Parental Consent Collection Record
The Parental Consent Collection Record documents when and how parental or guardian authorization was obtained for processing a child’s personal data, where such authorization is required. It captures key metadata such as the child account/reference, the parent/guardian contact, the consent scope (purposes and data types), the verification approach used (and its assurance level), timestamps, and the consent status (active, withdrawn, expired). Because child-consent requirements vary by jurisdiction, services should define the applicable age threshold and verification standard for their context and record evidence that the chosen method was followed. Maintaining a secure, access-controlled consent log supports accountability, helps respond to consent withdrawal requests, and provides traceability during audits or incident investigations.
It is an audit-ready log that records when and how parental or guardian authorization was obtained for processing a child’s personal data, including scope, verification method/assurance, timestamps, and status.
Requirements vary by jurisdiction and service context. Some regimes require verifiable parental/guardian authorization for certain age groups or certain types of services, while others impose different notice, safety, or limitation rules. Define the applicable threshold and standard for your product and record evidence that it was followed.
Common fields include: child reference, parent/guardian contact, consent scope (purposes/data types), verification approach and assurance level, timestamps (request, verification, consent granted), status (active/withdrawn/expired), and links to relevant notices or workflows.
Use the least intrusive method that provides adequate assurance for your risk profile. Where possible, avoid storing sensitive identity documents and instead store proof of verification (e.g., token references), verification outcome, and assurance level, with strict retention and access controls.
Document and honor withdrawal using a clear process. Update the consent status, stop processing covered activities where required, and trigger deletion or restriction workflows unless retention is required for legal or safety reasons. Record actions taken and timestamps.
Audit by sampling child accounts and confirming each has a corresponding active consent record with appropriate verification metadata, correct scope, and traceable timestamps. Also validate age-gating accuracy, exception handling, and that withdrawal requests change system behavior.
Common issues include using a fixed age threshold globally without regional handling, collecting excessive identity data to verify parents, failing to tie consent scope to actual system permissions, and not updating processing behavior after withdrawal or expiry.
| Version | Date | Author | Description |
|---|---|---|---|
| 1.0.0 | 2026-02-13 | WatchDog Security GRC Wiki Team | Initial publication |
