COPPA and kids' privacy for game marketers

The FTC's updated COPPA rule, finalised as background regulation before 2026 and already shaping how mixed-audience apps handle data, remains the starting point for any UA team running campaigns that could reach an app with a child-directed audience. The stakes for a buyer run higher than most media plans account for.

Mixed-audience apps, ones with a general audience but a meaningful share of under-13 users, sit in the hardest position under COPPA. A studio cannot simply declare an app general-audience to escape the rule's obligations when actual knowledge or reasonable inference suggests a substantial child audience exists, and the FTC has shown it will look at subject matter and visual style, and at the age distribution advertisers themselves report, when it decides after the fact how a rule applies. So the safest position for a UA lead is the dull one. Treat any app with meaningfully mixed demographics as though child-directed obligations apply to at least a segment of it, rather than betting a campaign's targeting on a favourable interpretation that might not survive scrutiny.

What this restricts inside a campaign

The restriction that bites hardest in paid UA is on data collection and targeting itself. Behavioural advertising, the kind that relies on a persistent identifier tracking a user across apps and sites to build an interest profile, is off the table for verified child users under COPPA without parental consent, and most game studios have no practical way to obtain that consent at the scale a UA campaign needs. Standard retargeting and lookalike audience building go with it for any campaign segment known to be under 13. What's left for that population is contextual targeting: buying against the app or content category rather than an inferred user profile.

Apple and Google have each built their own guardrails on top of the underlying law. Apple's Kids category on the App Store adds its own restrictions on third-party analytics and advertising SDKs inside an app listed there, which bars most standard mobile ad SDKs from a Kids-category app entirely. Google's Play Families policies work similarly, asking apps likely to appeal to children to certify compliance and restricting which SDK families a Families-eligible app may include. A studio building for this audience picks a fundamentally different UA model from day one, because paid acquisition inside these constraints looks more like traditional media buying against demographic and contextual signals than like the identifier-driven targeting the rest of mobile UA runs on.

Outside the US, a studio distributing in the UK meets a parallel obligation under the Information Commissioner's Office's Age Appropriate Design Code, which applies similar logic to any service children are likely to use, whether or not the studio explicitly markets it at them. The code pushes in the same direction as COPPA: data minimisation, and away from profiling-based advertising for a young audience. The legal mechanics differ. A UA team working across both markets gains little from treating the two regimes as separate compliance projects, since contextual targeting with strict segmentation for any child-likely audience satisfies both without requiring two different campaign structures.

Segmentation as the practical answer

For a studio with a mixed-audience portfolio, the workable approach most measurement leads land on is strict campaign segmentation rather than one compliant approach stretched across every audience. A title's general-audience campaigns run with standard targeting and attribution. Any campaign segment likely to reach under-13 users runs on contextual targeting only, with no persistent identifier tracking and no behavioural retargeting, which buys compliance certainty at the price of a worse measurement picture. Blending the two into a single campaign that serves both audiences under one targeting strategy is the mistake that draws regulatory attention, because it forces a studio to defend one approach against the stricter of the two standards it should have applied separately.

The COPPA questions worth asking before a campaign launches are not complicated, though a deadline makes them easy to skip. Does this app or campaign segment have actual knowledge of, or reasonable grounds to infer, a meaningful under-13 audience? If it does, has the targeting come down to contextual signals with no persistent identifier in play? Answer both honestly before spend goes live and you avoid most of the exposure this area of law creates.

Related archive reading

These articles provide related context and remain subject to their stated review status.

• Data clean rooms for game marketers
• Android attribution reporting after Sandbox