Spain: Public consult on draft bill for minor’s protection, including age verification, consent, and loot boxes

The pre-draft bill (Draft Bill) on Spanish Organic Law for the Protection of Minors in Digital Environments has been adopted and is currently open for public comments until 28 June 2024. Although still in its early stages, this Draft Bill is particularly interesting as it would impact many different areas including loot boxes, lawfulness of minors' consent from a data protection standpoint, obligations on manufacturers of internet-connected digital devices and age verification duties for video-sharing platforms.

The Draft Bill's main purpose is to establish measures to ensure the protection of minors in digital environments. To this end, it provides various measures and aims to amend several laws. Particularly, and among other measures, it establishes the following obligations and prohibitions:

Obligations for manufacturers of digital devices with Internet connection: Manufacturers shall implement by default parental control mechanisms at the initial setting up of the device (tablets, mobile phones, intelligent TVs, computers, etc.) and will be subject to notice and disclosure obligations.
Prohibition for minors to access randomized reward mechanisms (commonly known as loot boxes) or their activation: The Draft Bill defines “randomized reward mechanisms” as a virtual functionality whose activation is done with legal tender or through a virtual object, such as a code, key, in-game currency, cryptocurrency or other element, directly or indirectly acquired with money; in which the result of such activation is uncertain and consists in obtaining a virtual object that can be exchanged for money or other virtual objects.
Minors' valid consent is raised from 14 to 16 years old from a data protection standpoint: This provision is groundbreaking in Spain as age for minors' consent is 14 years old (and has been for decades). Note that, under GDPR, Member States may provide for minors' valid consent as low as 13. Now the Draft Bill aims to increase it to 16.
Reinforced obligations for video sharing platforms regarding content that could potentially harm the physical, mental or moral development of minors: New obligations include establishing, by default, age verification systems and parental controls, which must meet data protection requirements and, at least, be equivalent to those under the eIDAS 2 Regulation (EUDI Wallet).
Additional measures addressed to educational facilities and public bodies, as well as changes to the Criminal Code and consumers and users law: The impact of these provisions is even broader. For instance, the dissemination of pornographic deepfakes will be subject to imprisonment.