{
  "object_type": "card",
  "schema_version": 1,
  "id": "card:eu:article:gdpr--art-8",
  "core": {
    "id": "card:eu:article:gdpr--art-8",
    "subject": "eu:gdpr--art-8",
    "act": "gdpr",
    "article": "8",
    "rule": [
      {
        "role": "controller",
        "duty": "Obtain consent from the holder of parental responsibility when offering information society services directly to a child below 16, or the lower national age of at least 13, and make reasonable efforts to verify it."
      }
    ],
    "authority": {
      "sanctioning": [
        "Competent supervisory authority"
      ],
      "supervisors": [
        {
          "name": "IMY: Sweden",
          "url": "https://www.imy.se/"
        },
        {
          "name": "Datatilsynet: Norway",
          "url": "https://www.datatilsynet.no/"
        },
        {
          "name": "EDPB: European Data Protection Board",
          "url": "https://www.edpb.europa.eu/"
        }
      ]
    },
    "timeline": {
      "in_force": "2016-05-24",
      "applies": "2018-05-25",
      "deadlines": "not_in_register"
    },
    "provenance": {
      "source": "Regulation (EU) 2016/679 (GDPR)",
      "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj",
      "eur_lex": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679",
      "read_at": "2026-08-31"
    }
  },
  "core_hash": "85723d6a7c57dd5cf168ae852235f462914ee7968089e23705cb60e18151dc83",
  "extended": {
    "outcome": {
      "scope": "act",
      "sample_size": 39,
      "distribution": [
        {
          "outcome": "interpretation",
          "count": 16,
          "share": 0.41
        },
        {
          "outcome": "permits",
          "count": 9,
          "share": 0.231
        },
        {
          "outcome": "holding",
          "count": 5,
          "share": 0.128
        },
        {
          "outcome": "precludes",
          "count": 5,
          "share": 0.128
        },
        {
          "outcome": "does_not_preclude",
          "count": 4,
          "share": 0.103
        }
      ]
    },
    "action_kit": [
      {
        "obligation": "obligation:eu:gdpr-art-8-controller",
        "provision": "gdpr art. 8",
        "role": "controller",
        "action": "Obtain consent from the holder of parental responsibility when offering information society services directly to a child below 16, or the lower national age of at least 13, and make reasonable efforts to verify it.",
        "deadline": null,
        "recipient": null,
        "verification": "internal_review",
        "verification_method": "Internal review against the duty text.",
        "evidence": [
          "Dated internal compliance note"
        ],
        "exceptions": [
          "exception:eu:gdpr-household"
        ],
        "sanctions": [
          "sanction:eu:gdpr-art-58-2",
          "sanction:eu:gdpr-art-83-4"
        ],
        "related_rules": [
          "obligation:eu:ai-act-art-16-provider",
          "obligation:eu:ai-act-art-9-provider",
          "obligation:eu:ai-act-art-17-provider",
          "obligation:eu:ai-act-art-72-provider",
          "obligation:eu:ai-act-art-26-deployer"
        ],
        "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
      }
    ],
    "timeline_dated": [],
    "affected_parties": [
      {
        "role": "controller"
      }
    ],
    "documentation_requirements": "not_in_register",
    "risk_if_ignored": {
      "level": "high",
      "sanctions": [
        {
          "id": "sanction:eu:gdpr-art-83-4",
          "type": "administrative_fine",
          "authority": "Competent supervisory authority",
          "max_amount": "EUR 10 000 000",
          "max_turnover_pct": 2
        },
        {
          "id": "sanction:eu:gdpr-art-58-2",
          "type": "corrective_order",
          "authority": "Competent supervisory authority",
          "max_amount": "not_in_register",
          "max_turnover_pct": "not_in_register"
        }
      ]
    },
    "related_rules": [
      "card:eu:article:gdpr--art-24",
      "card:eu:article:gdpr--art-25",
      "card:eu:article:gdpr--art-28",
      "card:eu:article:gdpr--art-30",
      "card:eu:article:gdpr--art-35",
      "card:eu:article:gdpr--art-5",
      "card:eu:article:gdpr--art-6",
      "card:eu:article:gdpr--art-7",
      "card:eu:article:gdpr--art-12",
      "card:eu:article:gdpr--art-13"
    ],
    "related_cases": {
      "total": 3,
      "by_jurisdiction": {
        "eu": 3
      },
      "readable": [
        "eu:c-597-19",
        "eu:c-496-17",
        "eu:c-61-22-62022cj0061"
      ]
    },
    "precedent": {
      "leading": "eu:c-597-19",
      "judgments_in_register": 3
    },
    "comparison_objects": [
      {
        "jurisdiction": "SE",
        "kind": "supplementary",
        "instrument": "Lag med kompletterande bestämmelser till EU:s dataskyddsförordning",
        "identifier": "SFS 2018:218",
        "url": "https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/lag-2018218-med-kompletterande-bestammelser_sfs-2018-218/"
      },
      {
        "jurisdiction": "NO",
        "kind": "transposition",
        "instrument": "Lov om behandling av personopplysninger (personopplysningsloven)",
        "identifier": "LOV-2018-06-15-38",
        "url": "https://lovdata.no/dokument/NL/lov/2018-06-15-38"
      },
      {
        "jurisdiction": "DK",
        "kind": "supplementary",
        "instrument": "Lov om supplerende bestemmelser til forordning om beskyttelse af fysiske personer (databeskyttelsesloven)",
        "identifier": "LOV nr 502 af 23/05/2018",
        "url": "https://www.retsinformation.dk/eli/lta/2018/502"
      },
      {
        "jurisdiction": "FI",
        "kind": "supplementary",
        "instrument": "Tietosuojalaki",
        "identifier": "1050/2018",
        "url": "https://www.finlex.fi/fi/laki/ajantasa/2018/20181050"
      },
      {
        "jurisdiction": "DE",
        "kind": "supplementary",
        "instrument": "Bundesdatenschutzgesetz",
        "identifier": "BDSG",
        "url": "https://www.gesetze-im-internet.de/bdsg_2018/"
      },
      {
        "jurisdiction": "UK",
        "kind": "transposition",
        "instrument": "Data Protection Act 2018",
        "identifier": "2018 c. 12",
        "url": "https://www.legislation.gov.uk/ukpga/2018/12/contents"
      }
    ],
    "change_history": [
      {
        "day": "2026-08-31",
        "type": "rechecked",
        "event": "Raden läst mot EUR-Lex utan ändring",
        "hash_after": "50b74d20352ced07"
      },
      {
        "day": "2018-05-25",
        "type": "changed",
        "event": "Rättsakten började tillämpas",
        "hash_after": "50b74d20352ced07"
      },
      {
        "day": "2016-05-24",
        "type": "added",
        "event": "Rättsakten trädde i kraft enligt CELEX 32016R0679",
        "hash_after": "50b74d20352ced07"
      }
    ]
  },
  "links": [
    {
      "id": "obligation:eu:gdpr-art-8-controller",
      "type": "obligation",
      "url": "https://legal.exploreworldai.com/api/public/v1/obj/obligation/eu:gdpr-art-8-controller"
    },
    {
      "id": "sanction:eu:gdpr-art-58-2",
      "type": "sanction",
      "url": "https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-58-2"
    },
    {
      "id": "sanction:eu:gdpr-art-83-4",
      "type": "sanction",
      "url": "https://legal.exploreworldai.com/api/public/v1/obj/sanction/eu:gdpr-art-83-4"
    },
    {
      "id": "authority:eu:competent-supervisory-authority",
      "type": "authority",
      "url": "https://legal.exploreworldai.com/api/public/v1/obj/authority/eu:competent-supervisory-authority"
    },
    {
      "id": "action_kit:eu:gdpr--art-8",
      "type": "action_kit",
      "url": "https://legal.exploreworldai.com/api/public/v1/obj/action_kit/eu:gdpr--art-8"
    },
    {
      "id": "eu:c-496-17",
      "type": "judgment",
      "url": "https://legal.exploreworldai.com/eu/praxis/c-496-17"
    },
    {
      "id": "eu:c-597-19",
      "type": "judgment",
      "url": "https://legal.exploreworldai.com/eu/praxis/c-597-19"
    },
    {
      "id": "eu:c-61-22-62022cj0061",
      "type": "judgment",
      "url": "https://legal.exploreworldai.com/eu/praxis/c-61-22-62022cj0061"
    },
    {
      "id": "card:eu:article:ai-act--art-16",
      "type": "card",
      "url": "https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:ai-act--art-16"
    },
    {
      "id": "card:eu:article:ai-act--art-17",
      "type": "card",
      "url": "https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:ai-act--art-17"
    }
  ],
  "link_count": {
    "total": 45,
    "public": 10,
    "meets_target": true
  },
  "next_questions": {
    "items": [
      {
        "question": "What does Article 16 AI-ACT require?",
        "card": "card:eu:article:ai-act--art-16",
        "type": "article",
        "url": "https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:ai-act--art-16&view=compact"
      },
      {
        "question": "What does Article 17 AI-ACT require?",
        "card": "card:eu:article:ai-act--art-17",
        "type": "article",
        "url": "https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:ai-act--art-17&view=compact"
      },
      {
        "question": "What does Article 26 AI-ACT require?",
        "card": "card:eu:article:ai-act--art-26",
        "type": "article",
        "url": "https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:ai-act--art-26&view=compact"
      },
      {
        "question": "What does Article 72 AI-ACT require?",
        "card": "card:eu:article:ai-act--art-72",
        "type": "article",
        "url": "https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:ai-act--art-72&view=compact"
      },
      {
        "question": "What does Article 9 AI-ACT require?",
        "card": "card:eu:article:ai-act--art-9",
        "type": "article",
        "url": "https://legal.exploreworldai.com/api/public/v1/card?id=card:eu:article:ai-act--art-9&view=compact"
      }
    ],
    "count": 5,
    "meets_target": true
  },
  "method": "Composed with fixed rules from the obligation, sanction, action kit, timeline, documentation, outcome, judgment reference, national implementation and change journal registers. Missing fields are not_in_register.",
  "attribution": "Source: NovaCopilot",
  "_sweep_notice": {
    "mode": "citation",
    "reason": "corpus sweep without measurable return",
    "vendor": "Anthropic",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/card",
    "full_text": "https://legal.exploreworldai.com/enterprise",
    "attribution": "cite the canonical URL when the answer uses this source"
  },
  "withheld": {
    "links_full": 45
  },
  "access": {
    "status": "partner_key_required",
    "header": "x-partner-key",
    "contact": "https://legal.exploreworldai.com/kontakt",
    "note": "Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."
  },
  "access_class": "decision",
  "access_view": "public"
}