The legal protection of children's data in the era of big data faces two major dilemmas: “the empowerment and protection” and “the individualization and average age”. The EU GDPR has made efforts to cope with the above difficulties, but there are still some problems. The strict parental consent principle of GDPR may result in an excessive protection for children; the simple dichotomy of average age may limit the network activities of talented children. The substitution of the differentiated parental consent approach to strict parental consent principle helps balance the conflict between “empowerment” and “protection”; the substitution of an individual assessment based on certain age limit to the cooperation and dialogue of stakeholders in the data chain will constantly seek better data protection programs of children. The formulation of the “Network Protection Regulation of Minors” should draw reasonable references to the legislative experience of EU GDPR and Children's Online Privacy Protection Act (COPPA) in America.