Children online: COPPA, design codes, and age assurance

Lesson 4 of 5 in Biometric Surveillance, Law Enforcement AI, and Protecting Children.

Everything in the second half of this module rests on one legal move: children get heightened protection by default, and the burden of knowing who is a child shifts to the service. Three regimes anchor the field.

COPPA (US, 1998) applies to online services directed to children under 13 or with actual knowledge of under-13 users: verifiable parental consent before collecting personal information, data minimisation, deletion rights. Its AI moment arrived when the FTC fined Amazon $25 million (2023) for keeping children’s Alexa voice recordings indefinitely — partly to train models — after parents requested deletion. The FTC’s 2025 COPPA Rule amendments (effective June 2025) sharpened the AI angle: separate opt-in consent for disclosing children’s data to third parties, including for AI training, written retention policies, and a ban on indefinite retention.

The UK Age Appropriate Design Code (Children’s Code, in force September 2021) reframed the question from consent to design: fifteen standards requiring high-privacy defaults, off-by-default geolocation and profiling, and no nudge techniques that push children toward weaker protections — applying to any service likely to be accessed by under-18s, not just child-directed ones. It moved markets: YouTube, TikTok, and Instagram all changed teen defaults globally in the months around its commencement.

GDPR Article 8 sets the EU consent floor (age 13–16, member-state choice), and the EU AI Act adds two AI-specific layers: Article 5(1)(b) prohibits exploiting vulnerabilities due to age in ways that cause significant harm, and recital 48 plus Article 9 push child-specific risk assessment into high-risk systems.

That burden-shift makes age assurance — knowing, with proportionate confidence, whether a user is a child — the load-bearing technology of the whole field. And age assurance is itself usually an AI system: facial age estimation models (is this face over 18?) are the dominant method, which means the tool for protecting children raises its own accuracy, bias, and biometric-data questions. Regulators publish buffer policies for exactly this reason — if the legal line is 18 and the estimator’s mean error is two-plus years, you set the operational threshold higher and route borderline cases to stronger verification.

Two 2025 milestones made age assurance mandatory at scale: the UK Online Safety Act’s “highly effective age assurance” duty for pornography and other priority content (Ofcom enforcement from July 2025), and Australia’s under-16 social media minimum age (in force December 2025) — the world’s first outright age-gate on general social platforms, with platforms required to take reasonable steps to prevent under-16 accounts. The EU, meanwhile, published DSA guidelines on protection of minors and is piloting a privacy-preserving age-verification app ahead of EU Digital Identity Wallets.

Key terms: coppa, age assurance, aadc, verifiable parental consent, age estimation

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.