AI and minors: extra protection under the AI Act, GDPR and DSA

Short answer: If you deploy AI that can reach children, stricter rules from three frameworks apply at once. The AI Act prohibits systems that manipulate children or exploit their age-related vulnerability (Article 5). The GDPR demands extra care over consent and profiling of children. The DSA bans online platforms from showing advertising based on profiling of minors.

AI Act: prohibited manipulation and exploitation

Article 5 of the AI Act does not name minors directly, but protects them in two ways. It prohibits AI that uses subliminal or manipulative techniques to materially distort behaviour, and it prohibits systems that exploit the vulnerability of a group — expressly including vulnerability arising from age.

An AI toy that nudges a child towards dangerous behaviour, or a recommender that deliberately exploits children's inexperience, thus falls into the zone of prohibited practices. This ban has applied since February 2025.

GDPR: children merit specific protection

The GDPR treats children as especially vulnerable data subjects. Three points are crucial for AI:

• Consent. Services aimed at children often require a parent's consent; Member States set the age threshold between 13 and 16.
• Profiling. Automated decision-making and profiling of children call for extra restraint and clear explanation.
• Transparency. Information must be given in plain language suited to the child.

Anyone training or deploying AI on children's data must therefore justify the legal basis and proportionality more rigorously than for adults.

DSA: no profiling-based advertising

The Digital Services Act adds a hard prohibition: online platforms may not present advertising based on profiling when they are reasonably certain the user is a minor (Article 28). Recommender and ad AI must be configured accordingly.

At the same time, that ban must not become a reason to collect more children's data for age verification than strictly necessary — a tension that has to be balanced against the GDPR.

Overlap with other themes

Protecting children touches broader issues such as accessibility and the general transparency obligations for interaction with AI. A chatbot for young people, for instance, must make clear that it is AI.

What to do

• Map your age reach: can your AI application reach children, even unintentionally?
• Test against Article 5: avoid any design that manipulates children or exploits their age-related vulnerability.
• Arrange consent and transparency in line with the GDPR, in child-friendly language.
• Switch off profiling-based advertising for (suspected) minor users.
• Minimise age verification: collect no more data than strictly necessary.

When in doubt about the exact classification, the state of AI regulation overview helps determine which framework governs.