We've said in more than one “EDPS Opinion” that this is an area where we are partly disappointed. The GDPR is not in the form of my dreams, but it's the best we can achieve today. If we started today with a new process, I doubt we could get something better.
On children, the legislator has been less ambitious than expected. We have just one article in the GDPR. We are expecting a new provision with regard to online services in the e-privacy directive.
First of all, there is a fragmented approach in the EU with regard to the age of maturity, and the compromise was that the processing of personal data of a child shall be lawful where the child is at least 16 years old.