Gaming Privacy in 2026: COPPA, Age Checks and Player Data

By Andrew R. Jacobs, Esq. | Founder & Managing Attorney, Jacobs Counsel LLC | Director, Sports, Entertainment & Gaming Initiatives, Seton Hall University School of Law | Super Lawyers Rising Star 2026

A game can send a device identifier to an advertising partner before the player creates an account. It can also collect a child's voice through chat or retain age-check records long after the check is complete. A privacy review needs to follow those data flows, not stop at the policy linked in the footer.

The general compliance deadline for the amended COPPA Rule was April 22, 2026; some safe-harbor provisions had a different schedule. The published final rule identifies those dates. For gaming companies, the immediate task is to compare the current requirements with the product and vendors actually in use.

Does COPPA apply to your game or platform?

COPPA protects children under 13. It can apply to covered commercial services directed to children and to other operators with actual knowledge of covered collection from children, including certain third-party collection. A service need not call itself a children's game to require analysis. The current COPPA Rule supplies the definitions and operative requirements.

Audience classification depends on the facts, including the subject matter, visual and audio content, activities, advertising and evidence about intended or actual users. A mixed-audience service is a category of child-directed service that does not primarily target children; it is not simply any game with players of different ages.

For qualifying mixed-audience services, age determination must be neutral and precede personal-information collection beyond the rule's limited exceptions. Primarily child-directed services cannot simply use an age screen to treat older self-declared users as outside COPPA. General-audience services must also address what happens when they acquire actual knowledge that a user is under 13.

Document the classification before selecting an age gate or consent vendor. Include the store listing, marketing, screenshots, audience evidence and a walkthrough of registration, chat, advertising and payments. The FTC's COPPA FAQs provide background, but the FTC cautions readers to consult the amended rule for current requirements.

What changed for parental consent and advertising?

Under 16 C.F.R. § 312.5, covered collection, use and disclosure generally require verifiable parental consent, subject to specified exceptions. Parents must have a separate choice about disclosure to third parties unless that disclosure is integral to the service. Where that choice is required, separate verifiable parental consent is required for the disclosure.

Review the advertising software development kits, commonly called SDKs, alongside analytics, attribution and social features. A vendor described as essential in a contract is not automatically integral under COPPA. Nor does a vendor's consent setting prove that the application stops sending information when the parent declines.

Consider this hypothetical: a parent agrees to an account but declines optional third-party disclosure. Test whether the game still starts the same advertising SDK, sends the same identifiers or makes the child's profile public. The answer must match the parent-facing choice and the applicable rule.

Age checks are different from parental consent

Age assurance asks about the user's age; verifiable parental consent asks whether the child's parent authorized the relevant practices. Treating those as interchangeable can leave a gap between a vendor's product and the operator's obligations.

The FTC's February 25, 2026 enforcement policy describes conditional enforcement discretion for age-verification collection by mixed-audience and general-audience operators. It does not remove COPPA or create a general exemption for age-check data.

The policy requires age-verification-only use, restricted sharing with vetted recipients and written assurances, prompt deletion, clear privacy-policy notice, reasonable security and reasonable steps to assess accuracy. Operators must comply with COPPA in other respects. The statement does not extend its approach to primarily child-directed services, create substantive rights or prevent the FTC from investigating individual cases.

Review what the vendor keeps, whether it reuses images or identifiers, and what the game learns from the result. Identifying a user as under 13 can supply actual knowledge. Have a defined path for that result instead of collecting the information and leaving the same unrestricted experience in place.

📥 Free Download: Gaming Compliance 101

Understand skill, chance, sweepstakes and the compliance questions behind a gaming launch.

Security and retention now need written, working programs

Section 312.8 requires a written security program suited to the children's information and the operator's circumstances. It includes a responsible employee or employees, risk assessments at least annually, safeguards, regular testing and monitoring, and evaluation at least annually. The rule also requires reasonable vendor capability checks and written security assurances in the covered circumstances.

Bring legal, security and product staff into the same review. A contractual promise from an SDK provider should be compared with the data it receives and the controls the team can verify. Keep a list of outstanding issues, the person responsible for resolving each one and the relevant product decision.

Section 312.10 limits retention to what is reasonably necessary for the specific collection purposes and prohibits indefinite retention. It requires a written retention policy stating purposes, the business need for retention and a deletion timeframe, provided in the service's required online notice.

Translate that policy into actual systems: accounts, support tickets, voice recordings, SDK records, identity checks and backups. If another legal obligation may require preservation, have counsel reconcile it with the retention rule rather than quietly making the schedule indefinite.

A gaming privacy review checklist

This checklist is a preparation aid, not a statutory form or certification. COPPA also provides parental rights to review and delete a child's information and refuse further collection or use. Build the request process around the applicable requirements, the information held and an appropriate identity check.

COPPA is one part of the privacy review

Player location, the business's activities and applicable thresholds can trigger additional state privacy obligations. The California Attorney General's CCPA guidance, for example, explains coverage criteria, consumer rights and rules for selling or sharing minors' information. COPPA's under-13 framework should not be treated as the age threshold for every privacy law.

Map the places where players are located and the purposes for which data is used. If the product serves other countries, obtain the relevant jurisdictional analysis. A worldwide privacy statement or a single consent setting does not answer all coverage questions.

Coordinate this work with the gaming launch checklist. If users can share images or video, separately assess the TAKE IT DOWN Act's platform requirements; that analysis does not replace the privacy review.

Questions gaming companies ask about privacy

Does an age checkbox make a game COPPA compliant?

No. Coverage depends on the audience and the operator's knowledge, and a covered service must address collection, notice, consent, security, retention and parental rights. Age screening must fit the applicable rules and the actual product.

Is targeted advertising always prohibited in a game with children?

The answer depends on the data practices and applicable law. COPPA's amended rule requires a separate parental choice and consent for covered non-integral third-party disclosures. Other laws or platform terms can impose additional restrictions.

Can an age-verification provider keep children's identity data for its own purposes?

The FTC's 2026 age-verification policy is conditional on age-verification-only use and prompt deletion, among other safeguards. Do not assume that buying an age-check service authorizes secondary use or indefinite retention.

Does updating the privacy policy complete the review?

No. The policy and notices need to match what the product and vendors actually do. Consent behavior, data flows, written programs, parent requests and deletion controls also need review.

Prepare the product, policies and vendor agreements together

Jacobs Counsel can help assess the legal requirements, notices and contracts for a gaming product, subject to conflicts and an agreed engagement. Bring the product walkthrough, audience evidence, data map, SDK list, vendor agreements and current notices. Identify any active complaint or regulator communication when discussing scope.

Explore gaming law services or discuss your gaming privacy review. For recurring commercial and product questions, see outside counsel support.

Sources checked September 21, 2026. General information, not legal advice or clearance to launch. The review needed depends on the product, data practices, users and applicable law.

Need Legal Support?

We help high-performing creators, athletes, and founders protect their brands and build sustainable businesses.