Europe’s Privacy Regulators Built a Classroom. What the EDPB’s Privacy for Kids Hub Tells Companies About Children’s Data

Europe’s data protection authorities have spent years fining platforms over how they treat children’s data. On November 4, 2026, they tried something different: talking to the children themselves. The European Data Protection Board (EDPB), the body that brings together the national privacy regulators of the European Economic Area, launched Privacy for Kids, an online hub of games, videos, quizzes and classroom material about personal data, built for parents, teachers and educators to use with young people.

The hub does not create new law, and nothing on it is guidance addressed to companies. It is still worth a close look from anyone who builds or runs services that children use, because it shows, in plain language, what Europe’s regulators think a child should expect from an app, a game or a smart toy. Those expectations have a way of turning up later in complaints, audits and enforcement decisions.

What the EDPB actually launched

According to the EDPB’s announcement, Privacy for Kids collects educational resources produced by data protection authorities across Europe, in several languages, and guides visitors through them with a cartoon mascot, Eddy the beaver, and his friends. The Board’s reasoning is direct: children may not recognise risks easily, may trust strangers and may share personal data carelessly, while many of the apps they use collect that data and can leave what the EDPB calls long-lasting digital footprints.

Visitors can filter the catalogue in four ways:

• Age group: 3 to 10, 11 to 15, and 16 and older.
• Country: all 27 EU member states plus Iceland, Liechtenstein and Norway.
• Topic: sharing online, social media, smartphones and apps, privacy at home, privacy at school, cyberbullying, smart toys and more.
• Format: projects, information campaigns, games, infographics, videos and quizzes.

The first materials featured on the hub’s landing page give a sense of the range. There is a second volume of a French manga mystery series about deepfakes, online scams and privacy; an awareness campaign with a video and booklet for children aged 7 to 10 from Malta’s Information and Data Protection Commissioner; Leonora, the interactive toolkit for teenagers released earlier this year by Luxembourg’s CNPD; and FantomApp, the Swedish regulator’s tool that we covered when Sweden launched it to help kids lock down social media. The introductory video for younger children tells them not to share personal information, to think before they post, to ask a parent when unsure, and explains what online cookies are, with the line that one should “only like cookies that you can eat.”

The project’s main value is aggregation. Until now, most of this material sat on separate national regulator websites, often in a single language, and was hard to find unless a teacher already knew where to look. The hub puts it in one place with a common filter.

The law behind the lesson plans

The hub is educational, but each lesson rests on legal duties that apply to businesses. Three are worth keeping in view.

GDPR Article 8 and the age of digital consent

Article 8 of the GDPR covers information society services offered directly to a child where the service relies on consent. Processing a child’s data on that basis is lawful only if the child is at least 16, or if a parent gives or authorises consent. Member states may set a lower age, but not below 13, so the threshold differs across the EU. The controller must make reasonable efforts, using available technology, to verify that a parent really consented. Recital 38 adds that children merit specific protection, particularly in marketing, profiling and services offered directly to them, and Article 12 requires information addressed to a child to be clear and plain enough for a child to understand.

That last duty is where the hub becomes a quiet benchmark. If national regulators can explain cookies to a seven-year-old in a cartoon, a privacy notice for a teen-facing game written in dense legal prose will be harder to defend as “clear and plain.”

DSA Article 28 and the 2025 guidelines on minors

The Digital Services Act requires online platforms accessible to minors to put in place appropriate and proportionate measures to ensure a high level of privacy, safety and security for them, and bars advertising based on profiling when the platform knows with reasonable certainty that the user is a minor. On July 14, 2025, the European Commission published its guidelines on the protection of minors under Article 28. They are not binding, but the Commission treats them as the benchmark for assessing compliance, and they recommend private-by-default accounts, safer recommender systems, limits on addictive design features and proportionate age assurance.

Many of the hub’s topics map neatly onto those recommendations. A lesson telling a child to keep a profile private is the user-side version of a private-by-default setting. A lesson about strangers sending messages is the mirror image of a default that stops unknown adults from contacting minors.

What is still only proposed

In September 2026 the Commission also proposed the EU KIDS Act, which would add age thresholds for risky social media features and specific duties for AI companions and chatbots. That text is still being negotiated by the European Parliament and the Council and imposes no obligations today. Companies should plan against the GDPR and the DSA as they stand, and watch the proposal.

Five things the hub tells businesses about regulator expectations

Read as a whole, the material amounts to a list of behaviours that European regulators want children to adopt. Each one implies a design choice that a company could be asked to explain.

1. Children are told to share as little as possible. A sign-up flow for a children’s service that requests a full birth date, a phone number and location access when it needs only an age band is collecting more than the child is being taught to give. Data minimisation under Article 5(1)(c) GDPR is the legal hook.
2. Children are told to ask an adult when unsure. That assumes there is a meaningful parental route. If parental consent under Article 8 is a checkbox the child can tick alone, the “reasonable efforts” test is hard to meet.
3. Children are taught what cookies are and that they can say no. A consent banner that hides the reject option, or keeps loading trackers after a child refuses, contradicts the lesson. Teams should test what actually fires after refusal rather than trusting the banner; our guide to cookie consent explains the basics, and a banner on its own is never proof that tracking stopped.
4. Smart toys get their own topic. Connected toys with microphones, cameras or location features process data inside the home. The enforcement history is real: in 2025 the FTC alleged that a toy maker’s app let a third-party software kit collect children’s precise location without parental consent, a case over robot toys and hidden tracking that the company settled.
5. Privacy at school is a category. Schools choose tools on children’s behalf, so the vendor’s contract, retention settings and sub-processor list matter more than any notice the child sees. France’s regulator has already issued GDPR rules for school cloud and collaboration tools.

Education is not a substitute for compliance

There is an obvious risk in campaigns like this one: that the burden of safety drifts toward the child. Regulators appear aware of it. The same authorities contributing material to the hub have imposed some of the largest children’s privacy penalties on record, and the UK’s Information Commissioner’s Office, which operates outside the EDPB since Brexit, showed what that looks like when Reddit was fined £14.47 million for children’s privacy failures in February 2026, a penalty Reddit has appealed. Teaching a twelve-year-old to read app permissions does not lower the standard a company must meet when designing those permissions.

A practical way to use the hub is as a test script. Pick the age group your service attracts, work through the lessons for that group, and check whether your product lets a child follow the advice. Can a child find and change privacy settings without help? Does a refusal stick? Is there a working way to delete an account and its data, and can the team show that deletion actually happened rather than only that a ticket was closed? Where the answer is no, the gap is a design problem, and it is the kind a regulator will notice.

For a data-flow review of a child-facing service, the core questions are the familiar ones, asked more strictly:

• What data is collected at sign-up and during use, including device identifiers and inferred interests?
• Which recipients receive it, including analytics, advertising and AI vendors?
• For what purposes, and does any purpose involve profiling a child?
• How long is it kept, and what happens when a child or parent asks for deletion?
• Which controls are on by default, and which require the child to act?

Frequently asked questions

Is Privacy for Kids official EDPB guidance?

No. It is a collection of educational resources for parents, teachers and children. EDPB guidelines and opinions addressed to controllers are published separately and have a different status.

Who made the materials on the hub?

The EDPB says the resources come from data protection authorities across Europe. Each item is labelled with its country of origin, language and age group, so the original national regulator can usually be identified.

Does the hub change the age of digital consent?

No. The age for consent-based processing in information society services remains set by GDPR Article 8: 16 by default, or a lower national age that cannot go below 13.

Can a business use the hub’s material in its own product or website?

Each resource belongs to the authority that produced it, so reuse terms depend on that authority. Linking to the hub from a help centre or parent page is straightforward; republishing a game or video should be checked with the source regulator first.

Does the KIDS Act already apply?

No. It is a Commission proposal from September 2026 and must pass the European Parliament and the Council. Under the proposal, most of the rules would apply six months after entry into force, and the final text may differ.

A beaver with a clipboard

Eddy the beaver will not open an investigation. But the people who commissioned him do, and they have now written down, in language a ten-year-old can follow, what they think a fair online service looks like. The useful question for product and privacy teams is not whether their own children would enjoy the games. It is whether a child who learned every lesson on the hub could use their service exactly as the regulators taught, and what the record would show if one of those regulators tried.