Under-18 learners: consent, guardians and the data you hold

You can apply for a provisional licence at 15 years and 9 months, and “you can usually start driving a car when you’re 17”. A driving school’s newest learners are, more often than not, children in the eyes of data protection law — and will be for months of lessons, sometimes right up to the test.

That means you are processing children’s personal data, routinely, and the Information Commissioner’s Office expects you to treat it differently. Here is what that means in practice, what to collect from a parent or guardian, and how Passdesk handles it.

The 13 that confuses everyone

The number people half-remember is 13. It comes from Article 8 of the UK GDPR, which the ICO summarises as “only children aged 13 years and over may lawfully provide their own consent for the processing of their personal data” — below 13, “an adult with parental responsibility must provide consent”.

Two things about that number matter for a driving school.

First, it applies specifically to information society services — online services offered directly to a child — and only when you rely on consent as your lawful basis. The ICO is explicit that Article 8 “does not require you to always get consent for the processing of children’s personal data in this context, but if you choose to rely on consent it sets out further conditions”. A 17-year-old can consent to an online account in their own right.

Second, it does not mean a 17-year-old is treated like an adult. The ICO’s guidance is that organisations should be “designing your processing activities and business practices with children’s best interests in mind”, choosing an appropriate lawful basis for a child’s data, and writing privacy information a child can understand. And if you “intend to use children’s personal data to offer an online service to a child then you must do a DPIA” — a data protection impact assessment — because the ICO treats that as likely to be high risk.

A 17-year-old learner can sign up for lessons, agree to your terms and log in to a learner portal. The school still owes them more care than it owes a 30-year-old, and the online parts of what you offer — a booking app, a progress portal — are the parts the ICO is looking hardest at.

Which lawful basis you are on

For most of a driving school’s processing, the lawful basis is not consent. You hold a learner’s name, contact details, lesson history and progress because you have a contract to teach them. That basis does not depend on age, and it is the right one for the core record.

Consent comes in for the extras, and those are the ones to think about for a child:

• Health information. A learner’s medical conditions are special category data. Storing them needs an Article 9 condition, and for a child, explicit consent from a parent or guardian is the defensible route.
• Location. Recording where a learner drove, with GPS, is a trace of a child’s movements. Treat it as consent-based and be able to show the consent.
• Marketing. Do not market to a child’s account without a specific, separate opt-in. The ICO’s guidance singles out marketing and profiling as areas needing particular thought.
• Research and statistics. If you contribute anonymised data to anything, the child, or their guardian, should be able to opt out.

Our GDPR primer for driving schools covers lawful basis, controller and processor roles, and the audit trail in more depth.

What to collect from a parent or guardian

At sign-up, for every under-18 learner:

1. A named parent or guardian, with their relationship to the learner — parent, legal guardian, or something else you record in words.
2. Their contact details, email and phone. This is the person you call when a lesson is cancelled at short notice, when the learner does not turn up, and if anything happens on the road. It is also who you need if the learner is unwell mid-lesson.
3. An emergency contact if it is not the same person. Ask; do not assume.
4. Confirmation that they know the learner is on your books and what data you hold. A one-line consent from the guardian, dated and stored against the learner, answers most questions.

Then hold that guardian information to the same standard as the learner’s own. It is personal data about a second person who never signed your terms.

Payment by a parent

Most under-18 learners are paid for by someone else. That is a contract question before it is a data one: be clear in your terms who the paying party is, and keep the payment record attached to the learner it pays for. Card and Direct Debit details never belong in your learner records — leave them with the payment provider, and note only who paid, how much and for what.

Photos and media

A photograph of a 17-year-old holding a pass certificate is the most common piece of children’s data a driving school publishes, and the one most often published without asking. Get permission for it in writing, from the learner and — under 18 — from the guardian, and record what it was given for. A pass photo for the school’s social media is not consent for a paid advert.

Lesson video and in-car recording are a bigger step. If you record lessons for any purpose, that needs its own notice and its own consent, and the footage needs a retention rule you follow.

How Passdesk handles under-18 learners

Passdesk has two under-18 flows. In both, a guardian confirms, with a link only they receive, before the parts that matter switch on.

Solo learners signing up themselves. When a learner’s date of birth puts them under 18, the sign-up form requires a parent or guardian’s email, their relationship to the learner (parent, legal guardian or other), and the learner’s confirmation that a parent or legal guardian will receive the email. The account is created but stays inactive, with no subscription started. The guardian gets a one-shot consent link, valid for 14 days, as of September 2026. If nothing happens, Passdesk chases the same link at three days and again at ten, only during UK daytime hours; a learner who turns 18 in the meantime drops out of the chase. When the guardian confirms, the moment of consent is written to the learner’s consent log and the account unlocks. If consent never arrives, the link expires and the record is removed on the retention schedule.

Learners a school adds. When a school creates an under-18 learner, the guardian is emailed a consent link in the same way. Lessons and bookings work immediately — the school is the controller and supervises in person — but until the guardian confirms, two things are blocked: storing the learner’s medical details, and GPS practice-route recording. Those are the health and location uses above.

Guardian details at rest. The guardian’s name, email and phone on a learner record — and the guardian email a solo learner supplied at sign-up — are encrypted at rest, and the audit trail shows them as redacted rather than in the clear.

Parents who want to follow along. A solo learner can invite up to two supporters — usually parents — who can see and update progress and nothing else. The learner sends the invitation, not the school.

Passdesk does not gate photos or lesson media on guardian consent; that permission is yours to collect and record.

The short version

Assume most of your learners are children until proven otherwise. Put the core record on contract, not consent. Get the guardian’s details and a dated confirmation at sign-up, and treat health, location, marketing and photos as separate decisions with separate permission. Do the DPIA for whatever online portal your learners log in to, and keep it short: a page that says what you collect, why, and what a parent can ask you to delete.

This is a plain-English reading of the ICO’s published guidance as of September 2026, not legal advice. The ICO’s children’s guidance is the primary source and is written to be read by a small business; the links are below.