Abstract
This article examines the protection of minors in digital services through a comparative legal analysis directed at foreign platforms and families. It distinguishes access restrictions, age assurance, parental authority, personal-data processing and routes of challenge. The article considers the jurisdictions, legislation, official materials and judicial decisions identified in the manuscript, with attention to the difference between binding rules, future commencement and policy proposals. The analysis emphasises product-specific and case-specific assessment. A protective purpose does not resolve questions about data minimisation, decision-making authority, proportionality or the practical availability of remedies.
Keywords minors, digital services, age assurance, parental authority, data protection, comparative law
Introduction
A platform may verify a child's age correctly and still process the verification data unlawfully. A parent may give valid consent to a particular use of data without being able to override a statutory restriction on access. For a foreign business entering Türkiye, or a family seeking advice across borders, those distinctions should be resolved before choosing a verification system, signing a service contract or bringing a complaint.
This guide examines Türkiye's new framework alongside the European Union, the United Kingdom, Italy, France, Germany and the United States. It distinguishes legislation already applicable, enacted provisions awaiting commencement, proposals and judicial decisions. The practical recommendations are legal risk- management analysis, not a substitute for assessing a particular service or child's circumstances.
Executive overview
Türkiye's new social-network and gaming duties commence on 1 November 2026, but existing representation and data-protection obligations require attention now. Access restrictions, age assurance, parental authority and data consent must be assessed separately. The comparisons below distinguish binding duties from guidance, enforcement policies and announced reforms. Operators should connect each obligation to the product and evidence of implementation. Families should establish the relevant jurisdiction, authority to act and remedy sought. Sections 1 to 9 provide the legal analysis and sources.
1. Türkiye's 2026 framework: what changes, and when?
Law No. 7578 was adopted on 22 April 2026 and published in Official Gazette No. 33240 on 1 May 2026. Under Article 27(1)(a), Articles 22 and 23, containing the principal social-network and gaming provisions, enter into force six months after publication, on 1 November 2026. The remaining provisions took effect upon publication. At this article's review date, the new access restriction is enacted but is not yet operational under those provisions.1
Social networks: an access rule, not a consent rule
The replacement paragraph 7 of Additional Article 4 of Law No. 5651 prohibits social-network providers from supplying their services to children who have not completed fifteen years of age. Providers must take necessary measures, including age verification, and provide a differentiated service for children aged fifteen to seventeen. The provision does not contain a parental-consent exception to the under-fifteen restriction.2
The same reform requires understandable, usable parental controls covering account settings, approval of paid transactions and monitoring or limitation of usage time. It also requires measures against deceptive advertising. The statutory requirement for a differentiated service should not be presented as a complete technical specification: implementation must be checked against the applicable secondary rules and the service's actual features.3
The one-hour obligation is narrower than a general duty to remove every reported risk. It concerns social networks with more than ten million daily accesses from Türkiye and decisions issued under the urgent procedure in Article 8/A. An ordinary user report is not automatically such a decision. Certain persistent failures can lead to fines, restrictions on new advertising and applications to a criminal judgeship of peace for bandwidth reduction. The applicable breach, notice and escalation requirements matter; throttling is not an automatic consequence of every compliance error.4
Foreign social-network providers exceeding one million daily accesses from Türkiye were already subject to a local representative obligation before these reforms. The 1 November commencement does not defer that existing duty. Confirm the current requirements for the representative's status, powers and reporting separately from the new gaming rule.5
Gaming platforms require a separate analysis
New Additional Article 5 addresses game classification, parental controls and other platform duties. Games that have not been duly classified may be offered only if the platform classifies them in the highest age category. This is a classification condition, not an automatic default. Foreign-based gaming platforms exceeding one hundred thousand daily accesses from Türkiye must designate a representative in Türkiye and publish the required contact details. Their enforcement sequence is separate from the social-network regime; the thresholds, feature requirements and sanctions should not be treated as identical.6
The competent authority changed in July 2026
Law No. 7590, published on 31 July 2026, amended the institutional framework of Law No. 5651 and expressly changed the authority references in Articles 22 and 23 of Law No. 7578 to the Cybersecurity Presidency, Siber Güvenlik Başkanlığı. For transferred functions, Article 26 preserves existing secondary rules until replacement measures are adopted, with the specified references read as references to the Presidency or its President. This is not a transfer of every digital-regulatory function. The Personal Data Protection Authority and Board retain their separate statutory jurisdiction.7
For a foreign provider, the first deliverable should be a written scope assessment: which legal category covers the service, how Turkish access is measured, which obligations apply independently of traffic thresholds, and what must be ready by the relevant commencement date. A representative appointment does not, by itself, complete substantive compliance.
2. Children's personal data and proportionate age assurance
Law No. 6698 does not classify all children's information as special-category data merely because of age. Nor does it establish a general digital-consent age equivalent to Article 8 GDPR. The lawful basis for each processing operation, the child's capacity and the nature of the information must be examined separately.
Health or qualifying biometric data can engage special-category rules, but minority alone is not an Article 6 category.8 The Personal Data Protection Board's decision of 11 August 2020, No. 2020/622, illustrates why capacity matters. In a complaint concerning a minor's health report, the Board examined the exercise of personal-data rights by a child with capacity of discernment and the parent's representative role. It is an administrative decision, not a Supreme Court judgment, and it does not supply a universal age for consenting to every digital service.9
A defensible age-assurance arrangement should establish what needs to be proved and retain no more information than the lawful purpose requires. Consider whether a reliable age-band confirmation can replace retention of an identity-document image. Assess the vendor's role, security, deletion, transparency and any overseas transfer under Article 9. An obligation to establish age is not a general licence to retain identity or biometric information indefinitely.10
For EU-facing processing, the EDPB's Statement 1/2025 provides a useful comparison: age assurance should be necessary, proportionate, effective and accessible, with remedies for incorrect outcomes. Assess age-band confirmation and other privacy-preserving methods against the governing law and actual data flows, rather than treating them as automatic compliance. Document the lawful basis, retention limits, responsibilities and route for contesting an age decision. The statement addresses EU data protection; it does not itself establish a Turkish technical standard.11
Parental controls raise a further question: who is entitled to exercise them? An email address and a checked box do not resolve disputed custody, guardianship or the child's evolving ability to exercise personal rights. Product design and the legal assessment of authority should be aligned before access to sensitive account information is granted.
3. Constitutional safeguards and Turkish judicial review
Enactment satisfies the formal requirement for a statutory basis, but does not settle constitutional legality. Clarity, foreseeability, safeguards against arbitrariness, the essence of the right and proportionality remain material. Articles 13, 20, 26 and 41 of the Constitution require a careful assessment of expression, privacy, personal data and child protection. A protective objective does not dispense with explaining why the particular restriction is necessary and proportionate.12
Wikimedia: the relevance and limits of an internet-access precedent
In Wikimedia Foundation Inc. and Others, Application No. 2017/22355, 26 December 2019, the Constitutional Court found that blocking the entire Wikipedia website violated freedom of expression. Its official summary emphasises the absence of sufficient justification for the extensive restriction. The decision supports scrutiny of breadth and reasoning; it did not determine the validity of an age-based social-network prohibition.13
The distinction affects litigation strategy. Abstract constitutional review and a referral from a court are different from an individual application. Article 45 of Law No. 6216 excludes direct individual applications against legislation and requires exhaustion of the relevant remedies. Counsel must identify an actionable measure, standing, the competent forum and the applicable time limits rather than promising an immediate individual challenge to the statute itself.14
There is also an existing procedural record to acknowledge. The Constitutional Court's published results for 16 July 2026 record a decision to examine the merits of challenges to certain provisions of Law No. 7578 in E.2026/172, with the suspension request reserved for that stage. The agenda does not identify the contested provisions or establish a merits outcome. It is not evidence that the under-fifteen rule has been annulled or suspended.15
4. The European Union: service design and data consent are distinct
The Digital Services Act requires covered platforms accessible to minors to provide appropriate, proportionate privacy, safety and security measures. Article 28(2) prohibits profiling-based advertising using a recipient's personal data where the provider knows with reasonable certainty that the recipient is a minor. Formal identity verification is not a prerequisite. Article 25 addresses deceptive or manipulative interfaces for users generally, not only children; paragraph 2 excludes practices covered by the GDPR or the Unfair Commercial Practices Directive from that prohibition. Articles 34 and 35 impose systemic risk duties on designated very large online platforms and search engines. Scope and exemptions, including Article 19, require separate examination.16
The Commission's July 2025 minors-protection guidelines address matters such as default privacy, recommender systems, contact risks and age assurance. They are guidance, not a replacement for the statutory tests or an automatic compliance safe harbour. Article 28(3) also cautions against treating minors' protection as requiring additional personal-data collection simply to establish whether a recipient is a child.17
GDPR Article 8 has a narrower function than a minimum platform-access age. Where processing relies on consent under Article 6(1)(a) in connection with information-society services offered directly to a child, the default threshold for the child's own consent is sixteen. Member States may lower it to thirteen. This does not establish a general prohibition on access below that age, make consent the only lawful basis for children's data, or determine contractual capacity.18
5. The United Kingdom: existing duties and announced reform
The Online Safety Act 2023 framework requires relevant services to assess children's access and risks and comply with applicable safety duties. Ofcom's codes and guidance address proportionate protective measures, including effective age assurance where required. Providers must distinguish the statutory duties from the recommended methods of satisfying them.19
The comparison must also reflect the government's 2026 policy change. Its official fact sheet, updated on 17 July 2026, announces an under-sixteen social-media restriction, with the first regulations expected to be laid before the end of the year and implementation anticipated in spring 2027. That announcement is not an already operational blanket prohibition. Equally, portraying the United Kingdom as committed only to a risk-based model would omit a material development.20
6. Italy, France and Germany: avoid treating one age as the whole law
Italy: fourteen concerns a particular consent question
Article 2-quinquies of Italy's data-protection legislation sets fourteen as the age for the child's own consent in the relevant information-society-service context. It is not a universal entitlement to use every social platform from fourteen. Parliamentary records identify reform proposals, including Senate Bill S.1136 and Chamber Bill C.3016, rather than an enacted equivalent of Türkiye's new prohibition. Proposed access ages, consent changes and technical standards should not be combined and presented as current law.21
France: commencement conditions and an important 2026 ruling
Law No. 2023-566 of 7 July 2023 provides an under-fifteen parental-authorisation framework. However, Article 7 ties its commencement to a decree and the specified European Commission stage. The Senate's 2026 implementation report records that the law could not be applied. It should not therefore be presented as a straightforward operational parental-consent regime.22
In Decision No. 2026-911 DC of 14 August 2026, the Constitutional Council invalidated Article 1 of a subsequent social-media law, which would have imposed a general under-fifteen access prohibition. The Council identified inadequate tailoring and insufficient safeguards for age-verification data. This was a decision on that French provision, not a universal rejection of age checks.23
Law No. 2026-813 of 24 August 2026 accordingly records Article 1 as unconstitutional. The invalidated ban must not be described as operative merely because the remainder of the law was promulgated. The decision illustrates the distinction between protecting children as an objective and justifying a particular restriction. Its relevance to Türkiye is comparative, not binding, and it does not predict the outcome of Turkish constitutional review.24
Germany: layered protection rather than a single consent label
The German framework combines the DSA and GDPR with the federal Youth Protection Act, Jugendschutzgesetz, and the Interstate Treaty on the Protection of Minors in the Media, Jugendmedienschutz-Staatsvertrag. The GDPR consent threshold of sixteen must not be recast as a general social-media access ban. Article 5 of the Basic Law protects expression and information while expressly recognising statutory provisions for protecting young persons as a limitation. The analysis therefore requires balancing and examination of the applicable rules, not a presumption that either interest always prevails.25
7. The United States: COPPA and the limits of constitutional analogy
At federal level, COPPA principally regulates the collection, use and disclosure of personal information from children under thirteen by covered operators. It applies to child-directed services and, in the relevant circumstances, operators with actual knowledge of collecting children's information. Verifiable parental consent is subject to defined exceptions. COPPA is not itself a universal prohibition on a child's access to digital services.26
The amended COPPA Rule was published on 22 April 2025, became effective on 23 June 2025 and set a general compliance deadline of 22 April 2026, subject to specified exceptions for safe-harbour provisions. Publication, legal effectiveness and the compliance deadline are distinct dates. The changes strengthen consent, information-security and retention requirements, including separate consent for certain third-party disclosures. A 2026 review should not rely on an unamended pre-2025 checklist.27
A conditional FTC enforcement policy is not a statutory exemption
On 25 February 2026, the FTC announced conditional non-enforcement for general-audience and mixed- audience operators processing information solely to determine age without prior verifiable parental consent. Conditions include exclusive use for that purpose, prompt deletion, restricted disclosure supported by written third-party assurances, clear privacy-policy notice to parents and children, reasonable security and reasonable steps to assess accuracy. Operators must otherwise comply with COPPA. The statement creates no substantive entitlement, preserves case-specific enforcement discretion and is subject to withdrawal or replacement through final amendments. It is not a repeal of COPPA or a general licence to collect children's data.28
Two Supreme Court judgments explain why the subject matter matters
In Brown v. Entertainment Merchants Association, 564 U.S. 786, 27 June 2011, the Supreme Court invalidated California's restriction on the sale or rental of violent video games to minors. It treated the games as protected expression and found the restriction unable to satisfy the applicable constitutional scrutiny. Child protection did not justify creating a new category of unprotected expression.29
In Free Speech Coalition, Inc. v. Paxton, No. 23-1122, 27 June 2025, the Supreme Court upheld the challenged age-verification requirement for specified websites distributing sexual material harmful to minors, applying intermediate scrutiny. The judgment does not endorse a general ban on minors using ordinary social networks.30
Read together, the decisions reject a simplistic claim that American courts either prohibit all age verification or automatically uphold every measure labelled child protection. For any state-law obligation, counsel must examine the current statute and the scope of any applicable court order. A preliminary injunction, a final judgment and a decision concerning a different category of content are not interchangeable.
8. A comparative compliance strategy for foreign businesses
Access eligibility, contractual capacity, data consent, age verification and safety design are separate legal workstreams. A common protective baseline can be useful, but it must accommodate the rules applicable to each market. The strictest age threshold is not necessarily the correct universal solution, particularly where collecting additional data creates a separate legal problem.
For a foreign platform or investor, commission an assessment that connects each obligation to a product feature, responsible team, deadline and evidence of implementation. Test registration, age transitions, paid transactions, reporting and appeal routes. Record why the selected verification method is effective and proportionate, who receives the underlying data, and how errors can be challenged. These are practical governance recommendations, not a claim that every jurisdiction prescribes the same checklist.
An acquisition review should also examine existing child accounts, age-assurance contracts, unresolved complaints, regulatory correspondence and the cost of adapting the product. Contractual warranties from a seller or software supplier should not replace an independent assessment of the platform's actual operation.
9. Choosing and instructing counsel in Türkiye
A foreign client should identify the lawyer responsible for the matter, verify professional registration and agree the mandate in writing. The relevant expertise may span platform regulation, data protection, administrative procedure, child-related civil issues and cross-border coordination. A claim to handle “internet law” does not define which of these tasks is included.
What should a foreign client ask a lawyer?
Begin with jurisdiction and the objective: which country's rules and complaint routes require assessment, which entity operates the service, what evidence should be preserved and is counsel abroad needed? Establish whether the lawyer represents the parent, the child or the provider, and who may give instructions. These questions are particularly important where the child, parent and operator are in different countries.
For a provider, the engagement should specify whether it covers service classification, local representation, age-assurance procurement, contracts and privacy notices, regulator communications and contentious proceedings. Appointment as a statutory representative is not the same as a broader advisory or litigation mandate. For a parent, clarify whether the objective is account restriction, access to data, correction, deletion, protection from harmful contact or a claim against a particular person. Different objectives may require different evidence and remedies.
Before sharing a child's records, agree a secure communication method and establish who is authorised to instruct the lawyer. Preserve relevant dates, URLs, notices and correspondence without unnecessarily reproducing harmful content. Where data rights are invoked, the application and complaint procedure under Law No. 6698 must be considered; account deletion should not be equated with unconditional erasure of every record.31
Fees should distinguish advice from representation, translation, expert work and litigation expenses. Confirm reporting arrangements, conflicts of interest, confidentiality and responsibility for advice in other jurisdictions. A written assessment of available remedies and their limits is more useful than a promise that a platform will reopen an account or a court will invalidate a law.
Frequently asked questions
When do Türkiye's new social-network and gaming provisions commence?
Article 27(1)(a) of Law No. 7578 postpones Articles 22 and 23 for six months after publication, corresponding to 1 November 2026. It does not postpone the whole law or pre-existing social-network representation duties. Read the date with subsequent amendments and applicable implementing measures. See section 1.
Can parental consent override the Turkish under-fifteen restriction?
The new paragraph 7 does not provide that exception. Permission to process particular data or approve a purchase is a different legal question from permission to supply a restricted service. See sections 1 and 2.
Does a service have to retain every user's passport or biometric information?
No such universal requirement follows from the provisions discussed here. The method must meet the applicable assurance standard while respecting lawful-basis, necessity, security and retention requirements. The analysis depends on the method and jurisdiction. See sections 2 and 4.
Must every report concerning a child be resolved within one hour?
Not under the specific Turkish provision described above. That obligation concerns qualifying high-traffic social networks and urgent decisions under Article 8/A, not every report submitted by a user. Other obligations and deadlines may apply. See section 1.
Does GDPR require parental consent for all processing involving anyone under sixteen?
No. Article 8 addresses the defined situation of consent-based processing for information-society services offered directly to a child. National thresholds and other lawful bases require separate analysis. See section 4.
Have France and the United Kingdom adopted equivalent operative blanket bans?
The legal positions are different. France's 2026 blanket-ban provision was invalidated before promulgation. The cited UK announcement anticipates regulations and spring 2027 implementation. Neither should be substituted for an examination of the rules currently applicable to a service. See sections 5 and 6.
Can a foreign gaming company avoid the Turkish rules by having no office in Türkiye?
The new gaming provision expressly addresses qualifying foreign-based platforms and requires a Turkish representative above the specified access threshold. Whether other duties apply must be assessed separately; the representative threshold is not a general exemption for smaller businesses. See section 1.
What should a foreign client provide before the first legal consultation?
A provider should supply its service model, markets, relevant traffic information, age controls, data flows and any regulatory notice. A parent should describe the concern, the child's age, authority to act, the platform and existing correspondence. Agree a secure route before sending identity or sensitive records. See section 9.
Protecting children online requires more than selecting an age and adding a consent box. The legally significant questions are who may access a service, who may decide on a child's behalf, what information the provider may process and how a restriction can be challenged. Advice is strongest when it connects those questions to the actual product or family circumstances, identifies what is binding today and explains what remains uncertain.
Footnotes
1. Law No. 7578, adopted 22 April 2026; Official Gazette, 1 May 2026, No. 33240, Articles 22, 23 and 27(1)(a)-(b). Only Articles 22 and 23 have the six-month commencement rule, yielding 1 November 2026; the other provisions commenced on publication. Official-source refinement review: 10 September 2026. Enacted text; Publication record.
2. Law No. 7578, Article 22, replacing Law No. 5651, Additional Article 4(7). The text distinguishes children who have not completed fifteen from those who have completed fifteen and contains no parental-consent exception to the former restriction. Statutory text.
3. Law No. 7578, Article 22, inserting Law No. 5651, Additional Article 4(20) and (21), on parental controls and deceptive advertising; paragraph 7 addresses the differentiated service. Statutory text.
4. Law No. 7578, Article 22, Additional Article 4(22) and (23), read with the revised sanction provisions. Paragraph 22 refers to decisions under Article 8/A, immediate action within at most one hour, and more than ten million daily accesses from Türkiye. Different breaches have different enforcement conditions. Statutory text.
5. Law No. 7253, Article 6, inserting Law No. 5651, Additional Article 4(1), and Article 10 on commencement. This official 2020 enactment establishes the pre-existing representative obligation above one million daily accesses from Türkiye; it is not a consolidated statement of every current representative requirement. Read with subsequent amendments, including Law No. 7590. Official enacted text.
6. Law No. 7578, Article 23, inserting Law No. 5651, Additional Article 5: age classification, foreign-platform representation above one hundred thousand daily accesses, parental controls and a separate enforcement sequence. Article 21 supplies relevant definitions. Statutory text.
7. Law No. 7590, Official Gazette, 31 July 2026, No. 33326, Articles 26, 27(2), 27(5) and 31(f). Article 26 inserts Law No. 7545, Provisional Article 2(1), preserving existing secondary rules for transferred functions until replacement and adjusting institutional references. Article 27(5) amends Law No. 7578, Articles 22 and 23. Separate data-protection jurisdiction: Law No. 6698, Articles 21 and 22. Amending law; Publication record; Data-protection law.
8. Personal Data Protection Law No. 6698, Articles 4, 5 and 6, including the amended special-category provisions. Article 6 lists categories by the nature of the data, not the age of its subject. No general GDPR-style digital-consent age is specified in these provisions. Authority’s statutory text.
9. Personal Data Protection Board, 11 August 2020, Decision No. 2020/622, official decision summary concerning a minor’s health report and applications by the parent and child. The discussion relies on the published administrative summary, not a judicial precedent. Official Board summary.
10. Law No. 6698, Articles 4, 7, 9, 10 and 12: proportionality and retention, erasure, overseas transfers, information duties and security. The comparison of verification methods is legal risk-management analysis, not an assertion that a particular technology has official approval. Statutory text.
11. European Data Protection Board, Statement 1/2025 on Age Assurance, adopted 11 February 2025, version 1.2, including minor changes of 1 April 2025; sections 2.2 and 2.4 to 2.8, especially paragraphs 20 to 31. This is EU supervisory guidance, not a Turkish technical standard or an approval of any supplier. Official EDPB statement.
12. Constitution of the Republic of Türkiye, Articles 13, 20, 26 and 41. Constitutional analysis must address the applicable grounds of limitation and the affected rights; a statutory form alone does not establish substantive proportionality. Official constitutional text.
13. Constitutional Court, General Assembly, Wikimedia Foundation Inc. and Others, App. No. 2017/22355, 26 December 2019. The account relies on the Court’s official individual-application press summary, published 15 January 2020, rather than an independently retrieved full judgment. Official Court summary.
14. Law No. 6216, Articles 45(2), 45(3) and 46; Constitution, Articles 148 and 150 to 152. Individual applications, abstract review and judicial referrals have distinct admissibility and procedural requirements. Court’s statutory text; Constitution.
15. Constitutional Court, “16 Temmuz 2026 Genel Kurul Gündemi ve Sonuçları”, E.2026/172, item 11. This is an initial-review result referring to certain provisions of Law No. 7578. It does not identify each challenged provision or establish a merits judgment; subsequent developments require verification. Official procedural record.
16. Regulation (EU) 2022/2065, Digital Services Act, Articles 19, 25(1)-(2), 28(1)-(3), 34 and 35. Article 28 uses reasonable certainty, not a formal-verification prerequisite. Article 25(2) excludes practices covered by Directive 2005/29/EC or the GDPR from its paragraph 1 prohibition. Articles 34 and 35 cover designated very large online platforms and search engines. EUR-Lex statutory text.
17. European Commission, minors-protection guidelines under the DSA, published 14 July 2025; official explanatory page. The Commission states that the guidelines are voluntary and compliance with them does not automatically guarantee compliance with the DSA. See also DSA Article 28(3). Commission guidance; DSA.
18. Regulation (EU) 2016/679, GDPR, Articles 6(1)(a) and 8. Article 8(1) concerns specified consent-based processing, allows national thresholds no lower than thirteen, and Article 8(3) preserves Member States’ general contract law. EUR-Lex statutory text.
19. Online Safety Act 2023; Ofcom, “Online safety regulatory documents”, updated 25 June 2026, including children’s access assessments, children’s risk assessments and protection-of-children codes. The legal effect of codes and guidance should be distinguished from the statutory duties. Current Ofcom documents.
20. UK Government, “Fact sheet: New rules to protect children online”, updated 17 July 2026: proposed regulations before year-end and expected implementation in spring 2027. This is a policy and implementation announcement, not evidence that a general under-sixteen ban already applies. Government fact sheet.
21. Italy, Legislative Decree No. 196/2003, Article 2-quinquies, inserted by Legislative Decree No. 101/2018, Article 2. For reform status, see the official records for S.1136 and C.3016. Pending proposals are distinguished from enacted law. Normattiva text; S.1136 record; C.3016 record.
22. France, Law No. 2023-566 of 7 July 2023, particularly Articles 4 and 7. Senate, Bilan annuel de l’application des lois au 31 mars 2026, section on that law, records the implementation obstacle. The report’s earlier discussion of a successor proposal must be read with the August 2026 decision below. 2023 law; Senate implementation report.
23. French Constitutional Council, Decision No. 2026-911 DC, 14 August 2026, paragraphs 6 to 22 and operative Article 1; official full decision in Légifrance. The Council declared Article 1 unconstitutional, addressing expression, tailoring and safeguards for proving age. Official full decision.
24. France, Law No. 2026-813 of 24 August 2026, visant à protéger les mineurs des risques auxquels les expose l’utilisation des réseaux sociaux. The promulgated text records Article 1 as declared unconstitutional by Decision No. 2026-911 DC. Promulgated law.
25. Germany, Jugendschutzgesetz, especially sections 10a, 10b and 16, the latter addressing the state-law framework for electronic information and communication media; Jugendmedienschutz-Staatsvertrag; Basic Law, Article 5(1) and (2); GDPR Article 8. Youth Protection Act; Basic Law Article 5; GDPR.
26. COPPA, 15 U.S.C. §§ 6501 to 6506; implementing Rule, 16 C.F.R. Part 312, particularly §§ 312.2, 312.3 and 312.5. The FTC’s official final-rule publication explains scope, actual knowledge, consent and exceptions and supplies the amended regulatory text. Federal Register text.
27. FTC, Children’s Online Privacy Protection Rule, final amendments, 90 Fed. Reg. 16918, 22 April 2025. Effective 23 June 2025; general compliance date 22 April 2026, except as specified for § 312.11(d)(1), (d)(4) and (g). See amended consent, security and retention requirements. Official final rule; FTC publication record.
28. FTC, Enforcement Policy Statement Promoting the Adoption of Age-Verification Technology, 25 February 2026, especially pages 2 and 3. The conditional policy concerns general-audience and mixed-audience operators, requires otherwise complying with COPPA and creates no substantive entitlement. Its withdrawal or replacement must be checked before reliance. Full policy statement; Official publication record.
29. US Supreme Court, Brown v. Entertainment Merchants Association, 564 U.S. 786 (2011), No. 08-1448, decided 27 June 2011, particularly pages 790 to 805. Official United States Reports text, Government Publishing Office. Official judgment.
30. US Supreme Court, Free Speech Coalition, Inc. v. Paxton, No. 23-1122, decided 27 June 2025, majority slip opinion, especially pages 5 to 36. The holding concerns the specified harmful-to-minors sexual-material context, not a general social-network access prohibition. Official judgment.
31. Law No. 6698, Articles 7, 11, 13 and 14, on erasure, data-subject rights, applications to the controller and complaints to the Board. The requested remedy, representation, retention grounds and applicable procedural time limits require individual assessment. Statutory text.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
