Eu Kids Act and privacy: what it means for an SME to collect only the data it needs

If you are wondering what the Eu Kids Act means for your business, the honest answer is that the official source currently available gives no obligations, deadlines or penalties. What it does give is a clear principle, expressed by the Garante per la protezione dei dati personali (the Italian data protection authority): verifying the age of minors who use social media is fine, but the collection of information must stay limited to what is strictly necessary. For an SME, it is a good reminder of how any data collection should be designed.

To define the topic clearly: on the Garante's page, the Eu Kids Act is linked to the protection of minors online. Age verification is welcomed but, by our reasoning, it does not authorise asking for more data than due. In practice, an age check is a means, not a licence to profile people.

In this article we keep what the source says separate from our own reasoning. There is only one source, and the text we have is an excerpt. For this reason you will not find technical details on verification methods or application dates here: they are not in the material and we do not invent them.

What does the source actually say about the Eu Kids Act?

The page is on the Garante's website and is titled Eu Kids Act, Stanzione: Tutela dei minori senza sacrificare privacy e autonomia. The passage we can use with confidence is this: «Bene la verifica dell'età dei minori che utilizzano social, ma limitando la raccolta di informazioni allo stretto necessario.» (roughly: age verification of minors who use social media is welcome, but the collection of information should be limited to what is strictly necessary.)

The sentence contains two ideas. The first is an approval: verifying the age of social media users is an acceptable measure. The second is a limit: verification must not become a pretext for collecting excess information. The page title reinforces the message, as it speaks of protecting minors without sacrificing privacy and autonomy.

What the source does not say is just as important. It does not describe which verification systems are allowed, it sets no application timelines and it says nothing about penalties. The rest of the text is truncated, so the following sentence cannot be used.

Why should an SME care about a rule designed for social media?

Because the reasoning is transferable. A small business does not run a social network, but it collects data every day: contact forms, newsletter sign-ups, bookings, registrations to a members' area, quote requests. At each of these points the same question the Garante asks platforms arises: are you asking only for what you need?

The source assigns no obligations to SMEs, and neither do we. But the practical impact is this: the principle of strictly necessary data is a criterion of good design, and adopting it early is a methodological choice.

There is also a practical advantage, with no figures to cite: less data on file means less to protect, update and delete, and a leaner form is easier to maintain.

If you want to place the topic in a broader frame, the relationship between personal data rules and intelligent tools is covered in GDPR and artificial intelligence in the company, while for those starting from scratch it helps to understand what a company should know about AI and GDPR before getting started.

What is the difference between verifying age and collecting too much data?

Verifying age means establishing whether or not a person falls within a certain band. Collecting too much data means, in order to reach that answer, also acquiring information that is not needed to give it. The difference lies in the purpose: if you only need to know whether the user is an adult, the answer is yes or no, not the full archive of a document.

The table below sums up the idea simply. It is our own reasoning framework, not a list of rules from the source.

The criterion is the same in every row: each piece of data must have a use that is already clear, today, in your process.

How can this principle be applied in an Italian SME?

To make the discussion concrete we offer two examples. They are hypothetical situations and not client cases: they only serve to show the reasoning.

Example one: a dance school. Imagine a dance school with a website where trial lessons are booked. The form asks for a name, the parent's contact details, the student's age, the full address, the parents' occupations and how they heard about the school. Reviewing the form, the school realises that the address and occupation are not needed for the trial. It removes them and keeps only what allows it to organise the lesson and contact an adult. The form becomes shorter and there is less to safeguard.

Example two: an online toy shop. Imagine a small e-commerce business selling games that wants to make sure certain purchases are made by adults. Instead of asking everyone for a copy of an ID document, the shop limits itself to a step that confirms adult age and records only the outcome. This applies the limit indicated by the Garante: verification yes, but contained collection. Which system is suitable remains to be assessed with a consultant, because the source does not specify it.

A third idea, for professionals. A professional firm that uses an online form for first enquiries can ask itself whether it really needs the tax code at first contact or whether a contact detail is enough, leaving the rest to the stage when the engagement is actually under way.

If first contact goes through a chat window on the site, the same logic applies to what the assistant asks the user, as explained well in the article on how a chatbot for a company website works.

How do you actually audit the data you collect?

You don't need a big project. You need orderly work, with one person who knows the processes and one who knows the website. Here is a simple sequence, designed as our own working method.

1. List the collection points. Website forms, emails, phone calls, shared spreadsheets, booking tools, payment systems.
2. Write down the fields requested at each point. One row per field, without skipping fields that seem trivial.
3. Assign a purpose to each field. If you cannot say who needs it and when they will use it, it is a candidate for removal.
4. Remove or make optional whatever is not needed right away. An optional field must be clearly declared as such.
5. Check where the data ends up. Who sees it, where it is stored, how long it stays.
6. Update the privacy notice. It must describe what you actually do, not what you used to do.

If you use artificial intelligence tools, for example an assistant that answers customers, the same logic applies to what you let it read. The less personal information enters the system, the less there is to govern. To understand what happens to what is typed into these tools, you need the in-depth piece on Business Data and AI, and to see the picture from the side of internal confidentiality, the one on AI and corporate privacy.

Once you have clarified what you collect, it is worth putting it in writing as internal rules everyone can understand: how to write them is explained in how to set up a company policy on AI use. And if you want to understand where data risks leaving the perimeter, there is the guide to the concrete risks to data security when using these tools.

At the end of the audit you can check the result with this list.

• I know what data I collect and at which points.
• For each piece of data I know what it is for.
• I have removed the fields nobody uses.
• I know who can see the data and where it is stored.
• The privacy notice matches actual practice.

What mistakes should you avoid when dealing with minors' data?

There are five mistakes to avoid. These too are our own methodological observations, not content from the source.

Inferring obligations that the source does not contain

This happens when you read a headline and draw a rule from it. The Garante page provided here does not indicate obligations, deadlines or penalties for businesses. To avoid the mistake, always separate what is written from what you think is written, and check the full text before acting. For another regulatory framework that concerns SMEs, read what obligations an SME really has under the AI Act.

Confusing age verification with collecting documents

People think that to know someone's age you need to acquire everything. The principle the Garante recalls goes in the opposite direction: verification is fine, collection stays limited to what is strictly necessary. Ask yourself what the minimum information is that lets you decide, and stop there.

Asking for data just in case

This is the temptation of “we might need it someday”. It leads to long forms, full archives and more risk. To avoid it, set an internal rule: a field goes into the form only if it has a use that is already described.

Forgetting data that does not pass through the website

People look after the online form and neglect the spreadsheets, chats and emails where the same data accumulates. To avoid this, include these channels in your data map too.

Putting everything off until the obligation arrives

Waiting for a deadline seems convenient, but processes are better sorted out when there is no urgency. Since the source gives no timelines, use this phase to put things in order calmly, without panic.

When is it worth getting help?

If the data you collect concerns minors, or if you are not sure what is necessary, talking to a consultant avoids decisions based on partial readings. A typical example is choosing an age verification system: the source does not say which methods are required, so the choice must be made on the full official text and with adequate legal expertise. This article is not legal advice.

If instead the topic is how to organise tools and processes, including with artificial intelligence, without collecting more data than due, that is design work that can be set up with a clear method.

Where to start today?

Take the most used form on your website and read it as a customer would. For each field ask yourself: if I removed it, what could I no longer do? If the answer is “nothing”, the field is not needed. It is a small exercise, but it is the practical translation of the principle the Garante recalls: collect what is strictly necessary.

If you would like to discuss how to set up this work in an orderly way in your business, you can start from our page on artificial intelligence consulting.