Which topic would you like to know more about?
What is the legal age of adulthood/ majority in your jurisdiction? Are all persons below this age considered a child/ minor?
The Guardianship Act provides that a person under the age of 18 is a minor for the purposes of Norwegian law. All persons below this age are considered a child/ minor.
Has the UNCRC been directly incorporated into national law in your jurisdiction?
Yes.
The UNCRC was directly incorporated into the Norwegian Human Rights Act in 2003.
Is there an ombudsperson/ commissioner for children in your jurisdiction?
Yes.
The Ombudsperson for Children is established by the Ombudsperson for Children Act, 1981.
If there is an ombudsperson/ commissioner for children in your jurisdiction, do they have any responsibility for upholding children’s rights in the digital world or does the relevant regulator have sole competence?
No.
The Ombudsperson for Children is a Norwegian ombudsperson tasked with promoting children's interests in relation to the public and private sectors, monitoring developments in children's upbringing and ensuring that Norway complies with the UNCRC, according to section 3 of the Ombudsperson for Children Act, 1981.
The Ombudsperson is a government agency but is independent of the state in its work.
The Ombudsperson is given broad powers. Section 4 of the Children's Ombudsperson Act gives the Ombudsperson free access to all public and private institutions for children. Public authorities and public and private institutions for children shall, without prejudice to the duty of confidentiality, provide the Ombudsperson with the information needed to perform the Ombudspersons duties.
Thus, we do not consider the Ombudsperson to have responsibility for upholding children’s rights in the digital world, as the competence of the Norwegian Ombudsperson for children is of a “watchdog” manner and is limited to monitoring public and private actors in their protection of children’s rights.
Is there any standalone requirement to collect the consent of one or both parents when processing a child’s personal data (irrespective of any other obligations, e.g. the requirement to have a legal basis for processing)?
No.
There are no national-specific laws in this regard; see more information on the GDPR-level requirements here. The requirement to collect parental consent under Article 8(1) of the GDPR must be read in conjunction with section 5 of The Personal Data Act, which establishes the age of digital consent as 13 years. Consequently, if the child is under 13 years old, processing is only legal if consent is given or approved by the person who has parental responsibility for the child.
Note that at the time of publication of this questionnaire, the Norwegian government has indicated that the age of digital consent may be raised to 15 years of age; however, no official proposal to amend the Personal Data Act in this regard has been put forward.
At what age can children legally consent to the processing of their own personal data, such that parental permission/ consent is not required?
As local law does not regulate specified data processing activities regarding children, usually a person will be able to grant valid consent to the processing of their personal data starting from 18 years of age.
The main rule is that children can consent to the sharing and processing of their own personal data when they reach the age of 18, per section 9 of the Guardianship Act on legal capacity. Before this, the parents or person with parental responsibility must consent on behalf of the child.
However, in Norway, the age of consent for purposes referred to in Article 8(1) of the GDPR is set at 13 years according to Section 5 of The Personal Data Act. Consequently, the digital age of consent in connection is 13 years old.
Are there specific requirements in relation to collection and/or verification of parental consent/ permission concerning the processing of a child’s personal data?
Yes.
There are no national-specific laws in this regard; see more information on the GDPR-level requirements here.
Are there any particular information or transparency requirements concerning the processing of children’s personal data?
Yes.
There are no national-specific laws in this regard; see more information on the GDPR-level requirements here.
Can children directly exercise their rights in relation to their personal data without the involvement of their parents?
Yes.
There are no national-specific laws in this regard; see more information on the GDPR-level requirements here.
Can children make complaints on their own behalf directly to your national data protection/ privacy regulator(s)?
Yes.
There are no national laws or guidelines which specify whether children can make complaints on their own behalf to the Norwegian Data Protection Authority. The Authority specifies that "all individuals who believe they have experienced a violation of privacy regulations can file a complaint with the Data Protection Authority".
Are there any particular requirements/ prohibitions related to:
a. processing specific types of children’s personal data;
b. carrying out specific processing activities involving children’s personal data; and/ or
c. using children’s personal data for specific purposes.
No.
There are no national-specific laws in this regard, but the Data State Inspectorate (DSI) has made some comments regarding the processing of children’s personal data.
a) processing specific types of children’s personal data
It is worth noting that the age of digital consent of 13 years, as established by section 5 of The Personal Data Act, is considered in Norwegian law not to apply to special categories of personal data. In the processing of special categories of personal data. about children, the age of digital consent is 16 years.
b) carrying out specific processing activities involving children’s personal data; and/ or
No national law requirements or prohibitions.
c) using children’s personal data for specific purposes.
No national law requirements or prohibitions.
Has there been any enforcement action by your national data protection/ privacy regulator(s) concerning the processing of children’s personal data? In your answer, please include information on the volume, nature and severity of sanctions.
Yes.
To date, there have been no major cross-border processing decisions issued by The Norwegian Data Protection Authority which relate to the processing of children's personal data. However, the Authority has issued several decisions concerning Norwegian schools’ processing of children's personal data:
- 2019: Unauthorized users gained access to other users in a mobile application for communication between schools and pupils. The municipality had not implemented sufficient technical and organizational measures to protect the data. A fine of 1.2 million NOK was imposed on Oslo Municipality.
- 2019: Usernames and passwords of learning platforms were leaked. The municipality had not implemented sufficient technical and organizational measures to protect the personal data. A fine of 1.6 million NOK was imposed on Bergen Municipality.
- 2020: The municipality had failed to implement adequate technical and organizational measures to safeguard personal data concerning children who require enhanced protection. A fine of 3 million NOK was imposed on Bergen Municipality.
- 2020: Insufficient risk assessments, privacy impact assessments and information security in relation to processing of health information about children in the learning platform Showbie. A fine of 500,000 NOK was imposed on Rælingen Municipality.
- 2021: An exercise tracking application was used in teaching without a data protection impact assessment being conducted. A fine of 50,000 NOK was imposed on Ålesund Municipality.
- 2022: The municipality had not implemented sufficient technical and organizational measures to protect children's personal data against a virus attack. A fine of 4 million NOK was imposed on Østre Toten Municipality.
Are there specific rules concerning electronic direct marketing to children?
Yes.
The Marketing Act relates to marketing in general, which includes electronic direct marketing. In Chapter 4 of the Marketing Act, there are special provisions for the protection of children:
- Section 15 states that electronic direct marketing cannot be sent on any basis other than consent. This provision is not specifically directed at communications made to children - regardless of whether communications are sent to an adult or a child, the general rule is that the consent of the individual recipient is required (which must be GDPR-standard consent; see more information on the GDPR-level requirements here.).
- Section 19 mandates that commercial practices directed at or accessible to children must exercise special care due to children's susceptibility, inexperience, and credulity. It requires that factors such as age and developmental stage be considered to assess if a practice is in violation of the law, recognizing the vulnerabilities of children.
- Section 20 emphasizes that when assessing if a commercial practice is unreasonable, special attention should be given to whether it targets children or is likely to influence them due to its nature or product, considering children's particular vulnerabilities.
- Section 21 specifies that marketing to children should be assessed for content that promotes illegal or dangerous behavior, exploits insecurities, induces fear, or uses aggressive elements such as violence or sexuality.
Are there specific rules concerning the use of adtech tracking technologies, profiling and/or online targeted advertising to children?
Yes.
It is the Norwegian Data Protection Authority’s position that organisations should not profile children for advertising/marketing purposes. The Authority generally advises against the use of tracking technologies, especially when the tracking involves special categories of personal data. There are no national-specific laws or further guidelines concerning the use of adtech tracking technologies, profiling and/or online targeted advertising to children in particular.
However, Chapter 4 of the Marketing Act provides special provisions for the protection of children:
- Section 19 of The Marketing Act mandates that commercial practices directed at or accessible to children must exercise special care due to children's susceptibility, inexperience, and credulity. It requires that factors such as age and developmental stage be considered to assess if a practice is in violation of the law, recognizing the particular vulnerabilities of children.
- Section 20 of The Marketing Act emphasizes that when assessing if a commercial practice is unreasonable, special attention should be given to whether it targets children or is likely to influence them due to its nature or product, taking into account children's particular vulnerabilities.
- Section 21 of The Marketing Act specifies that marketing to children should be assessed for content that promotes illegal or dangerous behavior, exploits insecurities, induces fear, or uses aggressive elements such as violence or sexuality.
Are there specific rules concerning online contextual advertising to children?
Yes.
The Marketing Act relates to marketing in general, which includes online contextual advertising. In Chapter 4 of the Marketing Act, there are special provisions for the protection of children.
- Section 19 of The Marketing Act mandates that commercial practices directed at or accessible to children must exercise special care due to children's susceptibility, inexperience, and credulity. It requires that factors such as age and developmental stage be considered to assess if a practice is in violation of the law, recognizing the particular vulnerabilities of children.
- Section 20 of The Marketing Act emphasizes that when assessing if a commercial practice is unreasonable, special attention should be given to whether it targets children or is likely to influence them due to its nature or product, taking into account children's particular vulnerabilities.
- Section 21 of The Marketing Act specifies that marketing to children should be assessed for content that promotes illegal or dangerous behavior, exploits insecurities, induces fear, or uses aggressive elements such as violence or sexuality.
Has there been any regulatory enforcement action concerning advertising to children? In your answer, please include information on the volume, nature and severity of sanctions.
Yes.
There have been several regulatory enforcement actions concerning advertising to children. The Consumer Authority has had two cases involving hidden marketing targeted at children and four cases involving direct purchase solicitations to children. In one of the cases, the Consumer Authority imposed a penalty fee of NOK 150,000. The severity of the sanctions in the remaining case is unknown (not public). The Market Council has had two cases involving breaches of the ban on advertising specifically aimed at children in broadcasting. Note that this overview is not exhaustive. There may be more cases that are not publicly published.
At what age does a person acquire contractual capacity to enter into an agreement to use digital services?
The age of civil capacity to enter into a contract in Norway is 18 years.
However, minors have control over their own funds that they have earned through their own work or business after turning 15 years old, or that a guardian or others have allowed the minor to manage independently (per Section 12 of the Guardianship Act). Therefore, a minor can legally enter into an agreement to purchase digital services, provided they are over 15 years old and have earned the money themselves, or if they have the money at their own disposal. Minors cannot commit to future payment obligations, or make purchases where payment is to be made by subsequent invoice.
Do consumer protection rules apply to children?
Yes.
Norwegian consumer protection rules (e.g. The Consumer Protection Act, The Marketing Act and The Cancellation Act) apply to all physical persons acting as consumers, including children.
Are there any consumer protection rules which are specific to children only?
Yes.
Chapter 4 of The Marketing Act contain consumer protection rules which are specific to children only. These regulations focus on protecting children from harmful commercial practices, requiring marketers to exercise special care and consider children's vulnerabilities, and prohibiting content that promotes illegal or dangerous behavior, exploits insecurities, or uses aggressive elements in marketing directed at children.
Has there been any regulatory enforcement action concerning consumer protection requirements and children’s use of digital services? In your answer, please include information on the volume, nature and severity of sanctions.
No.
The Market Council and the Consumer Authority have determined breaches in at least three cases involving direct purchase solicitations to children on a social media platform, hidden marketing to children on a multimedia messaging app, and direct marketing through direct messages to children on social media platforms messaging services, as well as advertising videos directed at children on social media platforms. In 2023, the Consumer Authority, alongside the Directorate of Medical Products and the National Health Inspectorate, conducted an operation to address illegal marketing of cosmetic procedures online. They found violations at 34 clinics advertising on social media platforms frequented by children and teenagers. The Authority instructed the clinics to rectify illegal advertising practices aimed at children.
Are there any age-related restrictions on when children can legally access online/ digital services?
No.
To date, there are no age-related restrictions on when children can legally access online/digital services.
However, the age of digital consent is 13 years, as established in Section 5 of The Personal Data Act. This means that only children over 13 years can legally consent to their personal data being treated in accordance with the Article 8(1) GDPR.
Are there any specific requirements relating to online/ digital safety for children?
No.
To date, there are no specific requirements relating to online/digital safety for children.
In a 2021 report called "Childhood in Front of, Behind, and on the Screen", the limitations of regulatory and technical measures for online/digital safety for children were addressed. The report cited concerns over the effectiveness of national legislation relating to online/digital safety. Consequently, the government-appointed committee (commissioned to propose new measures to better protection children online) refrained from recommending specific legal and technical measures for increased online/digital security for children.
Are there specific age verification/ age assurance requirements concerning access to online/ digital services?
No.
To date, there are no specific age verification/age assurance requirements concerning access to online/ digital services.
However, such requirements are currently a topic of public debate, as governmental representatives have indicated their intention to introduce age verification on social media platforms. The Data Protection Authority, the Ombudsperson for Children, and the Consumer Council have expressed scepticism about this proposal. They argue that age verification could infringe on fundamental rights of children, including the rights to participation, freedom of expression, and access to information.
Are there requirements to implement parental controls and/or facilitate parental involvement in children’s use of digital services?
No.
To date, there are no requirements to implement parental controls and/or facilitate parental involvement in children’s use of digital services.
However, children's advocacy groups are calling for new legislation following recommendations about implementation of parental control in digital devices from the Council of Europe, and schools and child protective services have an increased emphasis on the use of parental control in their work.
Has there been any regulatory enforcement action concerning online/ digital safety? In your answer, please include information on the volume, nature and severity of sanctions.
No.
N/A
Are there any existing requirements relating to children and AI in your jurisdiction?
No.
N/A
Are there any upcoming requirements relating to children and AI in your jurisdiction?
No.
Note, however, that the incorporation of the AI Act into Norwegian law is expected to contribute to strengthening the safety for children in relation to AI, as it identifies children as a vulnerable group, and mandates that providers of AI technologies implement risk management, transparency, and accountability measures to safeguard children's rights. However, please note that the AI Act has not yet been enacted in Norway and will require amendments to national legislation. Thus, it is not yet possible to tell with certainty how the requirement relating to children and AI will unfold in Norway.
Has there been any other regulatory enforcement activity to date relevant to children’s use of digital services? In your answer, please include information on the volume, nature and severity of sanctions.
No.
N/A
Are there any other existing or upcoming requirements relevant to children’s use of digital services?
Yes.
Existing requirements:
Section 3-1 of The Broadcasting Act stipulates that advertising segments cannot be broadcast in connection with children's programs or in segments specifically targeted at children within broadcasting or audiovisual on-demand services. Additionally, Section 3-6 prohibits product placement in programs or segments specifically aimed at children. These requirements apply to social media platforms for video sharing such as YouTube and TikTok.
Upcoming requirements:
The Ministry of Health and Care Services has proposed a new regulation that bans certain types of marketing aimed at children, specifically for foods rich in unhealthy nutrients. The regulation is technology-neutral, encompassing advertisements on various platforms such as TV, radio, magazines, social media, and digital games. The proposal facilitates active supervision and effective response options in case of rule violations.
Separately, note that the Norwegian Ministry of Children and Families has proposed amendments to the Marketing Act to strengthen consumer protection for children in digital media. The proposal introduces a new Section 21(a), which stipulates that marketing likely to be seen or heard by children on social media and games should not include any references, videos or images of services that are unsuitable for children. Additionally, the proposal seeks to expand the Consumer Authority's power to impose fines for violations of Sections 21 and 2, which concern good marketing practices towards children, and breaches of the new provision regarding marketing in social media.
Please note that the amendments are only proposals and have not yet been enacted but are currently under review by the Ministry.
Contributors
Rune Opdahl
Wiersholm
Annelin Sødal
Wiersholm
Cecilie Island
Wiersholm
