Comparative Law Review

Comparative Law Review

Protecting Children's Personal Data in Iran: An Analysis of Legislative Gaps and a Strategic Roadmap with Comparative View on EU and UK Regulations

Document Type : Research Paper

Authors
1 Ph.D. in Technology Management, University of Tehran, Tehran, Iran
2 M.A. in Family Law, Refah University, Tehran, Iran
Abstract
The rapid expansion of digital technologies has exposed children to unprecedented data-driven risks. The particular vulnerability of this age group to the collection, processing, and commercial exploitation of personal data amplifies the need for specialized protective frameworks. Despite legislative efforts, Iran's legal system primarily focuses on protecting children from harmful content and suffers from the absence of a cohesive, data-centric regime. Using a comparative-legal analysis, this research examines leading international models, particularly the European Union's General Data Protection Regulation (GDPR) and the UK's Age Appropriate Design Code. The findings indicate that these models have adopted a preventive, design-based approach by introducing fundamental principles such as the "best interests of the child", "privacy by design", and practical mechanisms like "verifiable parental consent" and "Data Protection Impact Assessments". In contrast, an analysis of Iran's draft "Personal Data Protection Bill" reveals deep structural weaknesses and an insufficient approach to children's rights, notably by reducing protection to the traditional concept of "legal incapacity". Ultimately, by identifying existing gaps, this article presents a strategic legislative and executive roadmap. This roadmap is founded on the necessity of enacting a "Special Law for the Protection of Children's Data", which would recognize the "best interests of the child" as the governing principle and mandate operational mechanisms such as "verifiable parental consent" and the requirement for a "child-focused Data Protection Impact Assessment". Furthermore, while analyzing institutional challenges, the article proposes a model for establishing a specialized supervisory authority tailored to Iran's legal structure.
Keywords
Subjects

1.     Abedini, A., & Meshkibaf, M. (2021). The position of welfare in the Convention on the Rights of the Child and Iranian family laws. Comparative Research on Islamic and Western Law, 8(4), 183-212. DOI: https://doi.org/10.22091/csiw.2021.4635.1625 (In Persian).
2.     Akbarzadeh, S., Naeni, A., Yilmaz, I., & Bashirov, G. (2024). Cyber surveillance and digital authoritarianism in Iran. Global Policy Journal.
3.     Alizadeh, P., & Nasiri, M. (2025). Governance structure of technology in Iran: Analysis of institutional challenges and policy requirements for improving efficiency based on content analysis of legal documents. Scientific Quarterly of Governance Knowledge, 3(6). DOI: https://doi.org/10.22034/jokog.2025.509483.1066 (In Persian).
4.     Badami, M. A., Meqdadi, M. M., & Pilevar, M. (2022). Investigating the Impact of Cyberspace on the Abuse of the Right to Raise a Child with Emphasis on Religious Education. Journal of Legal Research, 21(50), 457–494. DOI: https://doi.org/10.48300/jlr.2021.279730.1619 (In Persian).
5.     Data Protection Commission. (2021). Fundamentals for a Child-Oriented Approach to Data Processing. Ireland: Data Protection Commission.
6.     EDPS. (2014). EDPS issues guidelines on conflicts of interest in data protection. Retrieved from https://www.edps.europa.eu/press-publications/press-news/press-releases/2014/edps-guidelines-conflicts-interest-data-protection_en
7.     Elvy, S. A. (2024). Age-Appropriate Design Code Mandates. University of Pennsylvania Journal of International Law, 45(4), 953. https://doi.org/10.58112/jil.45-4.3
8.     Etemad. (2024, February 18). The severity of child abuse in cyberspace. Etemad Newspaper. (In Persian).
9.     European Commission. (2022). A digital decade for children and youth: the new European strategy for a better internet for kids (BIK+). Publications Office of the European Union.
10. European Union. (2016). Article 8 GDPR – Conditions applicable to child's consent in relation to information society services - General Data Protection Regulation (GDPR).
11. European Union. (2016). General Data Protection Regulation.
12. European Union. (2016). Recital 38 - Special protection of children's personal data - General Data Protection Regulation (GDPR).
13. Faisal, K. (2022). Certain Legal Aspects of Children's Right to Protect Personal Data in the Context of AI under the European Union Data Protection Laws. Social Science Research Network.
14. Farahmanad, F. (2024). Protection and safeguarding of personal data and information with comparative study of General Data Protection Regulation (GDPR). Journal of New Technology Law, 5(9), 17-25. DOI: https://doi.org/10.22133/mtlj.2023.383528.1164 (In Persian).
15. Faramarziani, P., Ansari, B., Soltanifar, M., & Mozaffari, A. (2022). Identifying and Evaluating Solutions for Protecting Children's Privacy in Cyberspace. Scientific Quarterly of Culture Studies-Communication, 23(59), 151–171. DOI: https://doi.org/10.22083/jccs.2022.286237.3362 (In Persian).
16. Fekraneh, Z. (2024, October 21). "Personal Data Protection" bill received in parliament; government bill still under review. Peyvast Monthly (In Persian).
17. Fekrizadeh, H., & Dorodian, M. (2023). Analysis of cyberspace harms to children with an approach to Iran's legal system. Children's Rights Quarterly, 5(18), 41-53 (In Persian).
18. Ghanizadeh Bafghi, M., & Chaji, F. (2024). A Comparative Study of the Protection of Children's Image Rights in Cyberspace. Journal of Legal Research, 22(56), 263–294. DOI: https://doi.org/10.48300/jlr.2022.325738.1929 (In Persian).
19. Greenleaf, G. (2012). Independence of data privacy authorities: International standards and Asia-Pacific experience. Computer Law & Security Review, 28(1-2), 1-49. https://doi.org/10.2139/ssrn.1971627
20. Guardian, The. (2022, September 5). Instagram owner Meta fined €405m over handling of teens' data.
21. Guardian, The. (2023a, April 4). TikTok fined for UK data protection law breaches.
22. Guardian, The. (2023b, September 15). TikTok fined €345m for breaking EU data law on children's accounts.
23. Hamidi, H. (2015). Ethics and protection of children's online privacy with parental consent. Ethics in Science and Technology, 10(3), 41-57 (In Persian).
24.  Hoseini, F. S., & Hoseinpour, Z. (2022). Legal protections against risks facing children in cyberspace. Journal of Jurisprudence and Media Law Studies, 4(1), 95-116 (In Persian).
25.  ICO. (2021). Age appropriate design: A code of practice for online services (Children's Code).
26. Iran Newspaper. (2022, May 15). "Personal Data Protection" bill goes to parliament, p. 12 (In Persian).
27. IRNA. (2024, May 5). Approval of "Personal Data Protection" bill in government legal commission. Islamic Republic News Agency (In Persian).
28. Islamic Parliament of Iran. (2003). Electronic Commerce Law (In Persian).
29. Islamic Parliament of Iran. (2009). Computer Crimes Law (In Persian).
30. Islamic Parliament of Iran. (2020). Law on Protection of Children and Adolescents. (In Persian)
31. Islamic Parliament of Iran. (2024). Personal Data Protection Bill (In Persian).
32. Khani Razgi, B., Peyvandpour, S., Andi, H., & Ghaemi, A. H. (2024, March 15). Investigating the protection of law for children and adolescents in cyberspace in Iran's legal system. Paper presented at the Thirteenth International and National Conference on Management, Accounting and Law Studies, Tehran (In Persian).
33. Marelli, M. (Ed.). (2024). Data Protection Impact Assessments (DPIAs). In Handbook on Data Protection in Humanitarian Action (3rd ed., pp. 65-74). Cambridge: Cambridge University Press. DOI: https://doi.org/10.1017/9781009414630.009
34. Meisami, F., Aghajani Ronaghi, A., & Shahbazi, A. (2020). The best interests of the child in international human rights law and Iranian law: Reflections on practice and theory. Comparative Law Research, 24(2), 139-162. DOI: http://dorl.net/dor/20.1001.1.22516751.1399.24.2.1.1 (In Persian).
35. Mirshkari, A., Hosseini, S. M. A., & Chaji, F. (2022). Privacy of Children of Celebrities in the Age of Modern Media. Modern Technologies Law, 3(5), 105-120. DOI: http://doi.org/10.22133/MTLJ.2022.340027.1092 (In Persian).
36. Nikbeen, M., & Raoofi, A. (2025). Protection of children's rights in cyberspace from the perspective of the United Nations system and Iranian law. Public Law Studies Quarterly, University of Tehran, 55(1), 697-718 (In Persian).
37. OECD. (2025). How's Life for Children in the Digital Age? OECD Publishing. https://doi.org/10.1787/0854b900-en
38. Panahi, R. (2018). The COP National Framework IRAN's Children Cyber Space: Action Plan and Ecosystem. International Telecommunication Union (ITU).
39. Pasquale, L., Zippo, P., Curley, C., O'Neill, B., & Mongiello, M. (2022). Digital age of consent and age verification: Can they protect children? IEEE Software, 39(3), 50-57. DOI: https://doi.org/10.1109/MS.2020.3044872
40. Pirnia, K., & Abrishami Rad, M. A. (2023). Supervision of the Supreme Council of Cyberspace resolutions in the legal system of the Islamic Republic of Iran. Iranian Association of Administrative Law - Scientific Quarterly of New Administrative Law Research, 5(17), 367-391. DOI: https://doi.org/10.22034/mral.2022.549602.1286 (In Persian).
41. Pourmojeddian, F., & Ebrahimi, S. N. (2020). Legal analysis of protecting children's privacy in cyberspace with a view to Iranian laws and international treaties. Women and Family Studies, Al-Zahra University, 8(4), 82-102. DOI: https://doi.org/10.22051/jwfs.2020.32749.2512 (In Persian).
42. Qotbi, M., & Habibzadeh, T. (2016). Analysis of the position of supra-parliamentary executive institutions approved by parliament in the system of the Islamic Republic of Iran and the framework of the principle of separation of powers. Public Law Studies Quarterly, University of Tehran, 45(3), 341-360 (In Persian).
43. Rose-Ackerman, S. (1999). Corruption and Government: Causes, Consequences, and Reform. Cambridge University Press. DOI: https://doi.org/10.1017/CBO9781139175098
44. Shahbik, H., Heydari, M. J., & Nouzari Fardosieh, M. (2022). Legal solution to resolve conflicts of interest in implementing environmental protection laws and regulations. Scientific Quarterly of New Administrative Law Research, 4(10), 75-100. DOI: https://doi.org/10.22034/mral.2021.538916.1188 (In Persian).
45. Shahsavari, E. (2023). Comparative study of the Iranian model "Protection of children and adolescents in cyberspace" and international child rights standards. Comparative Law Research Journal, 7(2), 105-124. DOI: https://doi.org/10.22080/lps.2023.25007.1471 (In Persian).
46. Shirvani, K., & Isaei Tafreshi, M. (2025). Protection of Children's Personal Data under the General Data Protection Regulation (GDPR) of the European Union and its Absence in Iranian Law. Modern Technologies Law, 6(12), 275–292. DOI: https://doi.org/10.22133/mtlj.2025.493734.1405 (In Persian).
47. Shudra, T. (2023). Children' personal data protection in digital environment with different expectations between parents and children. Journal of Personal Data Protection Law, 1, 1-23.
48. Solgi, M. (2021). National survey of internet and children in Iran; Opportunities and threats. Research Institute of Culture, Art and Communications (In Persian).
49. Supreme Council of Cyberspace. (2021). Protection of children and adolescents in cyberspace. (In Persian)
50. Taghizadegan, M. (2023). Digital resilience of children in Iran: Considerations about digital security and safety of children. Cultural and Social Research Journal of Children and Adolescents, 1(3), 7-26. DOI: https://doi.org/10.22083/cssca.2024.433653.1007 (In Persian).
51. Taherabadi, M. (2022). Information privacy of children in Iran's domestic laws. Children's Rights Quarterly, 4(15), 75-87 (In Persian).
52. Takhshid, Z. (2022). Children's Digital Privacy and the Case Against Parental Consent. Social Science Research Network, 101.
53. UNICEF. (2017). The State of the World's Children 2017: Children in a Digital World.
54.  United Nations. (1989). Convention on the Rights of the Child.
55.  Wenxiao, Z. (2024). Research on legislation of special protection of children's privacy data. The Frontiers of Society, Science and Technology, 6(1). https://doi.org/10.25236/FSST.2024.060102