Italy required parental consent for AI use under fourteen

What happened

The President of the Republic promulgated Legge 23 settembre 2025, n. 132 ('Disposizioni e deleghe al Governo in materia di intelligenza artificiale', provisions and delegations to the Government on artificial intelligence) on 23 September 2025. The Gazzetta Ufficiale published it two days later, as Serie Generale no. 223 of 25 September 2025, and the law entered into force on 10 October 2025, so promulgation, publication and entry into force are three distinct dates the official record states separately. Article 1(2) provides that the law is to be interpreted and applied in conformity with Regulation (EU) 2024/1689, the AI Act.

What the documents show

Article 4, paragraph 4 of the law provides, in the original: 'L'accesso alle tecnologie di intelligenza artificiale da parte dei minori di anni quattordici nonché il conseguente trattamento dei dati personali richiedono il consenso di chi esercita la responsabilità genitoriale', meaning access to artificial intelligence technologies by minors under fourteen, and the resulting processing of their personal data, requires the consent of whoever holds parental responsibility. The same paragraph adds that a minor who has turned fourteen, but is still under eighteen, may give their own consent to the data processing connected with using an AI system, provided the required information is easily accessible and understandable. Article 3(5) separately states that the law creates no new obligations beyond those in the AI Act itself for AI systems and general-purpose AI models.

The mechanism

The consent rule attaches to two things at once, access to the technology and the personal-data processing that access involves, rather than regulating either alone, and it sets its threshold at a specific age, fourteen, rather than leaving age-gating to platform discretion. Above that age and below eighteen, the minor gains a personal right to consent to the data processing specifically, layered inside existing data-protection law, the GDPR and Italy's implementing code, rather than replacing it. The law positions itself as a national layer operating in conformity with the EU regulation, not a competing standard.

What it leaves open

The text does not specify how a provider should verify a user's age before applying the under-fourteen consent requirement, leaving implementation to existing data-protection practice and, potentially, future delegated decrees. It also does not carve out a distinct category for companion-style conversational AI, so the same consent threshold that applies to any AI system applies to one designed to sustain an ongoing relationship with a young user. This is an editorial reading: nothing in the text singles out companion apps for extra scrutiny beyond the general under-14 consent rule.

• How does the service verify a user's age before deciding whether parental consent applies?
• If the user is between fourteen and seventeen, is their own consent captured separately from a parent's?
• Does the provider's privacy notice make the required information easily accessible and understandable to a minor, as the law specifies?

Italy's law adds a bright-line age threshold to a data-protection landscape that the AI Act itself leaves largely to member states, which makes the fourteen-year mark, and how it is checked in practice, the detail most worth verifying in any specific product.