A recent sanctioned case shows why it’s crucial to separate consents to avoid fines and protect children’s privacy.
With the end of the school year and the arrival of the holidays, thousands of children take part in activities such as camps, courses, and trips. In recent years, sharing images with families to show what the children are doing has become common.
Although this practice is usually well-intentioned, it can lead to legal risks if consent is not managed properly and there is no clear legal notice or privacy policy on the website.
The City Council of Móstoles reported an academy for a clause in its summer activity enrollment contract. This clause required parents to authorize, in a single section, both the child’s participation and the use of their images for advertising purposes.
Such clauses violate web data protection regulations, as consent must be granular and specific for each purpose:
According to the Spanish Data Protection Agency (AEPD), enrollment cannot be made conditional on accepting other non-essential uses, such as taking or publishing photos.
A proper cookie banner alone is not enough to ensure privacy when handling images of minors; clear consent and well-defined forms are required.
An example of an incorrect clause would be:
“I authorize Camping Vacaciones en el Mar to process my data and that of my son Juan Ramiro, 10 years old, on the legal basis of contract execution, to take photographs for the newsletter and publish them on social media.”
In the enrollment form or contract, there should be at least three separate consent sections:
Personal data for enrollment and service management
☐ I authorize
☐ I do not authorize
Image capture (photos or videos) without public distribution
☐ I authorize
☐ I do not authorize
Publication of images for promotional purposes (website, social media, brochures, etc.)
☐ I authorize
☐ I do not authorize
In addition, each consent must be accompanied by:
It’s also essential here to provide information about the purpose and legal basis of the processing, how long the data will be kept, and how to withdraw consent at any time. política de privacidad web y asegurarse de que el aviso legal web esté disponible y actualizado.
In this case, the fine imposed was €500, reduced to €300 for voluntary payment. A small amount, but a clear reminder that personal data protection is mandatory, especially when it involves minors.
At Lawwwing, as a legal tech platform, we automatically generate customizable legal consent checkboxes tailored to each purpose. You just need to copy and paste the code into your website or contract.
In addition, if you manage activities with minors, our legal team can help you review or draft your consent clauses and implement cookie management tools and a reliable cookie plugin so your site complies with eCommerce legal requirements and all privacy regulations.
