Special rules for children's data?

What the Law Says

Japan’s Act on the Protection of Personal Information (APPI) includes specific protections for children’s personal data, introduced in the 2023 amendment. These rules impose heightened obligations on businesses and organizations that handle personal information of minors.

Under the APPI, a 'child' is not defined by a fixed age in all contexts—but the 2023 amendment explicitly requires prior consent from a parent or legal guardian when collecting personal information from individuals under 18 years old, if such collection could harm their rights or interests.

The law applies to any 'personal information handler'—a business operator who uses personal information for its own purposes—and mandates that they take 'necessary and proper measures' when handling children’s data, including verifying consent and limiting use to essential purposes.

Section 24 of the APPI states: 'A personal information handler shall, where it collects personal information from a child, take necessary and proper measures, such as obtaining the consent of the child’s parent or other legal representative, to ensure appropriate handling of the personal information.'

Statutory Text

A personal information handler shall, where it collects personal information from a child, take necessary and proper measures, such as obtaining the consent of the child’s parent or other legal representative, to ensure appropriate handling of the personal information.

— Act on the Protection of Personal Information, s. 24 — Measures concerning personal information of children

What to Do

Sources