EU Minor Consent Matrix

Status: Research protocol only. Country rows must be completed by counsel before school pilots. Default Lumi rule: For child users under 18, Lumi requires a valid adult/school authority path before child-data processing. Research refreshed: 2026-09-13 · Counsel confirmation: none.

Not legal advice. GDPR Article 8 applies only where the lawful basis is consent and an information-society service is offered directly to a child. The GDPR default is 16; Member States may set a lower age, but never below 13. A cross-border service may need to account for the national law in each country where it is offered. This matrix deliberately requires local confirmation before any school pilot and never converts a research note into legal approval.

Primary research sources

• GDPR, Article 8:

the operative EU law.

• European Commission child-data guidance:

the threshold varies from 13 to 16 and the controller must make reasonable verification efforts.

• EDPB consent guidelines:

Article 8 has the two conditions above; it does not decide a school’s separate lawful basis.

• EDPB national supervisory-authority directory:

the authoritative route to the competent authority. Austria, Belgium and Germany have split competence, so counsel must identify the correct authority for the actual pilot.

Global rule for Lumi

• Direct family use: parent or legal guardian consent is required for every child profile.
• School use: the school must document its lawful basis and authority to deploy Lumi, and Lumi must support parent/guardian notice or consent where the school's law and policy require it.
• Child self-signup is not allowed.
• Child-data processing must remain blocked until the authority path is complete.

Country matrix

Evidence required per country

• Counsel confirmation of whether Article 8 is engaged for the actual family and school flows; do

not assume that a school’s lawful basis is consent.

• Local age-of-digital-consent confirmation if Article 8 is engaged, including the exact national

provision and retrieval date.

• Whether school public-task/legal-obligation basis is available and which organisation is the

controller for the intended pilot.

• Whether parent notice or parent consent is required by the school or national law.
• Whether special rules apply to private schools.
• Whether special rules apply to religious schools.
• Whether a national or regional DPIA template is recommended.
• Competent supervisory authority and complaint path, selected from the EDPB directory rather

than copied from an old contact list.

• School procurement or data-hosting requirements.
• Accessibility obligations beyond Lumi's baseline.

Required country decision record

For each country, counsel must retain a dated record containing the pilot organisation, the exact service flow, proposed lawful basis, applicable age rule (if any), the national-law source URL, the competent authority, notice/consent requirements, any regional or school-type constraint, and the named reviewer. Until that record and independent verification are present, Pilot allowed remains No.