Spain: Public consult on draft bill for minor’s protection, including age verification, consent, and loot boxes – Technologist

Obligations for manufacturers of digital devices with Internet connection: Manufacturers shall implement by default parental control mechanisms at the initial setting up of the device (tablets, mobile phones, intelligent TVs, computers, etc.) and will be subject to notice and disclosure obligations.

Prohibition for minors to access randomized reward mechanisms (commonly known as loot boxes) or their activation: The Draft Bill defines “randomized reward mechanisms” as a virtual functionality whose activation is done with legal tender or through a virtual object, such as a code, key, in-game currency, cryptocurrency or other element, directly or indirectly acquired with money; in which the result of such activation is uncertain and consists in obtaining a virtual object that can be exchanged for money or other virtual objects.

Minors’ valid consent is raised from 14 to 16 years old from a data protection standpoint: This provision is groundbreaking in Spain as age for minors’ consent is 14 years old (and has been for decades). Note that, under GDPR, Member States may provide for minors’ valid consent as low as 13. Now the Draft Bill aims to increase it to 16.

Reinforced obligations for video sharing platforms regarding content that could potentially harm the physical, mental or moral development of minors: New obligations include establishing, by default, age verification systems and parental controls, which must meet data protection requirements and, at least, be equivalent to those under the eIDAS 2 Regulation (EUDI Wallet).

Additional measures addressed to educational facilities and public bodies, as well as changes to the Criminal Code and consumers and users law: The impact of these provisions is even broader. For instance, the dissemination of pornographic deepfakes will be subject to imprisonment.