OpenAI launches ChatGPT for teenagers: how it works, what parents can control, and when it arrives in Spain

As of today (summer 2026), there is no official European Union program in the consulted documentation that discusses a phased deployment of a specific product called “ChatGPT for teenagers” or “ChatGPT Teen”. European authorities are regulating the use of digital platforms and AI systems by minors in a horizontal manner, but they have not approved or publicized a specific implementation schedule for a youth version of ChatGPT.

Consequently, the “deployment status” is, in formal terms, incipient and conditional: any potential version for teenagers depends on OpenAI's decisions and compliance with a rapidly consolidating European regulatory framework (GDPR, DSA, AI Act, and age verification rules).

What the EU is doing regarding minors and AI

European policy is focusing on three major components:

• Age assurance and verification. The European Data Protection Board (EDPB) has adopted a statement on “age assurance” and created a specific AI enforcement task force that extends the scope of the previous ChatGPT Working Group to the entire AI ecosystem (EDPB note, 02/12/2025). The goal is a coherent EU-wide approach to online age control.
• European application of age verification. The European Commission has presented guidelines and a prototype age verification app for a safer online environment (Joint EC press release, 07/14/2025). This application is being tested with several “frontrunner” Member States and, according to European press reports, the intention is for platforms to have effective age verification systems in place before the end of 2026 (see, for example, Demócrata’s analyses on the “European age verification app”).
• Limiting minors' access to AI networks and applications. The European Parliament has taken a position in favor of establishing a minimum age of 16 years to register on social networks, video platforms, and AI applications, never below 13 years even with parental authorization (Demócrata, 10/16/2025 and Demócrata, 11/26/2025). This stance is reinforced by an EU expert report proposing to restrict access for children under 13 to services with recommendation algorithms or chatbots as “virtual companions” (Demócrata, 07/13/2026).

Specific relationship with ChatGPT and OpenAI

Although a “Teen” version with deployment phases is not mentioned, regulators are directly linking the ChatGPT case with data protection and minors’ protection:

• The EDPB has created a “ChatGPT Task Force” to coordinate GDPR enforcement for this system and, more recently, has expanded its mandate to all AI, with special attention to data accuracy and risks of harmful content, including those related to minors.
• The Italian data protection authority (Garante) has closed its investigation into OpenAI by imposing additional obligations and a fine, in a context where risks for underage users and the legal bases for processing personal data linked to ChatGPT are also being analyzed (Garante bulletin, 12/23/2024).
• The European Commission maintains a technical dialogue with OpenAI about transparency and access to models, crucial to assess their safety and effects on vulnerable users (Demócrata, 05/11/2026).

All this implies that any eventual “ChatGPT for teenagers” would have to fit within this horizontal framework, not in an ad hoc deployment procedure approved by Brussels.

Expected next steps for full implementation

Based on the available information, the key steps for a ChatGPT version aimed at teenagers to be fully and stably implemented in the EU would essentially be the following:

• Complete and generalize the European age verification app and its national versions, so that OpenAI (and any other AI platform) can integrate a robust control that ensures only users within the permitted age ranges and with proper parental authorization can access.
• Full application of the AI Act, which introduces specific obligations for general-purpose models and prohibits manipulative practices aimed at minors. The operational guidelines being developed in the European AI sandbox promoted by Spain and the Commission will be relevant to specify these requirements in services such as generative chatbots.
• Development of sectoral guidelines on chatbots and minors. Based on the EDPB’s work (opinions and statements on AI and minors’ protection) and the Commission’s efforts, it is foreseeable that specific guidelines will be approved on interface design, content limits, risk explanations, and parental control tools in conversational services.
• Technical and contractual adjustments by OpenAI: more restrictive data policies for minor accounts, disabling or limiting certain functions (e.g., access to sensitive content, image generation, or web browsing), and easy-to-use adult supervision systems.

Until this regulatory and technical framework is deployed homogeneously, there can be no talk of a “full implementation” of a ChatGPT specifically designed for teenagers in the EU, but rather a process under construction in which the rules for minors in the digital environment are defined first, and specific products – such as a potential Teen version – would have to align afterwards with that common framework.

In Spain, the legal competencies of parents or guardians regarding consent for the use of digital tools and services by minors are based on two main pillars: the data protection regime (GDPR and Organic Law 3/2018, LOPDGDD) and the general framework for child protection and information society services. From there, it is articulated who can consent, under what conditions, and what supervision and protection duties correspond to the responsible adults.

Regarding personal data protection, Regulation (EU) 2016/679 (GDPR) establishes in its Article 8 that, for information society services offered directly to minors (e.g., social networks, online platforms, apps requiring registration), data processing based on consent is only lawful if the minor has a certain age or, otherwise, if consent is given by the holder of parental responsibility or guardianship. The GDPR allows Member States to set that age between 13 and 16 years.

Spain exercised this option through the Organic Law 3/2018, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), which maintains the age at fourteen years from which the minor can give consent for the processing of their personal data by themselves. This is expressly stated in the law’s preamble indicating that “the age from which the minor can give consent is maintained at fourteen years” for these processes.

Consequently, in the field of digital services involving data processing (practically all that require registration, profiling, or online tracking), the basic scheme is as follows:

• Minors under 14 years: cannot autonomously consent to the processing of their personal data for the use of information society services. Consent from the parent, guardian, or legal representative responsible for the minor is required.
• Those over 14 and under 18 years: can directly consent to the processing of their data for the use of these services, without formal authorization from parents, without prejudice to the general powers of supervision, guidance, and correction inherent to parental authority.

The LOPDGDD, in connection with Article 8 of the GDPR, not only imposes this substitution rule for consent but also typifies as a serious infringement the processing of personal data of a minor without obtaining their consent when capable, or that of the holder of parental responsibility or guardianship, as well as the failure to demonstrate that reasonable efforts have been made to verify that consent effectively comes from that parent or guardian. That is, platforms and service providers have the duty to reasonably verify that an authorized adult is behind the consent when the user is under 14 years old.

Beyond the strict issue of consent, the LOPDGDD recognizes a specific duty of parents and guardians regarding the use of digital tools. The legal text establishes that “parents, guardians, curators, or legal representatives shall ensure that minors make balanced and responsible use of digital devices and information society services” to guarantee the proper development of their personality and preserve their dignity and fundamental rights. This configures a genuine legal competence and obligation to supervise minors’ use of devices, social networks, online games, or applications.

This responsibility is reinforced when it comes to the dissemination of images or personal information of minors on social networks and equivalent services. The same law provides that the use or dissemination of such content that may imply an unlawful intrusion into the fundamental rights of the minor will lead to intervention by the Public Prosecutor’s Office, which may request protective measures under the Organic Law on the Legal Protection of Minors. In practice, this means that parents or guardians must assess not only their own publication of images of the minor but also that of third parties, and act in defense of their rights.

Alongside data regulations, the Law 34/2002, on Information Society Services and Electronic Commerce sets the framework for digital services and foresees that restrictions or specific measures may be imposed to protect minors when the use of these services may affect their development or rights. Although this law does not set a particular age of consent, it coordinates with the data protection regime and the general duty of parents to safeguard minors from inappropriate content or services.

In summary, the legal competencies of parents and guardians in Spain regarding consent for the use of digital tools by minors cover three areas: substituting the consent of minors under 14 for data processing necessary to use many services; ensuring, even when the minor can already consent, balanced and safe use of devices and online services; and acting (and, if necessary, seeking intervention from competent authorities) when the minor’s presence in digital environments poses a risk to their fundamental rights.

In Spain, a technology company offering digital services used by minors (apps, platforms, online games, social networks, video services, etc.) must comply with a set of obligations combining data protection regulations, information society services, audiovisual communication, child protection, and consumer and user defense laws. Below is a summary of the main axes according to current national legislation.

1. Data protection and digital rights

The basic framework is formed by Regulation (EU) 2016/679 (GDPR) and its Spanish adaptation in the Organic Law 3/2018, on the Protection of Personal Data and Guarantee of Digital Rights. For services directed at or accessible to minors, this implies, in particular:

• Legal basis and consent: the processing of minors’ personal data must be based on an appropriate legal basis (valid consent, contractual compliance, legitimate interest, etc.). When relying on consent, special care is required to ensure it is informed, specific, and verifiable in the case of minors, involving parents or guardians when necessary.
• Clear and adapted information: privacy information (data policy, purposes, disclosures, retention periods, and rights) must be provided in clear and understandable language for minors, not only in legalistic formats aimed at adults.
• Minimization and limitation of purposes: only data strictly necessary for the service may be collected; any additional use (e.g., behavioral advertising or intensive profiling) requires specific justification and enhanced safeguards.
• Risk assessment: when processing entails high risk to minors’ rights (mass profiling, behavior tracking, cross-referencing sensitive data…), a data protection impact assessment and adoption of reinforced technical and organizational measures are expected.
• Digital rights of minors: Organic Law 3/2018 recognizes specific rights in the digital environment (e.g., against non-consensual content dissemination or certain forms of digital violence), obliging the company to have effective channels for exercising rights, content removal, and prompt complaint responses.

2. Information society services (LSSI) and security

Any company providing online services to users in Spain is subject to the Law 34/2002, on Information Society Services and Electronic Commerce. Among other relevant obligations for services involving minors:

• Provider identification: complete information about the company (name, tax ID, address, contact) easily accessible on the website or app.
• General conditions and contracting: terms of use, content policies, and, where applicable, contractual conditions must be transparent, accessible, and understandable also for minors and their families.
• Service security: the company must implement appropriate technical and organizational measures to protect systems and data against unauthorized access, data loss, or abusive uses, with special attention to the risk of third-party access to minors’ accounts.
• Limitations for minors’ protection: the LSSI empowers authorities to restrict information society services that cause serious harm or danger to minors’ protection, requiring service design to consider this legal security standard.

3. Audiovisual content and video platforms

If the service offers audiovisual content (linear, on-demand, or user-uploaded videos), the Law 13/2022, General Audiovisual Communication Law and its implementing regulations also apply. Among other requirements:

• Protection of minors against harmful content: obligation to prevent minors’ access to content that may seriously harm their development (violent, pornographic, inciting hatred or terrorism, etc.) through age classification systems, visible warnings, and effective parental control mechanisms.
• Video-sharing platforms: providers must adopt reasonable measures to protect minors from harmful content even when generated by users, including reporting systems, moderation, and content removal.
• Audiovisual advertising: reinforced restrictions on advertising certain products (alcoholic beverages, gambling, etc.) and messages that may encourage harmful behaviors in minors; the company must adapt its formats and targeting to comply with these limits.

4. Child protection against violence and digital environment

The Organic Law 8/2021, on comprehensive protection of children and adolescents against violence introduces specific obligations on the Internet and social networks:

• Duty to prevent and detect digital violence: providers must establish protocols to identify and act against bullying, sexual abuse, non-consensual image dissemination, or any other form of violence exercised through the service.
• Reporting illicit or violent content: regulates the duty to report the existence of content on the Internet constituting violence or abuse, even if not criminal, with protection for those making the report.
• Promotion of safe use: the law requires awareness and education actions for safe and responsible Internet use by children, adolescents, and their families, which practically obliges integrating notices, educational resources, and secure default settings.

5. Consumer and user protection

When minors are recipients of digital products or services, the consolidated text of the General Law for the Defense of Consumers and Users, approved by the Royal Legislative Decree 1/2007 and its amendments, also applies. This implies:

• Sufficient pre-contractual information (total price, functionalities, subscriptions, renewals, in-app purchases, etc.).
• Prohibition of unfair commercial practices, especially aggressive or deceptive ones exploiting minors’ special vulnerability.
• Complaint and withdrawal mechanisms adapted to the digital environment and easily usable by families and guardians.

In practice, a technology company operating in Spain with minors among its audience must design the service under the principle of “security and privacy by design and by default,” enhance transparency and parental involvement, limit commercial exploitation of minors’ data, and have clear protocols for content moderation, response to digital violence, and complaint handling.