Recital 51

The requirements of this Regulation on age assurance should be without prejudice to the application of Regulation (EU) 2016/679, notably the principles of purpose limitation and data minimisation as provided for in Article 5(1) points (b) and (c), thereof, as well as the requirements of data protection by design and by default. In particular, the requirements in this Regulation should not lead providers of services in scope to maintain, acquire or process more personal data than strictly technically necessary to assess if the recipient of the service is a minor. In addition, providers of services in scope should not further process this information or combine it with additional data for any other purpose. Data protection obligations should be applicable both to providers of services in scope and any third party involved in age assurance, such as providers of age assurance solutions. To ensure the highest level of privacy and data protection, age assurance solutions used should be based on state-of-the-art technology and be zero knowledge proof.