Yes, in practice. FTC staff guidance says an operator of a child-directed app must look at what each third party collects, and Google Play's Families policy says SDK collection counts as your app's collection. If an SDK gathers identifiers from children, you answer for it. This is general information, not legal advice.
What the FTC guidance says
The FTC's COPPA frequently asked questions are staff views, not binding on the Commission, but they show how the agency thinks. Three points matter for builders:
- Telling a third party that your site is child-directed does not by itself relieve you of COPPA obligations. You either avoid collection by others, or give notice and get prior parental consent.
- Operators of child-directed apps must examine each third party's collection practices to decide whether parental notice and consent are required.
- Before showing ads on a child-directed property, check whether you can limit ads to contextual only, and which persistent identifiers and location data will be collected. You can be liable for collection by others on your property.
The same FAQ says operators must keep children's information confidential, secure, and intact, and release it only to parties that can do the same.
What Google Play adds
Google's Families policy for apps aimed at children says such apps must not contain APIs or SDKs that are not approved for primarily child-directed services. Apps aimed at both children and adults may include other SDKs only behind a neutral age screen, or implemented so they do not collect children's data. Ads shown to children must come from self-certified ads SDKs, and developers must disclose child data collection "including through APIs and SDKs called or used in your app."
One violation the policy calls out: using an API whose terms of service prohibit use in child-directed apps.
A review you can run this week
- List every SDK and transitive library in your mobile and web builds. Your build files and lockfiles are the source of truth, not the product spec.
- For each one, note what it collects: advertising IDs, device identifiers, location, usage events.
- Read its terms. Does it allow child-directed use?
- Decide: keep, replace, configure to collect less, or remove.
- Record the decision and date, then re-check at every major SDK version bump.
Updates can change behavior. A minor version that adds a new data field is a good reason to review again.
Why the dependency tree matters here
The SDK you chose is only the top layer. It can pull in other libraries that you never evaluated. Watching the full tree, and the diff between releases, is the only way to notice a new collector arriving through an update.
Try it yourself
Open the demo, look at how transitive packages appear that no one chose directly, and imagine one of them being a data collector in your app.
Click through it at your own pace, or open it full screen.
Safeguard's SBOM and dependency scanning can list what is in a build, and the free scan is a quick way to see a repository's inventory.
Quick check
If the SDK vendor says it is COPPA compliant, are we covered?
Not automatically. FTC staff guidance says the operator must examine third parties' collection practices. Keep the vendor's statement with your own review notes.
Does this only apply to apps for young children?
COPPA concerns children under 13. Apps that serve mixed audiences have additional questions about age screens, so ask your counsel how your product is classified.
Sources
Last reviewed: 19 October 2026.
