Digital Age Verification: What Spain and the EU Propose to Protect Minors

On February 3, 2026, Pedro Sánchez announced that the Government would promote measures to ban access to digital platforms for minors under 16. It was a political announcement, not confirmation that the ban was already in effect: the official source records the proposal and the package of measures, but does not by itself prove the approval or application date of a law.

This distinction matters for families and businesses. A minimum age proposal may anticipate changes, but it should not be treated as an operational legal obligation. In contrast, the Digital Services Act (DSA) already establishes obligations for online platforms accessible to minors, and Article 28 requires adequate and proportionate measures to ensure a high level of privacy, security, and protection for these users.

It is also important to separate this discussion from the age for consenting to personal data processing. The AEPD indicates that in Spain, a minor can consent to such processing themselves from age 14; below that threshold, when processing is based on consent, it must be given by the holder of parental authority or guardianship. This is not a general age of access to social networks nor proof that the threshold has already been raised to 16 years.

The AEPD and the National Commission of Markets and Competition (CNMC) jointly published, on March 24, 2026, an explanation of Article 28 of the DSA and age assurance. Their approach does not consist of imposing a single verification method: measures must be adequate and proportionate to the service and must protect minors without failing to respect the rights of other users.

The guide links child protection with GDPR privacy obligations. Among the criteria it highlights are avoiding profiling and choosing solutions that allow proving a condition—for example, having the required age—without revealing more personal information than necessary. Age verification should not automatically become identification: verifying that someone meets a threshold and knowing who they are are distinct operations.

For those managing a platform, the practical decision is to assess risk and purpose before deploying a barrier. A measure useful for restricting adult content is not necessarily suitable for any service or age group. The available information does not establish a universal rule requiring all platforms to request identity documents from every user.

The AEPD and CNMC mention privacy mechanisms, including anonymous tokens and the EU Digital Identity Wallet. The idea is that a person can demonstrate reaching a threshold without the service necessarily receiving their full identity. This describes an approach favored by guidelines; it does not mean all platforms already use it or that each implementation has identical guarantees.

The European Commission also develops an age verification solution. According to its official page, it presented a plan in July 2025, and the solution was ready for use on April 15, 2026. The description states it allows proving one is over 18 without sharing other personal information. That specific scope is for those over 18: it is not enough to claim the system alone resolves verification of the Spanish 16-year threshold.

The initial draft referred to multifactor authentication and phishing-resistant methods, but available sources do not support that these are technologies specifically evaluated or required by the AEPD for this purpose. Nor does it correspond to present unique credentials as a general mandate. The verifiable formulation is narrower: authorities promote options that preserve privacy and avoid profiling users, while the technical solution depends on context and design.

An age check may involve documents, images, or biometric data, but not all solutions require collecting or retaining that information in the same way. The debate is about limiting data exposure: if a platform receives an eligibility signal instead of a document copy, it reduces the information it can directly associate with an account, although the result depends on how the system is built.

The AEPD and CNMC highlight mechanisms that preserve privacy and avoid profiling. This orientation does not prove that any token or wallet is anonymous in all scenarios: credential issuance, presentation method, reusability, and records kept by each participant matter. Protection depends on the complete flow, not just the name of a technology.

For users and families, a useful question when facing a verification request is what data is collected, who receives it, how long it is retained, and if it is reused for other purposes. For a company, these same questions help compare a one-time check with systems that can link identity, activity, and account. Minimization reduces exposure, but it does not by itself eliminate all security or misuse risks.

Age verification and minor protection can affect how a platform organizes its accounts, content, and data processing. However, sources do not prove an automatic change in the advertising model or a general ban on personalized advertising as a direct consequence of the Spanish proposal or age guidelines.

The effect depends on subsequent regulatory decisions, the type of service, and how information is obtained and used. Guidelines promoting the avoidance of profiling are relevant for designing verification systems, but they do not equate to a conclusion that all platforms must remove advertising segmentation or that they have already done so.

For compliance officers, the prudent measure is to distinguish current obligations from announced changes and document the necessity of each data point. For parents and users, it is advisable not to confuse an age check with a general authorization to track or profile. The practical conclusion: verify the minimum necessary and do not treat a political proposal as an already applied norm.