A general audience app is not required to investigate users' ages, but COPPA applies once the operator has actual knowledge it is collecting personal information from a child under 13. The FTC says asking for information that reveals age, such as a birth date or grade level, can create that knowledge.
Who COPPA covers
The FTC business guidance says the Children's Online Privacy Protection Rule gives parents control over what information sites and services collect from children under 13. It covers operators of commercial sites or services directed to children under 13 that collect personal information, and operators of general audience sites with actual knowledge they are collecting it from a child under 13.
Third party services such as ad networks and plug ins can be covered too, when they collect information directly from users of child directed sites or services and have actual knowledge.
What the operator must do
For covered operators the FTC lists: a privacy policy, direct notice to parents and verifiable parental consent before collecting a child's personal information. It also points to parental rights, data security, retention and deletion.
This post does not cover the 2025 amendments. The page I reviewed did not mention them, so check the FTC's COPPA pages and the Federal Register for current dates and changes.
Actual knowledge in product terms
The FTC gives examples: a birth date suggesting the user is under 13, or answers to age identifying questions such as grade level or school type. That creates product decisions.
- Sign up fields. A birth date field is an age signal. If you collect it, decide in advance what happens when it shows under 13.
- School features. Asking for grade or school type has the same effect.
- Support and moderation. If staff learn a user is a child, treat it as knowledge and route it to a defined process.
- Analytics. Do not silently collect from a user after you know.
A simple age flow
Use a neutral age screen, do not hint at the cutoff, and do not encourage users to change an answer. If a user is under 13, stop collecting, delete what you hold, and route to a parental consent path if your product supports one. Record the decision logic and test it.
Check your third parties
If you embed ad or analytics code, find out what it collects and whether it is configurable for child users. A general audience product with an SDK that collects device identifiers from everyone can create problems you did not intend.
Safeguard's SBOM and dependency scanning shows which third party packages ship in your product, which is the first step to reviewing their data practices. Legal questions belong with counsel.
Quick check
Must we verify every user's age?
Per the FTC, general audience operators are not required to investigate users' ages, but asking for information that reveals under 13 triggers compliance.
Sources
Last reviewed: 19 October 2026.
