Beyond Consent: Children’s Data Protection, Parental Power, and the Limits of Privacy in the Age of Sharenting

Abstract

The article critically examines the legal status of minors as data subjects within contemporary data protection frameworks, with a particular focus on the limitations of consent as the primary legal basis for processing children’s personal data. While instruments such as the General Data Protection Regulation establish enhanced safeguards for minors, the reliance on parental consent raises significant doctrinal and practical concerns, especially in digital environments shaped by asymmetries of power, information, and technological literacy.

The paper explores the concept of ,,sharenting” as a growing phenomenon that challenges traditional controller–data subject relationships, arguing that parents increasingly function as de facto data controllers of their children’s digital identities without corresponding regulatory accountability. By analysing international and regional legal instruments, including the United Nations Convention on the Rights of the Child, as well as selected national approaches, the article highlights structural gaps in existing frameworks, particularly regarding consent verification, cross-border inconsistencies, and enforcement limitations.

The study further interrogates the tension between parental authority and the child’s independent right to privacy, especially in cases involving children of public figures, where reduced expectations of privacy may undermine effective protection. Drawing on empirical insights and comparative legal analysis, the article argues for a conceptual shift from a purely consent-driven model towards a responsibility-based and risk-oriented approach that better reflects the realities of children’s digital lives. It concludes by proposing that effective protection of minors’ personal data requires not only legal reform but also the reconfiguration of parental obligations within the broader data protection ecosystem.

In doing so, it contributes to the emerging debate on the need to reconceptualise children’s data protection beyond individual consent towards systemic accountability frameworks.