Edtech platform: 12,000 student accounts, photos, messages. Low-cost shared stack, shared admin, US analytics, no DPA. Review: measures unfit for minors.
Children's data needs reinforced protection (GDPR, DSA). Weak hosting fails the whole program.
Protecting minors starts by reducing who can see their data — including the host.
Concrete hosting criteria
Isolation, encryption in transit/at rest, least privilege, MFA, admin logs (admin audit), EU location (backup location).
| Measure | Basic shared | Minor target |
|---|---|---|
| Admin logs | Panel | SIEM export |
| Deletion | Manual | API + proof |
Is shared enough?
Rarely at scale. Hardened VPS/cloud, WAF, tested backups more realistic.
Audit documentation
DPIA, registry, consent, host contracts, data deletion.
The peak: disproportionate risk
Beyond parental consent
Verifiable parental consent is necessary but insufficient if infra lets admin browse files without logging. Education or youth platforms should treat host as high-risk subprocessor: restricted access, quarterly admin account review, fast incident notification.
Step-up to hardened VPS, WAF, tested backups costs less than sanction or family trust loss. Compare via directory demanding subprocessor list and copy location.
Go further with the inquiry
Apply the article to your concrete case: what volume, what service level, what contractual constraints from clients or regulators? Write answers before opening the pricing page. Request written documents — full grid, DPA, certification scope, renewal terms — not homepage screenshots.
Compare at least two providers via the directory and compare tool on identical thirty-six-month assumptions. Share the short list with whoever signs the contract and whoever operates infrastructure daily. Archive terms dated at subscription so due diligence is defensible later.
Go further with the inquiry
Apply the article to your concrete case: what volume, what service level, what contractual constraints from clients or regulators? Write answers before opening the pricing page. Request written documents — full grid, DPA, certification scope, renewal terms — not homepage screenshots.
Compare at least two providers via the directory and compare tool on identical thirty-six-month assumptions. Share the short list with whoever signs the contract and whoever operates infrastructure daily. Archive terms dated at subscription so due diligence is defensible later.
Beyond parental consent
Verifiable parental consent is necessary but insufficient if infra lets admin browse files without logging. Education or youth platforms should treat host as high-risk subprocessor: restricted access, quarterly admin account review, fast incident notification.
Step-up to hardened VPS, WAF, tested backups costs less than sanction or family trust loss. Compare via directory demanding subprocessor list and copy location.
Beyond parental consent
Verifiable parental consent is necessary but insufficient if infra lets admin browse files without logging. Education or youth platforms should treat host as high-risk subprocessor: restricted access, quarterly admin account review, fast incident notification.
Step-up to hardened VPS, WAF, tested backups costs less than sanction or family trust loss. Compare via directory demanding subprocessor list and copy location.
Decide and move forward without blind spots
Start by framing your real scenario on one page: volumes, client constraints, required support level, and a thirty-six-month budget including domain, backup, and essential add-ons. Compare at least two hosts via the directory and compare tool with identical assumptions, archive pricing grids dated on subscription day, then have both the contract signer and daily infrastructure operator validate the short list.
Frequently asked questions
GDPR minors?
Reinforced consent/info; parental by age/country.
Extra host requirements?
Encryption, logs, DPA, notification, EU location often.
Shared enough?
Rarely at scale; hardened VPS more realistic.
Audit?
DPIA, registry, consent, contracts, account deletion.
Children's data: host must be at the level of the audience you serve.