Post #2345155
2026-05-10 11:26 UTC
@nik@toot.teckids.org 13-16: parental approval required. If we are lenient and say processing an IP address is not sufficient to be PII, the storing of the mail address on account creation sure is. There is an exception for services primarily target children (which has higher policing requirements anyway). I would rly love to be proven otherwise, yes this is very problematic, but its what I read here. @kleisli@mastodon.social @malwareminigun@infosec.exchange
Replies (1)
-
@nik@toot.teckids.org 2026-05-10 12:09
@fuchsiii@oxytodon.com @kleisli@mastodon.social @malwareminigun@infosec.exchange The headline solves your misconception: It is explicitly about **consent** given by a minor. Consent by the subject is one of six rules allowing data processing. The others include technical or legal requirement. GDPR allows a lot of things without explicit consent, and AFAIAC, I never was in a situation where any consent was even necessary at all. You cannot collect consent for targeted ad campaigns from minors. But you can certainly handle IP addresses.