Children's data

Children's data has stricter rules, and the age that counts as a child differs by law. This page covers age gating, picking an age floor, and parental consent. Read it before you set a minimum age, add sign-up, or add anything a child could use to share content.

How it works

The key insight: children's privacy law attaches to processing a child's personal data, not to the content. A reader with no account, no analytics and no ad ID can be used at any age. The account, the tracking SDKs and the social features are what bring in the rules.

The ages, as of October 2026

Law	Who is a child	What it requires	Source
GDPR Art. 8	Under 16 for consent to online services. Member states may set a lower age, not below 13	Where consent is the basis, the parent gives or authorises it; make "reasonable efforts" to verify	GDPR on EUR-Lex
DPDP Act s.9 and Rule 10	Under 18	Verifiable parental consent before processing. No tracking, behavioural monitoring or targeted advertising directed at children. No processing likely to harm a child	DPDP Act, DPDP Rules
US COPPA	Under 13	Verifiable parental consent	FTC (not researched for this page: verify before relying on it)

DPDP Rule 10 applies from about 13 May 2027. It allows two ways to verify the parent: details of an identifiable adult you already hold, or a virtual token from an authorised entity such as DigiLocker. The Fourth Schedule exempts some classes, such as education, health and childcare bodies, and certain purposes such as age checks. Verify the exact exemptions with legal before relying on them.

Self-declared age (a date-of-birth picker) is the usual gate. It is weak evidence. Under DPDP, operating Indian accounts for under-18s without verifiable parental consent is a risk decision for leadership and legal, not an engineering call.

How to build it

1. Pick the floor as a product decision, with legal

A generic example of tiers that one team used:

Tier	Minimum age	Why
Read only, no account	Any	No personal data collected
Account	13 globally; 16 in the EU where Art. 8 applies	13 avoids most parental-consent builds outside India and the EU
User-generated content, contacting strangers, precise location	18	Highest risk of harm to a child
Ad tracking and attribution	18	DPDP bans targeted ads to children; stores restrict ad IDs for minors

India is the hard case: under DPDP, anyone under 18 is a child. A 13 floor does not "open" India; it means accepting a documented risk until verifiable parental consent exists.

2. One source of truth for the number

# config.yaml - every surface reads this, nothing hard-codes it
age:
  minimum_account_age: 13
  minimum_age_by_region: { EU: 16 }
  minimum_ugc_age: 18

• Enforce on the server. The client gate is for UX only.
• Return an error code (dob_too_young), never branch on English message text.
• The database check, the API validation, the app pickers, the AI onboarding prompt and the translated error string all read the same value.

3. Collect nothing before the gate

• No analytics, attribution or ad-ID SDK before age and consent are known.
• No push token registration for a user who has not passed the gate.
• For a child or teen tier: ad personalisation signals off, ad ID collection off.

4. Stores

• Apple: apps in the Kids Category must not send personal data to third parties and should not include third-party analytics or advertising (Guidelines 1.3 and 5.1.4). A parental gate is not the same as parental consent under the law.
• Apple age rating and Google Play target audience must match the terms. A Google Play target audience that includes children brings in the Families policy. Check which age groups trigger it before you choose: verify before relying on this.
• Sources: Apple App Review Guidelines, as of October 2026.

5. Child safety

If users can post content, you need a way to report child sexual abuse and exploitation (CSAE), a prioritised queue, and a runbook:

1. Preserve, do not delete. Hide the content from others, keep the record under legal hold. Never download, copy or forward suspected abuse material.
2. Suspend the account.
3. Report to the authorities as the law requires (for example NCMEC in the US, and national reporting channels elsewhere). Legal confirms the duty per country.
4. Log the incident separately, with restricted access.
5. Legal hold beats routine deletion: the erasure job must skip held records.

Rules

Rule

The minimum age lives in one config value and is enforced on the server. Nine hard-coded copies of the number will drift, and then users are told one age and blocked at another.

Rule

No tracking or targeted advertising for anyone known to be under 18 in India, or below the local age in other markets. DPDP bans it for children, and stores restrict ad IDs for minors.

Rule

Change the terms first, then the code, then the store rating. A store rating that matches the legal terms is correct even if engineering has decided otherwise.

Mistakes we made

• The age was hard-coded in nine places. Database check, two API validators, two app pickers, a constant, an AI tool declaration, a seeded AI prompt and a translated error string. When the floor moved, some copies moved and some did not.
• Branching on message text. An error handler matched the English text "at least 13 years". The validator was changed to say 18, so the "too young" branch never fired and users saw a generic error. Use error codes.
• A constraint added as NOT VALID. Raising the age in the database without validating existing rows grandfathered in under-age accounts nobody ever counted.
• The decision never reached the terms. Engineering agreed a new minimum age, but the terms still said the old one. The store age rating had been set to match the terms. Read the terms before calling a store setting wrong.
• SDKs before the gate. An attribution SDK and push registration ran at app start, before age or consent, so a device ID left the phone for every user including children.

Checklist

• Age floor per tier decided with legal and written in the terms.
• One config value; server enforces it; errors are codes.
• Nothing collected before the gate: no analytics, attribution, push token.
• Child or teen tier: no tracking, no targeted ads, no ad ID.
• EU users: Art. 8 age applied where consent is the basis.
• India: decision on under-18s recorded as a risk decision until parental consent exists.
• Store age rating and target audience match the terms.
• CSAE report path, prioritised queue, runbook and legal hold in place for any UGC.