and parents paying for their children.
• How to run a sports club email newsletter: marketing consent and opt-ins for club news and promotions.

Want under-16 sign-ups to wait for a parent's approval automatically? See how SportyPlus handles member accounts.