In response to a query on the processing of personal data of minors who are provided with loyalty cards, the Spanish Data Protection Agency (SDPA) advised that, unlike minors over 14 years of age who may give a valid consent to the processing of their personal data, the processing of personal data of minors under 14 requires the consent of their parents or guardians. In the latter case there is no particular procedure for the controller to confirm the child's age and the authenticity of the parental consent, but the SDPA accepts two forms: (i) the application is submitted by the parent or guardian; or (ii) the parent or guardian authorises the application previously filed by the minor. In both cases, the SDPA recommends obtaining a copy of the ID of the parent or guardian to verify that the signature matches the application or authorisation submitted.