Protection of minors: how age verification works in Spain

Spain is positioning itself as a pioneering country in Europe in terms of online child protection, anticipating directives that the EU is discussing within the framework of the Digital Services Act (DSA). “We will protect them from the digital Wild West,” said Prime Minister Pedro Sánchez a few months ago.

The result is a highly advanced age verification system, set to become the operational benchmark for the entire European single market.

Online child protection: Spain’s leap forward

Online child protection in Spain is based on two key initiatives: the Cartera Digital Beta project, a testing-phase app that verifies users’ identity and age, and the Organic Law for the Protection of Minors in Digital Environments, fully in force since 2026. 

Cartera Digital (Digital Wallet)

The Cartera Digital Beta app, developed by the Spanish Government and in testing since September 2024, was created to confirm a user’s age of majority without revealing their name, date of birth, or real identity (zero-knowledge proof). Designed for use while browsing restricted websites, the app works by simply scanning a QR code generated on the website in question.

Its main purpose is to protect minors by limiting access to adult websites. Notably, it also ??????????????? a maximum of around 30 monthly accesses to pornographic sites by minors. The app is developed in compliance with European regulations and is ready to evolve into the EUDI Wallet, including official documents and certificates.

Organic Law for the Protection of Minors in Digital Environments

First presented in July 2024, the Ley Orgánica de Protección de los Menores en los Entornos Digitales is now the regulatory framework in force for managing minors in digital governance. The law aims to protect minors online by shielding them from harmful content and preventing online exploitation, involving a wide range of stakeholders—from digital platforms (including social networks) to video game developers.

Its key points include:

• Raising the minimum age for minors to access and register on social media platforms, increasing it from 14 to 16 years;
• Age verification system: the law requires platforms offering sensitive content (pornography, violence, gambling) to use reliable and secure verification systems, such as the Cartera Digital;
• Obligations for device manufacturers: smartphones, tablets, and consoles sold in Spain must include pre-installed and free parental control systems and must display a label clearly indicating the risks associated with unrestricted internet access;
• Restrictions and limitations on algorithms, which cannot follow “dark patterns” that push users to spend more time online than intended or to make impulsive purchases;
• Introduction of digital crimes such as deepfake and cyberbullying into the Spanish Criminal Code.

How does age verification work in Spain?

As anticipated, with the entry into force of the new law, minors under 16 must obtain explicit parental consent to activate an account on digital platforms. Therefore, age verification mechanisms become one of the fundamental pillars of Spanish digital governance (even before European governance, which will take shape with the Digital Services Act).

Age verification systems must be secure and ensure that minors can only access age-appropriate content. Self-declaration is therefore replaced by a government digital wallet (the aforementioned Cartera Digital), which identifies the user and issues an anonymous token to the website that—based on official documents—certifies the user’s age without revealing their personal data.

This overcomes the limitations in terms of privacy, security, and usability associated with systems that are too easy to bypass, such as self-declaration, or with extreme solutions like uploading documents to access individual websites.

Age verification: towards a European standard

The European Union’s digital identity strategy, consolidated by the eIDAS 2.0 regulation, is radically transforming how personal attributes are managed and shared online, starting with age verification. By overcoming the fragmentation of isolated and insecure checks, the new framework of the European Digital Identity Wallet (EUDI Wallet) allows citizens to validate their data once with a certified authority and present it digitally wherever needed, as is the case with Cartera Digital.

Companies and developers operating internationally must adapt to these rules—and to those yet to come—by adopting age verification solutions compliant with DSA requirements and with the various national laws implementing EU guidelines.