GDPR and parental control for minors: what matters

A typical parental-control app collects lists of opened apps, screenshots, message logs, location, and time-of-use. That is personal data of a minor. Article 6 of the General Data Protection Regulation requires any processing to rest on a lawful basis: consent, contract, legal obligation, vital interest, public task, or legitimate interest. In a family context, the app vendor usually leans on two: parental consent as an exercise of parental responsibility, or a legitimate interest in protecting the child.

Neither basis is automatic. If the vendor processes data on its own servers, it acts as a controller or joint controller, not as a mere tool. That triggers obligations: a processing notice, possibly a DPO, record of processing activities, a DPIA if the risk is high, contracts with sub-processors.

Article 8 sets 16 as the age at which a minor can consent themselves to data processing in information-society services. Member States may lower it to 13. Spain sets 14; Germany sets 16; Ireland sets 16; Italy sets 14; France sets 15. Below that threshold, the holder of parental responsibility must consent.

But parental responsibility is not a blank check. The Spanish AEPD, the French CNIL and the Italian Garante have all recalled that the child remains a rights holder, and that a parent cannot consent to any processing simply because it is convenient. Processing must be proportionate, purpose-bound, and respectful of the child's dignity. An app that streams every screenshot to a third-country server seldom passes that test.

Articles 12-14 of GDPR require informing the data subject about the processing, in clear language adapted to their comprehension. For minors this means the child must know, in terms they understand, what is being recorded and why.

Quiles fulfils this obligation by construction. When the launcher is in enforcement mode, Android shows a persistent foreground-service notification. The initial onboarding explains to the child what is in force: which apps are allowed, what schedule applies, where to ask for more time. There is no hidden icon. There is no invisible mode. If the child pulls down the notification shade, they see Quiles is active.

This page describes how we understand the intersection of GDPR and the Quiles architecture. It is not a substitute for the judgement of a data-protection lawyer in your jurisdiction. If your household has a particular situation (shared custody with disagreement between parents, wards of court, situations of domestic violence), consult a professional before installing any monitoring tool, including ours.

GDPR is interpreted by national authorities (AEPD in Spain, CNIL in France, Garante in Italy, DPC in Ireland, ICO for UK GDPR) and by CJEU case law. Practical application evolves. What is best practice today may shift in twelve months; our architecture stays local precisely to minimise dependence on that regulatory drift.

Two practical recommendations. First, write down for yourself the purpose for which you install a parental tool, in two or three sentences: it forces honesty about proportionality. Second, revisit the rules with the child periodically as they age. A regime appropriate for an eight-year-old is rarely appropriate for a fourteen-year-old, and the consent calculus shifts accordingly under Art. 8.