Website operators collecting data from users under 13 face a patchwork of overlapping rules – COPPA in the US, GDPR-K provisions across the EU, and age-appropriate design codes in the UK and California – and getting the site design wrong is one of the fastest ways to attract regulatory attention to children’s privacy online. A single sign-up form that asks for a birthdate, a game that tracks scores without consent gates, or a school platform that quietly enables third-party analytics can all trigger obligations most teams don’t realize apply to them.
Why children’s data gets special treatment
Regulators treat children’s personal data differently because kids can’t meaningfully consent, don’t understand tracking, and are more vulnerable to profiling and behavioral advertising. The US Children’s Online Privacy Protection Act (COPPA), enforced by the FTC since 2000 and updated with a new rule finalized in January 2025, applies to any commercial website or app “directed to children under 13” or where the operator has actual knowledge a user is under 13.
GDPR’s Article 8 sets the digital consent age at 16 by default, but EU member states can lower it to as young as 13 – Germany, France, and Ireland use 16, while Spain, Italy, and Denmark use 13 or 14. This inconsistency alone causes headaches for pan-European sites, since a single consent flow rarely satisfies every jurisdiction at once.
The UK’s Age Appropriate Design Code (Children’s Code), in force since September 2021 under the ICO, goes further than either by requiring “high privacy” default settings for anyone likely to be accessed by under-18s, not just sites explicitly for children.
What COPPA actually requires on a live site
COPPA applies once a site collects, uses, or discloses personal information from a child under 13. Personal information under the rule includes names, addresses, geolocation precise enough to identify a street, photos or videos, and persistent identifiers like cookies or device IDs used for behavioral advertising.
Operators must post a clear privacy notice describing what’s collected and why, obtain verifiable parental consent before collection (with narrow exceptions for things like one-time contact to respond to a request), let parents review and delete their child’s data, and avoid conditioning participation in a game or activity on collecting more data than necessary.
The January 2025 FTC amendments added a separate, affirmative opt-in requirement for third-party advertising and expanded what counts as a persistent identifier to include some biometric data. Sites that were previously compliant by bundling ad-tracking consent into a general parental consent screen now need a distinct opt-in specifically for behavioral advertising, with a compliance deadline that pushed into 2026 for many operators still updating consent flows.
GDPR-K in practice: consent age and parental verification
There’s no single “GDPR-K” statute – it’s shorthand for the parts of GDPR (mainly Article 8) covering children. In practice, once a site determines a visitor is under the applicable national age threshold, it must obtain consent from a parent or guardian rather than the child, and must make “reasonable efforts” to verify that the person giving consent actually holds parental responsibility, considering available technology.
The tricky part is the verification standard: GDPR doesn’t mandate credit card checks or ID uploads like COPPA’s more prescriptive verifiable parental consent methods, but “reasonable efforts” still needs documentation. A site that just adds a checkbox saying “I am over 16” with no age gate or follow-up has not made a reasonable effort, and several EU data protection authorities – including France’s CNIL in guidance updated in 2021 and 2024 – have said so explicitly in enforcement actions against edtech and gaming platforms.
Site design choices that create or avoid liability
Design decisions, not just policy text, are what regulators and plaintiffs’ attorneys scrutinize. A few patterns show up repeatedly in enforcement actions and audits:
Age gates that are easy to lie through (a simple dropdown with no consequence for entering a false birthdate) are treated as decorative rather than protective – the FTC’s 2022 settlement with Epic Games over Fortnite ($275 million, the largest COPPA penalty at the time) cited default settings and matchmaking design, not just data collection, as the problem. Default settings matter under the UK Children’s Code specifically: geolocation, profiling for ads, and public-by-default profiles should be off unless a user affirmatively turns them on. Nudge techniques – streaks, “your friends are online now” prompts, autoplay – that keep children engaged longer are now explicitly called out as a risk factor in Children’s Code guidance, separate from data collection itself.
A practitioner reviewing a children’s site checks these in order: does the age-gate mechanism actually filter anyone out, do default account settings match the “high privacy” baseline, and does the consent record for advertising cookies exist as a separate, timestamped event rather than being bundled into a general terms acceptance.
Common myth: “we don’t market to kids, so we’re fine”
A persistent misconception is that COPPA and similar laws only apply to sites explicitly designed for children, like cartoon character games. In reality, “actual knowledge” triggers COPPA regardless of intended audience – if a general-audience forum lets a 10-year-old enter their real age in a profile field and the operator does nothing about it, that knowledge alone creates liability. The FTC’s 2019 settlement with TikTok’s predecessor Musical.ly ($5.7 million) rested partly on evidence that the company knew a large share of users were children even though the app wasn’t marketed as kids-only. Mixed-audience sites need an age-screening mechanism precisely to avoid this “actual knowledge” trap, not because they intend to target children.
Common mistakes in implementation
Three patterns keep recurring in audits of sites that attempt compliance but fall short. First, teams build the age gate and parental consent flow, then let a marketing team add a new pixel or chat widget months later without re-checking whether it collects persistent identifiers – third-party scripts often introduce hidden data collection that nobody flagged against the children’s privacy policy. Second, sites verify parental consent once at signup but never revisit it when a feature changes, even though GDPR-K and COPPA both expect notice of material changes in data practices. Third, privacy policies describe a compliant process on paper while the actual cookie banner or consent mechanism behaves differently in production – a gap that’s easy to miss without monitoring cookie consent mechanisms technically rather than just checking that a banner renders.
FAQ
Does COPPA apply if my site is based outside the US?
Yes. The FTC has enforced COPPA against foreign-based operators whenever US children can access the site or app, since the law is triggered by the audience reached, not the operator’s headquarters.
Can we use the same consent flow for GDPR-K and COPPA?
Not directly, because the standards differ – COPPA lists specific “verifiable” methods (like a monetary transaction verification or signed form), while GDPR asks for “reasonable efforts” judged case by case. Most multinational sites build a base flow that meets COPPA’s more prescriptive bar, then layer country-specific age thresholds on top for the EU.
What counts as “actual knowledge” a user is a child under COPPA?
Actual knowledge includes things like a user entering a birthdate showing they’re under 13, an email confirming a child’s age, or a parent directly notifying the company – it does not require the company to guess or investigate proactively, but it does require acting once that information exists.
Getting children’s privacy right on a live site is less about the written policy and more about whether age gates, default settings, and consent logs actually function the way the policy claims – a gap that tends to widen quietly as marketing tags, plugins, and feature updates accumulate after launch.