Personal Information Protection Act — processing of personal information of children under 14

Korea sets its threshold at 14 and, unusually, applies it OFF-LINE as well as online. Art. 22-2 requires the controller to obtain the consent of a legal representative before processing the personal information of a child under 14, to verify that the consent is genuinely the representative's, and to give the child notice in language they can readily understand. Before the 2023 amendment the duty sat in the online-services provisions; the amendment unified it, so a business collecting children's data through offline channels no longer falls outside it. Collecting or using an under-14's personal information without the legal representative's consent is separately subject to administrative penalty.