1 Rights-based Approaches Against Risk-based Narratives

At the young ages of six and seven, 40% of children in Germany used the internet in 2019. This percentage only increases with age, with 71% of those aged eight to nine, 85% of those aged ten to eleven, and 97% of those aged 12 to 18 being active internet users.Footnote 1 This is not surprising given that a considerable part of sociality has shifted from analogue to digital means, such as communication via social networks and smartphone apps.

Communication in the digital age encompasses not only messaging services, but also content creation on social media for the public or a selected audience. Social networking sites have become such an integral part of young people’s everyday lives that it is practically out of the question for young people to reject this form of communication.Footnote 2 Children’s main focus with online activities is actually communicating within existing relationships, i.e. the reinforcement of relationships with peers.Footnote 3 Creating and maintaining social capital is one of the social benefits of children’s online activities.Footnote 4 Taking part in online sociality can also prevent isolation of children.Footnote 5 A large part of children’s identity practices and experimentation takes place online.Footnote 6 In addition, it can further young people’s engagement with public life.Footnote 7 Digital spheres offer specific opportunities for (civic) engagement and participationFootnote 8 as well as for creativity.Footnote 9 Not all of these benefits are the focus of adults who decide about children’s participation, such as lawmakers and parents.Footnote 10 Parents especially associate more risks than benefits with their children’s use of mobile technology, including addiction, neglect of other activities, cognitive absorption, decrease in physical activities, impairment of physical health and cognitive development, decrease in personal interaction, and impairment of social skills.Footnote 11 These rather concrete concerns are accompanied by further, vague parental concerns.Footnote 12

Children’s digital participation also concerns smart toys, enabling toy-child interaction, often with the use of “Artificial Intelligence” functions. Such toys can make enhanced learning experiences possible.Footnote 13 In doing so, they generally record information and transmit it offsite,Footnote 14 oftentimes creating cross-border data streams. Toymakers increasingly record more data,Footnote 15 leading to a ‘datafication’ of children.Footnote 16 In connection with internet-connected toys,Footnote 17 data hacking and other encroachments upon privacy and security have occurred,Footnote 18 most prominently with regard to Mattel’s ‘Hello Barbie’Footnote 19 and VTechFootnote 20 hacks.Footnote 21 Mattel’s talking ‘Hello Barbie’ doll recorded human’s speech when interacting and transmitted it to its partner ToyTalk, which then used it to improve its speech recognition technology.Footnote 22 Parents could also listen to their children’s conversations. In such a way, connected toys can be used as surveillance mechanisms by parents and third parties, with parental consent or by hacking.Footnote 23 Children are often unaware that their data is being processed, contrary to general principles of data protection lawFootnote 24 and family law,Footnote 25 which generally foresee their involvement according to their abilities.Footnote 26 At present, it is hard to tell what ramifications this data collection will have for children. Both the potential and the risks associated with emerging digital spheres are only just beginning to be better understood and outlined.Footnote 27

The magnitude of known risks as well as the uncertainty regarding further risks, both at present and in the future, has led to a risk-based narrative.Footnote 28 This is firstly true for coverage in popular media about children’s participation in connected activities.Footnote 29 Furthermore, risks pertaining to children’s use of online communication tools have also been found to be ‘grossly overstated’ in scholarly literature.Footnote 30 Children’s need for protection is thus emphasized, while the benefits associated with them partaking in digital communication, sociality, and play tend to be undervalued.

Children’s rights have been employed to balance that narrative and formulate their needs in an increasingly digitalized world from an educational and socio-psychological perspective.Footnote 31 Social psychologist Sonia Livingstone in particular has promoted the idea of basing children’s claims on their fundamental rights, namely those provided for in the United Nations Convention of the Rights of the Child (UNCRC).Footnote 32 This chapter aims to demonstrate the impact of a rights-based approach from a juridic point of view and with special regard to specificities of European Union (EU) legal architecture, principles, and multi-level norm-setting.

2 Children’s Rights in the EU and Transnational Digital Spheres

Children’s rights are enshrined in various instruments at multiple regulatory levels. Around the world—albeit not in the United States—children’s rights are guaranteed by the UNCRC. The UNCRC has had a lasting effect on our understanding of children’s rights and their individual agency,Footnote 33 and it has proven to be a “touchstone for children’s rights throughout the world”.Footnote 34 As an instrument of public international law, its incorporation into internal national legal systems varies according to the respective legal order. In 47 countries, it is complemented by the Council of Europe’s European Convention of Human Rights. European children’s rights law is largely based on the UNCRC.Footnote 35 Within the EU and the scope of application of EU law, the EU Charter of Fundamental Rights applies. Some national constitutions also provide for specific children’s rights,Footnote 36 while others do not formulate fundamental rights for children specifically.Footnote 37

When the Lisbon Treaty took effect in 2009, the European Community became the European Union, and the protection of children’s rights was included in the general objectives in Art. 3 of the Treaty on European Union (TEU). The Charter of Fundamental Rights (hereafter EU Charter) was attributed the same legal status as the Treaties.Footnote 38 The EU Charter’s influence on the Court of Justice of the European Union (CJEU), however, even predates its entry into force.Footnote 39 Once proclaimed by the EU Parliament, Council, and Commission in 2000,Footnote 40 the Advocate Generals already began relying upon the EU Charter.Footnote 41 Before the existence of an EU fundamental rights catalogue, the CJEU drew on the shared constitutional traditions of the Member States, determined by means of evaluative comparative law,Footnote 42 as well as on international treaties common to the Member States, such as the European Convention on Human Rights (ECHR).Footnote 43 Hence, the EU Charter does not stand incoherently alongside the other instruments for the protection of children’s rights.

The EU Charter holds not only great symbolic valueFootnote 44 and consequence for the constitutional architecture of the Union, but also for the protection of children’s rights.Footnote 45 Various rights of the EU Charter are of particular relevance for children, such as Art. 7, which safeguards private and family life as well as home and communications, the right to receive free education under Art. 14 and the prohibition of discrimination on grounds of age under Art. 21. General fundamental rights of the EU Charter extend to children as well.Footnote 46 Moreover, the changes brought about by the EU Charter gave visibility to children’s rights.Footnote 47 Building on the UNCRC,Footnote 48 Art. 24 of the EU Charter specifically addresses and recognizes children’s rights at the EU level. According to Art. 24 (1), children shall have the right to such protection and care as is necessary for their well-being (Sentence 1). They may express their views freely (Sentence 2), and these views shall be taken into consideration on matters which concern them in accordance with their age and maturity (Sentence 3). Art. 24 (2) mirrors Art. 3 of the UNCRC. According to these provisions, the child’s best interests must be a primary consideration in all actions concerning children. This principle of the best interest of the child and the principle of child participation are related to the understanding of children as autonomous rights holders. The recognition of children as such rights holders with individual agency is one of the key accomplishments of the UNCRC.Footnote 49 Its significance not only unfolds in analogue contexts,Footnote 50 but is also a fundament for the UNCRC’s potential in digital contexts.Footnote 51

As an international human rights instrument, the UNCRC is part of the general principles of EU law, thus binding the EU when setting, interpreting, and applying law.Footnote 52 The EU has pledged to implement children’s rights in line with the UNCRC,Footnote 53 and the EU Commission has reaffirmed this commitment in key EU legal and policy documents.Footnote 54 Legal acts, such as the EU Citizenship DirectiveFootnote 55 or the General Data Protection Regulation (GDPR),Footnote 56 contain references to children’s well-being and protection.Footnote 57 But the EU is still far away from realizing its potential as a children’s rights actor.Footnote 58 While the EU may not have the competence to set legal norms in a number of areas, more and more aspects of children’s lives are regulated at the supranational level, as online activities are transnational in nature. TikTok and Facebook, for example, are active in over 150 countries, with the short video application TikTok popular among young people in particular.Footnote 59 The protection of minors on video platforms is one of the areas the EU has regulated in its Audiovisual Media Services Directive (EU AVMSD).Footnote 60 So far, the EU’s instruments have focused on children’s rights to protection rather than on their rights to participation.Footnote 61 A rights-based approach in the EU can counteract one-sided, risk-based narratives of children’s digital activities already at the norm-setting stage. Both reactive and proactive policies require careful evaluations of both their objectives and the strategies for their realization with regard to affected fundamental rights.Footnote 62

3 Balancing Rights to Participation and Protection

Regarding the participation of children in online contexts, a number of fundamental rights are relevant,Footnote 63 including the right to education,Footnote 64 freedom of expression,Footnote 65 children’s privacy,Footnote 66 and their right to play.Footnote 67 Children’s rights are often divided into three categories: rights to provision, protection, and participation.Footnote 68 Children’s protective and participative rights must be balanced. Following a rights-based approach means closely looking at regulatory measures as limitations of children’s rights, which need to be justified. A risk-based narrative cannot cancel out children’s claims. Even in light of danger to their safety, children have a right to privacy.Footnote 69

The EU AVMSD, for example, contains measures “to protect minors from harmful content” (Recital 4) on video sharing platforms.Footnote 70 While the specific risks children encounter on such platforms are mentioned, there is no reference to specific benefits from their participation. Much like the accessibility of audiovisual content for elderly people and those with impairments was stated in Recital 22 to further their integration in the social and cultural life of the EU, the situation of children should have also been included. Participatory children’s rights have, however, not found their way into the recited motives of the AVMSD, despite shaping the limits of such restrictions on children’s participatory rights.

In addition to the freedom of expression (Art. 13 of the UNCRC), children’s right to engage in play and recreational activities as well as to participate freely in cultural life and the arts (Art. 31 of the UNCRC) is limited. In the context of children’s access to information and material from a diversity of national and international sources, Art. 17 of the UNCRC in lit. (e) also refers to the development of appropriate guidelines for the protection of the child from information and material injurious to their well-being, but not without mentioning that Art. 13 and 18 of the UNCRC must be borne in mind. A rights-based approach to children’s activities online highlights the interplay between protection and participation. Children’s freedom of expression, for example, may be limited by protective measures, which in turn even increase the benefits of children’s online activities.

Given the risk-based narrative, which is susceptible to influence both norm-setting and judicial review, it is important to highlight these links and make the balancing of rights. As part of the judicial review, such balancing involves weighing each interest and considering all circumstances of the case in order to determine whether a fair balance was struck between interests in the particular case at hand.Footnote 71 The balancing of children’s protective and participative rights is, of course, directly linked to the implementation of the principle of the best interests of the child.Footnote 72 From the point of view of legal psychology, the best interests of the child are ensured if the child’s needs are in harmony with their living conditions and family situation,Footnote 73 so that age-appropriate personality development is possible.Footnote 74

4 Implementing the Legal Principle of the Best Interest of the Child

The core principle of the best interests of the child (Art. 3 of the UNCRC, Art. 24 (2) of the EU Charter) shall ensure the full and effective enjoyment of all UNCRC rights.Footnote 75 It contains a fundamental interpretative legal principle, a substantive right, and a rule of procedure.Footnote 76 The principle of the best interests of the child influences the interpretation of legal norms: “If a legal provision is open to more than one interpretation, the interpretation which most effectively serves the child’s best interests should be chosen.”Footnote 77

As holders of the substantive right, children have a right to have their best interests assessed and taken into account as a primary consideration.Footnote 78 This applies not only when determinations concerning an individual child are made, but also when decisions affect groups of children or children in general.Footnote 79 Procedurally, the principle of the best interests of the child includes the evaluation of the impact of these decisions on the children concerned.Footnote 80 In addition, the justification of a decision must show that the right has been explicitly taken into account by explaining “what has been considered to be in the child’s best interests, based on which criteria and how the child’s interests have been weighed against other considerations, be they broad issues of policy or individual cases”.Footnote 81 In order to satisfy these requirements, trans-sectorial analyses can be necessary. In particular, regulatory measures from different legal areas, such as data protection, platform regulation, youth media protection, contract law, and family law, may have to be considered collectively in order to understand the impact of the legal situation on children. This may also include measures that do not target children specifically, but that might affect children differently than adults.

5 Proportionality and Coherence of Measures in the EU

The principle of proportionality plays an exceptional role in protecting children’s rights, specifically in the EU. It not only limits restrictions on children’s rights to the necessary amount, but also assures a certain coherence of measures in this multi-level system. The principle of proportionality does not only govern the balance of principles and rights, but also the balance of EU and Member State responsibilities and interests.Footnote 82

With Art. 7 of the Treaty on the Functioning of the European Union (TFEU), a general, cross-cutting clauseFootnote 83 at the beginning of the operative part outlining EU policies is dedicated solely to coherence, hereby stressing the importance of the principle of coherence in primary law.Footnote 84 According to that provision, the EU shall ensure consistency between its policies and activities, taking all of its objectives into account and abiding to the principle of conferral of powers. The legal principle of coherence even extends beyond Art. 7 of the TFEU.Footnote 85 It is a general principle of lawmaking,Footnote 86 applicable to all EU law.Footnote 87 Additionally, coherence is an expression of the principle of proportionality.Footnote 88 While coherence as part of the proportionality test is not the coherence requirement of Art. 7 of the TFEU, it is based on the same theoretical background.Footnote 89

The proportionality test is applied in different contexts and thus takes on meaning beyond the compatibility of national measures in purely national contexts. Much like the proportionality test in purely national contexts, the legality of EU restrictions on children’s rights is reviewed with regard to the principle of proportionality in Sect. 5.1, while aspects of proportionality and multi-level coherence in the EU will be discussed in Sect. 5.2.

5.1 Justification of EU Limitations to Children’s Rights

At EU level, the principle of proportionality is enshrined in Art. 52 (1) 2nd st. of the EU Charter and corresponds to a general principle of EU law.Footnote 90 Under Art. 52 (1), any limitation on the exercise of the rights and freedoms recognized by this Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations are only legal if they are necessary and genuinely meet objectives of general interest acknowledged by the EU or the need to protect the rights and freedoms of others. The CJEU has long held—even before the Treaty of LisbonFootnote 91—that restrictions may be imposed on the exercise of fundamental rights, but only if they correspond to objectives of general interest and do not constitute a disproportionate and intolerable interference in relation to the aim pursued.Footnote 92 The proportionality test generallyFootnote 93 includes an evaluation of objectives, suitability, and necessity.Footnote 94

In that context, a focus on children’s rights sheds light on specific consequences for children. Regulations for the Digital Single Market, such as the Directive on copyright and related rights in the Digital Single Market (DSM Directive),Footnote 95 are not aimed at children particularly. Children’s experience online, especially on online platforms, differ from those of adults. They encounter certain particular risks, such as grooming, and rely to a greater extent on online communication to maintain social connections. The reach of filtering and monitoring obligations of these platforms, such as those following from the DSM Directive, the E-Commerce Directive,Footnote 96 and the planned Digital Services Act,Footnote 97 therefore needs to be evaluated with regard to children’s distinct situation online. In cases where children are concerned, the balancing of rights with a view to monitoring obligations on platforms might have a different outcome than in situations involving only adult users and platform operators.Footnote 98

The special effect on children can also stem from an interplay with other legal instruments aimed at children specifically. For video sharing platforms, for example, the EU lawmaker has introduced specific protective measures for children with the AVMSD.Footnote 99 With regard to EU legislation, the coherence requirement in Art. 7 of the TFEU applies directly. First of all, the EU itself is obliged to maintain stringency and systemic justice in its measures.Footnote 100 Beyond that, it is the interplay between national and EU measures that characterizes the protection of children’s rights in the EU. Such protection in the context of audiovisual media, for example, is complemented by German national provisions in the Interstate Treaty on the Protection of Minors in the Media,Footnote 101 the Protection of Minors Act,Footnote 102 and the Network Enforcement Act.Footnote 103

5.2 Limits to Member State Limitations to Children’s Rights

In addition to the supranational level of EU law, legal norms are set at the level of the Member States. Further regulatory levels existing in Member States, such as the German states (Länder), are only relevant within each Member State.Footnote 104 Member States may not rely on provisions, practices, or situations of its internal legal order in order to justify non-compliance with its obligations under EU law.Footnote 105 A coherence of measures must be ensured at the Member State level, i.e. in Germany at the federal level.Footnote 106

Competences not conferred on the EU by the Treaties remain with EU countries (Art. 4 and 5 of the TEU). The use of these competences is governed by the principles of subsidiarity and proportionality, designed to limit the powers of the EU vis-à-vis Member States.Footnote 107 The negative presumption of competence in favor of the Member States has now been explicitly laid down in Art. 4 (1) and Art. 5 (2) 2nd st. of the TEU.Footnote 108 Residual competences remain with the Member States. Member States must, however, also respect EU law even when they exercise powers falling within their exclusive competences.Footnote 109 In that context, coherence serves as a constraint on the national legislator’s room for maneuver.Footnote 110

In Zenatti, the CJEU already invoked the idea of coherence when directing the national court to verify whether “the national legislation is genuinely directed to realising the objectives which are capable of justifying it and whether the restrictions which it imposes do not appear disproportionate in the light of those objectives”.Footnote 111 Relying on Zenatti, the Court went on to specify in Gambelli that national restrictions in the general interest must also be suitable for achieving those objectives, inasmuch as they must serve to reach the objectives “in a consistent and systematic manner”.Footnote 112 If this requirement is not fulfilled, the CJEU finds the concerned Member State’s restrictions are not suitable.Footnote 113 Coherence is thus used as a criterion for proportionality, to be assessed as part of the first of the three steps, which examines the suitability of the measure.Footnote 114 Some authors, however, do not see coherence as part of proportionality, but as a separate barrier that imposes additional requirements on a regulation of the Member States.Footnote 115 National measures must first be tested for individual proportionality and subsequently for coherence with other measures. Notwithstanding the classification, the coherence test entails a comprehensive evaluation of the legislator’s overall concept, including all measures in the relevant regulatory area.Footnote 116 Derogations do not necessarily impair coherence.Footnote 117 Several measures must, however, be coordinated and consistent with one another.Footnote 118 For example, various national regulations relating to gambling, player protection, prevention of addiction, and prevention of crime were considered together.Footnote 119

The development of the criterion of consistency is intertwined with CJEU jurisprudence on the justification of the encroachment on the freedom to provide services by the ban on organizing and brokering games of chance.Footnote 120 This strand of case law is also related to the concurrence of national competences for regulation and cross-border elements due to the use of the internet. In Carmen Media, a company based in Gibraltar took action against the rejection of its application by the State of Schleswig–Holstein to be allowed to offer sports betting online.Footnote 121 Member States enjoy discretion in setting the objectives of their policy.Footnote 122 It is also not necessary, with a view to the criterion of proportionality, that “a restrictive measure decreed by the authorities of one Member State should correspond to a view shared by all the Member States concerning the means of protecting the legitimate interest at issue”.Footnote 123

Member State discretion extends to the level of protection sought.Footnote 124 Particularly in areas where cultural or moral values are rooted in national traditions, Member States are largely free to determine the level of protection they wish to provide.Footnote 125 This applies beyond gambling, health policy,Footnote 126 and prohibitions under criminal law.Footnote 127 Especially with regard to family law and a harmonization or unification in Europe, the rootedness of the law in the national cultural context is emphasized.Footnote 128 With family law, general contract law, and tort law in Member State hands, the level of protection and autonomy of minors is largely determined by Member States.

It is essential for the application of the coherence requirement that all relevant measures across legal areas are identified. The principle of coherence applies only insofar as an interrelation or (systemicFootnote 129) connection between regulated subject matters exists.Footnote 130 The rights-based approach to children’s participation online facilitates the application of the principle of coherence, as it can help identify all legal areas relevant for children’s participation. Regarding multiple aspects of children’s activities online, Member State competences are touched upon. Joining a social network and posting user-generated content, for example, might trigger the application of general contract law including the child’s (limited) legal capacity to contract, tort law, and penal law, including special provisions from copyright law.

With the level of protection being determined by Member States, national limits on children’s autonomy do not only vary in accordance with the subject matter and associated risks, but also from Member State to Member State. While it is the national lawmakers’ prerogative to assess the risks and determine minimum age requirements for children accordingly, they must still be consistent with one another. With regard to the focus on risks in online environments rather than on the potential of children’s participation online, this coherence can be assured by contrasting state limitations on children’s participation in analogue and digital sectors. For example, the capacity to contract is determined irrespectively of the (technological) means used. Even though situations encountered by children are arguably comparable among Member States, the growing recognition of children’s autonomy with increasing development and age differs from Member State to Member State.

The preconditions for contractual capacity of children, for instance, are subject to diverse national regulations.Footnote 131 The majority of Member States foresee age-based gradations of children’s contractual autonomy.Footnote 132 In German law, for example, minors below the age of seven are legally incompetent.Footnote 133 Between the ages of seven and 18, the persons have limited legal capacity,Footnote 134 meaning that their acts are only legally effective if they are purely legally advantageous or if the holder of parental responsibility consents.Footnote 135 Similar to the German law, advantages for the child often lead to an earlier autonomy.Footnote 136 Minors with a commercial enterprise or professional activity are accorded more autonomy within related fields.Footnote 137 Routine daily transactions are also privileged in many legal orders,Footnote 138 as are transactions of minors using their own (pocket) money.Footnote 139 The cognitive faculty of children is largely drawn from their age. In a number of circumstances, however, the development of the individual child in question is decisive.Footnote 140 The legal effectivity of acts then presupposes the individual maturity of the acting child.Footnote 141 Declarations made by persons lacking capacity are null and void under the legal orders of other Member States,Footnote 142 unless the legal representative consents.Footnote 143 However, the protection of minors can also be realized by giving rights to rescindFootnote 144 or withdraw fromFootnote 145 the contract and to have the contract declared invalid by court order.Footnote 146

While both prerequisites for contractual capacity and legal consequences of its limitation or lack of it vary, common points could already be identified in this short comparative overview,Footnote 147 begging the question whether national legal cultures would really prohibit European harmonization.

6 Interplay of EU and National Legal Norms

Due to the increasing importance of the Digital Single Market,Footnote 148 more and more subject matters also fall under the competence of the EU. The relationship between EU and Member States is based on the principle of loyalty (Art. 4 (3) of the TEU), which applies to all areas of EU activity. The EU thus generally offers limited answers to more general questions, i.e. sectorial approaches, that are then complemented by national legal norms.Footnote 149 Specific effects on children can result from the interaction of norms from different areas or from norms of different levels.

6.1 Interplay of EU and National Law in the Same Legal Area: The Example of Art. 8 (1) of the GDPR

A prime example for the interplay of EU and national law in the same legal area is the protection of children’s data. The EU’s GDPR contains a number of specific provisions on the protection of children’s data. Art. 8 of the GDPR provides the conditions applicable to a child’s consent in relation to the offer of information society services directly to a child. At least from the age of 16, minors are able to give their own effective consent to the processing of their data in accordance with Art. 8 of the GDPR.Footnote 150 Art. 8 of the GDPR thus standardizes specific requirements for consent pursuant to Art. 6 (1) (a) of the GDPR for personal data of minors.Footnote 151 Lowering the age of consent to not less than 13 years of age is possible by national regulation.Footnote 152 If the minor has not yet reached the relevant age limit, consent may be given either directly by the parents or guardian or, with their consent, by the minor themself.Footnote 153

The provision of Art. 8 of the GDPR is complemented by Art. 12 of the GDPR, according to which particularly clear and simple language must be used in cases where information is addressed to children.Footnote 154 The use of such child-friendly language reflects the GDPR’s recognition of the heightened need for protection of children.Footnote 155 Art. 17 (1) (f) of the GDPR also provides for a separate right to delete data that was collected on the basis of Art. 8 of the GDPR,Footnote 156 even if the processing of the data was lawful.Footnote 157 It allows protected persons to request the deletion of content they have disclosed on the basis of consent under Art. 8 of the GDPR, even once they have reached adulthood. Data protection authorities have a duty to inform and educate under Art. 57 (1) (b) of the GDPR,Footnote 158 which particularly benefits children’s informed consent under Art. 8 of the GDPR.Footnote 159

Although the GDPR as Regulation is directly applicable in all Member States, Member States still have room to maneuver when it comes to the definition of data minors. This is remarkable, as the GDPR aims to level out differences in the degree of protection of the rights and freedoms of natural persons in connection with the processing of personal data in Member States according to its Recital 9. While the purpose of the GDPR’s predecessor, the Data Protection Directive, was to achieve comprehensive harmonization,Footnote 160 the GDPR was also intended to reduce obstacles to the free movement of data in the internal market through a unification of law (cf. Art. 1 of the GDPR). Due to the introduction of the opening clause in Art. 8 (1) 3rd st. of the GDPR, only a partial harmonization of children’s autonomy has been achieved. The harmonization effect relates on the one hand to the autonomy of 16 to 18-year-olds under data protection law and on the other to the protection of children up to the age of 12. For minors between the ages of 13 and 16, harmonization has also been achieved, but merely to the extent that the child’s ability to consent is only to be considered on a blanket basis, namely by setting a rigid age limit. The opening clause does not allow for the possibility of reverting to a flexible model of age assessment based on capacity of insight. Member States have made use of this opening clause, leading to a diversity of national regulations on the child’s consent in the scope of application of Art. 8 of the GDPR.Footnote 161 It is private international law that designates the applicable legal order.Footnote 162

Furthermore, Art. 8 of the GDPR has a rather limited scope of application. It only covers data processing in connection with information society services.Footnote 163 In order to define the term ‘information society’, Art. 4 No. 25 of the GDPR refers to the definition in Art. 1 No. 1 (b) of the Directive 2015/1535.Footnote 164 Services provided via the internet are included.Footnote 165 It is necessary that the offer is made directly to the child, e.g. by a child-friendly design.Footnote 166 For reasons of expediency, so-called dual-use offers should be included, as well as offers to the general public.Footnote 167 It is also a prerequisite that consent is involved as an element of justification for the collection of data.Footnote 168

Even within the scope of application of Art. 8 of the GDPR, national laws come into play regarding the question of the persons giving or authorizing consent. Art. 8 of the GDPR refers to the holder of parental responsibility. The law on parental responsibility remains part of Member States’ competences.Footnote 169 Beyond the scope of application, national law generally determines the conditions for the child’s consent.Footnote 170 In German law, this means that the ability to give consent in the individual case is decisive, as was already the case under the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) before the GDPR entered into force.Footnote 171 It cannot be deduced from this EU Regulation that national orders must assume a capacity to consent starting at the age of 16,Footnote 172 but once this age threshold is reached, it is generally presumed that the necessary capacity for understanding exists.Footnote 173

6.2 Interplay of EU Law and National Law Across Legal Areas: The Example of Art. 8 of the GDPR and National Contract Law

Finally, Art. 8 (3) of the GDPR explicitly states that it shall not affect the general contract law of Member States, such as the rules on the validity, formation, or effect of a contract in relation to a child. General contract law, as part of Member States’ competences, is thus not affected by the provision on the effectiveness of consent under data protection law.Footnote 174 But what influence do Member State rules on contractual legal autonomy have on data autonomy within the scope of application of Art. 8 of the GDPR? As per Art. 6 (1) (b) of the GDPR, data processing is lawful insofar as it is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. Read together, the national rules on contractual capacity thus determine children’s data autonomy in the context of the respective contract. GDPR contains no indications, specifically with regard to children, that the application of Art. 6 (1) (b) of the GDPR should be excluded.Footnote 175 If the applicable rules on contractual legal capacity are followed, parental consent under data protection law is not required if the person with limited legal capacity can effectively conclude it without parental consent.Footnote 176 The data processing based on the contract does not have to meet the additional requirements of Art. 8 (1) of the GDPR.Footnote 177

For the purposes of the contract, the permission for data processing lies within the conclusion of the contract (Art. 6 (1) (1) (b) of the GDPR).Footnote 178 Broad national rules, e.g. regarding contractual capacity when spending pocket money,Footnote 179 thus entail further consequences regarding the processing of data and associated risks, even though national rules on the necessary age or individual development do not address the children’s capacity to understand the significance of decisions regarding their data. Hence, EU law extends national rules on general contractual capacity to data protection law. This leads to a hybridization of these norms.Footnote 180 National contract law becomes EU data protection law through the GDPR.

While Art. 8 (1) 3rd st. of the GDPR is a testament to the national diversity and political power of the Member States despite the common goal of an EU digital market,Footnote 181 Art. 8 (3) does not, in fact, respect national legal traditions and law. Rather, EU law extends the proxies used for children’s capacity to conclude contracts, mainly individual development or attainment of a certain age, to another legal area where Member States do not necessarily use the same proxies. For example, German general contract law confers legal capacity to contract based on the attainment of a certain age, while the capacity to decide on the processing of data is determined in accordance with the individual development and ability to understand the significance of that particular decision. Under the German Federal Data Protection Act (BDSG), such an understanding was generally assumed at 14 years or older, and each individual case had to be considered. The individual age limit could also be higher.Footnote 182 The extension of contractual capacity into data autonomy in the framework of the GDPR bridges the gap between rules for the analogue and digital worlds, with rules on contractual capacity of minors being developed with regard to analogue contexts and Art. 8 of the GDPR applying to specific digital contexts. The interplay of EU law and national law across legal areas makes an approach based on the specific effects on the exercise of children’s rights all the more important.

7 Conclusions

Against risk-based narratives, which one-sidedly further the protection of children in digital spheres, a rights-based approach to children’s digital participation underscores vital points for their digital participation in the multi-level system of the European Union. The European Union’s role as a children’s rights actor has gained considerable importance with regard to digital and therefore commonly transnational contexts as well as in the EU’s legislative agenda with regard to the digital single market. Children’s rights, as established in the EU Charter, the ECHR, and the UNCRC, contain both protective and participative dimensions that need to be balanced. Currently, the benefits of children’s digital participation are not yet adequately reflected in legislative motives, regulations, and directives. The balancing of children’s protective and participative rights is directly linked to the implementation of the principle of the best interests of the child, which contains an interpretative legal principle, a substantive right, and a rule of procedure. Children’s best interests must be the primary consideration, also amid a large number of stakeholders. The principle of the best interests of the child requires a specific evaluation of the impact of these decisions on the children concerned and a justification demonstrating that the best interests of the child has been expressly taken into account when weighing interests. Depending on the issue and measure at hand, trans-sectorial analyses can be needed in order to carry out that impact assessment and give a suitable justification.

Children’s digital participation can be affected by a number of different instruments from various, partly overlapping legal areas, such as contract law, family law, private international law, platform regulation, and media law (including youth protection). As a result of sector-specific approaches and corresponding specializations of legal scholars analyzing the legal instruments, effects of such tools are rarely evaluated comprehensively. Instruments can also stem from various levels of norm-setting, such as the EU and Member State level. A rights-based approach emphasizes the need for integrative analyses, firstly, with regard to measures from different legal areas and secondly, with regard to those from different regulatory levels.

The principle of proportionality does not only govern the justification of EU limitations to children’s rights, but also the balance of EU and Member State responsibilities and interests. National limits on children’s participation and autonomy may vary, but coherence serves as a constraint on national legislators’ room to maneuver when exercising their competences. Specifically, Member States need to ensure coherence of all national measures in the relevant regulatory area. The rights-based approach to children’s participation online facilitates the application of the principle of coherence, as it can help identify all legal areas relevant for children’s participation in that specific context. As the example of children’s data autonomy shows, the interplay of EU and national law can not only take the shape of (partial) EU harmonization and supplement national law,Footnote 183 but also lead to hybridization, e.g. when EU law extends national rules on general contractual capacity to data protection law. In these cases, the rights-based, integrative approach becomes all the more important for the protection of children’s rights to digital participation in the European Union.