Spain seeks to protect minors in the digital environment: key points of the new version of draft law

The emergence of technology has transformed the way children interact with the world. Education, leisure, socialisation and even identity building are increasingly articulated through digital platforms. This growing digitalisation has created undeniable opportunities, but it has also led to premature and often unprotected exposure to risks of enormous significance: inappropriate content, addictive dynamics, disinformation and privacy violations, among others.

Back in July 2024, the Spanish government's then preliminary draft law proposed new digital safeguard measures for minors sought to address these challenges. Now, with the approval in the second round on 25 March by the Council of Ministers of the Draft Organic Law for the Protection of Minors in Digital Environments, this new version of the text  is emerging as a pioneering regulation intended to establish a comprehensive protection framework in this area.

The legislative text recognises that digitalisation, without the proper safeguards, can compromise the physical, mental and emotional development of minors. Access to pornographic or violent content, contact with extremist communities, health problems linked to excessive screen use and the algorithmic manipulation of minors' emotions are just some of the risk scenarios addressed by the new regulation.

Digital Services Act footsteps

This regulatory effort does not come out of nowhere. Spain is following in the footsteps of European recommendations and regulatory advances that are being consolidated within the framework of the Digital Services Act (DSA).

In this context, the Brussels-based policy think tank the Centre on Regulation in Europe, or CERRE, has recently published reports on age verification for access to digital services and on age-appropriate platform design, in anticipation of the European Commission's forthcoming guidelines on the protection of minors in digital environments under the DSA. At the same time, the European Parliament has held a hearing on child protection in the digital environment, where issues such as dark patterns and the addictive design of platforms were addressed.

What are the main measures proposed in the draft law to create a safe digital environment for minors?

Protection against harmful content and practices

In an effort to facilitate parental supervision, the draft text makes it mandatory for manufacturers of digital devices with an internet connection, such as mobile phones, tablets, computers and smart TVs, to include free parental-control systems that are activated by default when the device is first set up.

A new feature introduced by this draft law with respect to the preliminary draft is that personal data collected or generated during the activation of this functionality may not be used for commercial purposes, such as direct marketing, profiling or behaviour-based advertising.

In addition, manufacturers will be required to provide clear information tailored to all audiences, including persons with disabilities or autism spectrum disorders, on the risks associated with the use of devices, as well as on the protection mechanisms available, in line with European accessibility standards.

Victims of digital violence

Another new feature introduced in this draft law with respect to the preliminary draft is the new title III, which provides for measures in the area of protection for victims of gender-based violence and sexual violence. This new regulation expressly recognises as victims, for the purposes of Organic Law 1/2004 and Organic Law 10/2022, those persons who have suffered this type of violence in the digital environment. In addition, minors are guaranteed the right to free and continuous access to guidance and psychosocial care services, legal advice, as well as crisis centres and specialised shelters for victims of gender-based violence and sexual violence, both by telephone and online, 24 hours a day.

Consent to the processing of personal data

One of the most significant provisions of the text is the increase in the minimum age from 14 to 16 for minors to be able to give valid consent to the processing of their personal data in digital environments. This adjustment aligns Spanish legislation with the upper threshold allowed by the General Data Protection Regulation, which permits Member States to set this limit between 13 and 16 years of age. Spain currently sets it at 14. 

The reform responds to the increasing complexity of digital services and the need to ensure that minors have sufficient maturity to understand the implications of their personal data being used. Minors under the age of 16 will require parental or legal guardian authorisation to create accounts on social media platforms. This change compels digital companies to develop and implement reliable and appropriate age verification mechanisms.

"Lootboxes"

The regulation minors under the age of 18 from accessing and activating random reward mechanisms in video games, commonly known as "lootboxes". This measure, which treats lootboxes as potentially addictive practices −comparable in some ways to gambling− comes after a previous legislative attempt in 2022. The aim is to prevent the normalisation of such mechanisms among minors and to protect them from potentially addictive behaviours and harmful economic expenditures.

Professional specialisation

A new addition to the draft law, compared to the earlier preliminary draft, is the obligation for the government − working in collaboration with the autonomous communities− to develop a framework training and upskilling programme for all professional sectors that work directly with minors. This programme must cover not only the specific knowledge relevant to each sector (education, healthcare, justice, etc.) but also cross-cutting issues such as gender stereotypes, the impact of trauma and the prevention of secondary victimisation.

Criminal Code reform: deepfakes and virtual restraining orders

The draft law includes an ambitious reform of the Spanish Criminal Code aimed at adapting the legal framework to the new risks of the digital environment in relation to the protection of children. Among the most notable changes is the specific criminalisation of the creation and distribution of sexually degrading content generated by artificial intelligence – commonly referred to as pornographic deepfakes − when it affects minors.

A new provision penalises individuals who, without the consent of the affected person and with the intent to harm their moral integrity, disseminate or display digitally generated, modified or recreated images or audio simulating sexual or seriously degrading situations. This development aligns with the debate sparked by the organic law proposal presented in October 2023 to regulate the use of deepfakes and other AI-generated creations, which was withdrawn in March 2024.

Another particularly innovative measure in the proposed legislation is the introduction of virtual restraining orders − that is, sanctions prohibiting the convicted person from accessing or communicating through social networks, forums, communication platforms or any digital space where the offense occurred. This measure is introduced through amendments to various articles of the Criminal Code and seeks to extend the logic of physical protection into the digital realm.

Responsibility of users of special relevance

The law imposes specific obligations on so-called users of special relevance in the digital environment, such as influencers or content creators with a large amount of followers. These individuals will be required to clearly warn when their content may be harmful to minors, implement effective age-verification systems and ensure that pornographic or violent content is kept separate from the rest of their publications.

Osborne Clarke comment

Following its approval by the Council of Ministers, this draft organic law has now entered the parliamentary phase and has been submitted to the Congress of Deputies, where it will be debated and may be subject to amendments by the various political groups. This stage will be key in defining the final scope of a regulation that undoubtedly represents a milestone in the protection of children's and adolescents' rights in the digital environment. Organisations will be monitoring closely this legislative process and strategically preparing for the requirements that the new regulation will bring.