The three children's privacy frameworks most websites meet draw the line at different ages. The US Children's Online Privacy Protection Act (COPPA) protects children under 13 and needs verifiable parental consent before you collect their data. GDPR Article 8 asks for parental consent below 16, or below 13, 14 or 15 where an EU country has lowered the age. The UK's Age Appropriate Design Code applies 15 design standards to every under-18.
Three frameworks, three philosophies
Children's data receives special protection under privacy law in almost every major jurisdiction. But the way each regime defines "child," the obligations it places on website operators, and the penalties it imposes for violations differ sharply.
The United States focuses narrowly on under-13s through COPPA. In the EU, GDPR Article 8 sets a flexible age range between 13 and 16, leaving member states to choose their own threshold. The UK has gone further than both with 15 binding standards that apply to anyone under 18. If your site attracts visitors from more than one of these regions, you need to understand where the rules overlap and where they diverge.
COPPA: the US approach to under-13 protection
The Children's Online Privacy Protection Act applies to websites and online services directed at children under 13, or that have actual knowledge they are collecting data from under-13s. The Federal Trade Commission (FTC) enforces COPPA and published substantial amendments in April 2025, the first update to the rule since 2013.
The amended COPPA Rule adds biometric identifiers and government-issued identifiers to the definition of "personal information," and requires separate verifiable parental consent before a child's data is disclosed to third parties such as advertisers. Persistent identifiers such as cookie IDs have counted as personal information since the 2013 rule. Operators must obtain verifiable parental consent before collecting, using, or disclosing a child's personal information. Methods range from signed consent forms to knowledge-based authentication and matching a face to a verified photo ID.
The amended rule took effect on 23 June 2025, and companies had until 22 April 2026 to comply with most of it. Civil penalties now run up to $53,088 per violation, the amount set by the FTC's latest inflation adjustment.
The COPPA framework comes down to a short list of operator duties under the rule:
- Post a clear privacy notice and send a direct notice to parents.
- Obtain verifiable parental consent before collecting, using or disclosing a child's data, and separate consent for disclosure to third parties.
- Let parents review their child's data, refuse further use and have it deleted.
- Do not make a child's participation depend on giving more data than the activity needs.
- Keep the data secure under a written information security programme, and delete it under a written data retention policy.
GDPR Article 8: flexible age thresholds across the EU
Article 8 of the GDPR governs consent for information society services offered directly to a child. The default age threshold is 16, but member states may lower it to no less than 13.
This flexibility has created a patchwork. Checked against the national statutes on 16 October 2026, Belgium, Finland, Latvia and Sweden opted for 13. Austria, Bulgaria, Cyprus, Italy and Spain chose 14. France and the Czech Republic set theirs at 15. Croatia, Germany, Ireland, the Netherlands and Poland kept 16, Ireland by section 31 of its Data Protection Act 2018. If your website serves visitors across multiple EU countries, the safest approach is to default to 16 unless you can determine the visitor's location.
Below this age, processing is lawful only where consent is given or authorised by the holder of parental responsibility. The controller must make "reasonable efforts" to verify that parental consent is genuine, taking available technology into account. The GDPR does not prescribe specific verification methods, unlike COPPA's detailed list.
What Article 8 does not cover
Article 8 applies specifically to information society services - online services provided at a distance, electronically, at the individual request of the recipient. It does not cover all data processing involving children. Schools processing student records, for instance, typically rely on other lawful bases such as public task or legitimate interest.
The UK Age Appropriate Design Code: 15 standards for under-18s
The UK's Age Appropriate Design Code, often called the Children's Code, came into full effect in September 2021. Enforced by the ICO under the UK GDPR, it applies to any information society service likely to be accessed by a person under 18.
The scope is deliberately broad. If your service is not specifically age-restricted and children could reasonably access it, the Code applies. The ICO has made clear that "likely to be accessed" is a low bar.
The Code's 15 standards go well beyond consent. They include requirements for high-privacy defaults, data minimisation, transparency tailored to children's understanding, and restrictions on nudge techniques that encourage children to weaken their privacy settings. Profiling must be switched off by default for child users unless a compelling reason exists.
In December 2025, the ICO extended its Children's Code strategy to mobile games, and its August 2026 progress update reports a review of children's privacy in mobile gaming. The Data (Use and Access) Act 2025 has also changed the law behind the Code: since 5 February 2026, section 81 of the Act requires services likely to be accessed by children to take "children's higher protection matters" into account when they design their data protection measures.
Age thresholds compared
| Framework | Jurisdiction | Age threshold | Scope |
|---|---|---|---|
| COPPA | United States | Under 13 | Sites directed at or knowingly collecting from children |
| GDPR Article 8 | EU (default) | Under 16 (member states may lower to 13) | Information society services offered directly to children |
| UK Age Code | United Kingdom | Under 18 | Any online service likely to be accessed by children |
| LGPD (Brazil) | Brazil | Under 18 (parental consent for children under 12) | Any processing of children's and adolescents' personal data |
| PIPEDA (Canada) | Canada | Under 13 (the federal privacy commissioner's position) | Commercial activities involving personal information |
Below which age each framework treats a visitor as a child
How each framework handles parental approval
COPPA is the most prescriptive. The FTC lists approved methods of verifiable parental consent, including signed forms returned by post, credit card transactions, video calls, and government-issued ID checks. The 2025 amendments also write knowledge-based authentication, matching a face to a verified photo ID, and a text message method into the rule.
GDPR Article 8 takes a principles-based approach. Controllers must make "reasonable efforts" to verify parental consent, but the regulation does not mandate specific methods. In practice, many sites rely on email-based verification or checkbox confirmations, though regulators have criticised tick-box approaches as insufficient for younger children.
The UK Code does not require parental consent for all processing. Instead, it mandates that services apply high-privacy settings by default for child users. Parental consent under UK GDPR follows the same Article 8 model (with the UK retaining the age of 13), but the Code's 15 standards impose obligations regardless of whether consent is the lawful basis.
Enforcement and penalties
The three regimes differ significantly in how they punish violations.
Under COPPA, the FTC can impose civil penalties of up to $53,088 per violation. High-profile settlements have reached tens of millions of dollars. Epic Games paid $275 million in December 2022 for COPPA violations related to Fortnite.
GDPR fines can reach 4% of global annual turnover or 20 million euros, whichever is higher. The Irish Data Protection Commission fined TikTok 345 million euros in September 2023 for breaches related to children's accounts, including default public profile settings for under-18s. GDPR penalties for children's data violations rank among the largest ever imposed.
The ICO enforces the UK Age Code through the same powers it holds under the UK GDPR. Fines of up to 17.5 million pounds or 4% of global turnover apply. The ICO has so far favoured engagement with platforms over formal fines under the Code.
Cookies, tracking and children: practical implications
For website operators, children's privacy laws have direct consequences for cookie management.
Under COPPA, you cannot use cookies or similar technologies to collect personal information from known under-13 users without verifiable parental consent. This includes analytics cookies like _ga and advertising pixels like _fbp that create persistent identifiers, which the rule has treated as personal information since 2013. The 2025 amendments add separate parental consent before that data goes to advertisers or other third parties.
Under the GDPR, cookies on sites likely accessed by children require a lawful basis. If that basis is consent, age-gating mechanisms may be needed to check that the person giving consent meets the relevant threshold. Valid consent from a child below the applicable age requires parental authorisation.
The UK Code goes further by requiring that profiling and behavioural advertising be switched off by default for child users. Even if a child (or parent) technically consents to marketing cookies, the Code's high-privacy-by-default standard means you should not enable tracking that serves personalised ads to under-18s without careful justification.
One website, three sets of rules
Running a single website that meets all three frameworks is achievable, but it requires deliberate design choices.
Start by determining whether your site is likely to be accessed by children. If it is, apply the strictest standard as your baseline - the UK Code's under-18 threshold with high-privacy defaults. This approach meets the UK requirements and covers much of what COPPA and GDPR Article 8 ask for as well.
Implement age verification or age estimation at the point of data collection. For COPPA, you need a mechanism to identify under-13 users and obtain verifiable parental consent. For GDPR, the mechanism should reflect the lowest age threshold relevant to your audience.
Configure your consent tool to suppress non-essential cookies for users identified as children. Geo-targeting can apply different consent rules based on visitor location, so that US visitors and German visitors each get the rules that apply to them. Identifying who is a child stays a job for your own age check.
Short answers on children's privacy laws
Does COPPA apply to websites based outside the United States?
Yes. COPPA applies to any website or online service that is directed at children in the United States or has actual knowledge that it collects personal information from US children under 13, regardless of where the operator is based.
What age counts as a child under the GDPR?
GDPR Article 8 sets a default of 16 for information society services, but member states can lower this to 13. The applicable age depends on the country. Sweden uses 13, Italy and Spain 14, France 15, and Germany and Ireland 16.
Do I need to age-gate my website to meet children's privacy laws?
Not necessarily. COPPA requires action only if your site is directed at children or you have actual knowledge of under-13 users. The UK Code applies if children are likely to access your service. If neither condition applies, age-gating may not be required, though it can serve as a useful safeguard.
Can I set analytics cookies for child visitors without parental consent?
Under COPPA, analytics cookies that create persistent identifiers tied to a child count as personal information collection and require verifiable parental consent. Under the GDPR, you need a lawful basis such as consent, and if the user is below the relevant age threshold, parental authorisation is required. The UK Data (Use and Access) Act introduced limited analytics cookie exemptions, but these do not override the Children's Code obligations.
What happens if I violate COPPA or the UK Children's Code?
COPPA violations can result in FTC civil penalties of up to $53,088 per violation. The ICO can impose fines of up to 17.5 million pounds or 4% of global turnover for breaches of the UK GDPR, which the Code interprets.
Does the UK Age Appropriate Design Code apply to small businesses?
Yes. The Code applies to any online service likely to be accessed by under-18s, regardless of the organisation's size. There are no revenue or employee thresholds. If children can access your site, the 15 standards apply.
Find the cookies that would follow a child
If your website attracts younger visitors, start by knowing what it sets. A free cookie scan lists the cookies your pages set and sorts them into categories such as analytics and marketing, the identifiers children's privacy laws care about most. Kukie.io can then hold those cookies until a choice is made and apply different consent rules by country or region.
