The US Children's Online Privacy Protection Rule applies to operators of online services that collect personal information from children under 13, and the FTC lists internet enabled gaming platforms and mobile apps among covered services. Its six step plan runs from deciding whether you are covered to protecting data and limiting retention. This is a summary, not legal advice.
Step 1: Work out whether you are covered
According to the FTC, you are covered if your service is directed to children under 13 and collects personal information from them, or lets others collect it. You are also covered if you run a general audience service and actually know you are collecting personal information from children under 13. Ad networks and plug ins can be covered when they actually know they collect from users of a child directed service.
For a studio, that means looking at what you really collect: account names, chat, voice, device identifiers, location, photos. Then ask who your players are, honestly, not just who your marketing says they are.
Step 2: Post a compliant privacy policy
The FTC says the policy should list all operators collecting information, describe what is collected and how it is used, state the retention policy and explain parental rights. In games, the operators often include ad and analytics providers, so you need an accurate list of the SDKs in your build.
Step 3: Notify parents directly
Parents need direct notice of your practices before you collect their child's information. A notice buried in a store listing is not the same as one delivered to the parent.
Step 4: Get verifiable parental consent
You need consent before collecting, using or disclosing a child's personal information, using a method reasonably designed to confirm the person is the parent. Which method fits depends on your service, so confirm with counsel rather than copying a competitor's flow.
Step 5: Honor ongoing parental rights
Parents can review the information, revoke consent and have it deleted. Build the tooling early: you need to find a child's data across your databases, logs, analytics exports and backups.
Step 6: Security and retention
The FTC calls for reasonable security procedures and a written retention and deletion policy, keeping data only as long as reasonably necessary. In engineering terms: encrypt in transit, restrict internal access, avoid logging personal data, and delete on a schedule.
Engineering tasks that fall out of this
- Inventory every data field collected from player accounts and every third party that receives any of it.
- Turn off or limit chat, voice and location features for accounts flagged as children where your design allows.
- Review third party SDKs for what they collect, since you answer for what runs in your app.
- Write the deletion procedure and test it.
Safeguard can inventory the third party packages and SDK dependencies in your repositories through SBOM generation, which helps with the operator list. It does not provide legal advice or a consent flow. The free scan is at https://gold.safeguard.sh/scan.
Quick check
Does COPPA only apply to games made for kids?
No. A general audience service is also covered if it actually knows it is collecting personal information from children under 13.
Sources
Last reviewed: 19 October 2026.
