What is your child’s app actually collecting?
Pick any popular free children’s game from the app store. Before your child plays a single level, the app has requested access to location, microphone, contacts, advertising ID, and device storage. Most parents tap “Allow” on each prompt without reading what it’s for, because the alternative is listening to a seven-year-old complain for twenty minutes.
Here’s what those permissions are used for: location feeds ad targeting networks with your home address and daily movement pattern. Microphone access, in the worst cases, allows ambient audio collection — documented in several children’s apps before regulatory action. Contacts are harvested to build a social graph used for cross-app targeting. The advertising ID links your child’s in-app behavior to a persistent profile that follows them across every other app on the device.
Children can’t meaningfully consent to this. Most adults don’t realize they’re consenting to it either.
The laws that are supposed to protect your child
Three legal frameworks cover children’s data, depending on where you live.
COPPA (Children’s Online Privacy Protection Act) applies to US-based services accessed by children under 13. It requires verifiable parental consent before collecting personal data — not just a checkbox, but actual verification. In theory, this means children’s apps can’t collect data until a parent has explicitly approved it. In practice, enforcement has been uneven.
The clearest enforcement example: in 2019, the FTC fined YouTube $170 million for COPPA violations. YouTube had allowed child-directed content channels to collect behavioral data on child viewers and target them with ads — while claiming it couldn’t determine user age. The fine was historic; it still didn’t stop the broader problem.
GDPR Article 8 (EU) sets the consent age at 16, though member states can lower it to 13. Services operating in the EU must verify users’ ages and get parental consent for anyone below the threshold. In 2023, the Irish Data Protection Commission fined TikTok €345 million for processing children’s data without proper consent. The findings included making children’s accounts public by default and using dark patterns to push under-age users toward sharing more data.
India’s DPDPA defines children as anyone under 18, a stricter threshold than either US or EU law. The Digital Personal Data Protection Act requires verifiable parental consent before processing any data about a minor. Its rules were notified in late 2025, and enforcement is phasing in through 2027. Once fully in force, this will cover a significant share of the global children’s app market.
All three laws say roughly the same thing: get meaningful parental consent before collecting children’s data. None of them have fully solved the problem, because enforcement is reactive and many apps simply don’t comply until they’re caught.
Which platforms have the worst track records
TikTok has been fined for children’s data violations in the EU (€345 million, 2023) and faces a US FTC complaint filed in August 2024 alleging COPPA violations. Its default settings have repeatedly made children’s accounts public, recommended their videos to strangers, and used algorithmic nudges to maximize engagement time. Some of those users may be as young as 10.
YouTube collected behavioral data on child viewers at scale for years before the COPPA enforcement action. YouTube Kids exists as a separate app with different data practices, but many children access the main YouTube platform regardless.
Educational apps sold to schools are a frequently overlooked category. Schools often receive free or discounted EdTech tools in exchange for student data. The app’s privacy policy typically allows data sharing with “research partners” or “service providers” — language that can encompass advertising networks. Google Classroom, Clever, and similar platforms handle enormous amounts of child data with comparatively little scrutiny.
Free gaming apps are the most consistent offenders. Any app supported by advertising is, by definition, collecting and sharing behavioral data. The business model requires it. If you’re not paying for the app, the data is the product — and in children’s apps, that data is your child’s.
Practical protections for parents
Start with permissions. On iOS, go to Settings > Privacy & Security and review location, microphone, and contacts access for every app your child uses. On Android, go to Settings > Apps, select the app, and review Permissions. Revoke anything that isn’t necessary for the app’s core function. A game does not need microphone access.
Before installing any new app, search its name plus “privacy policy.” Look for the words “advertising,” “third party,” and “behavioral.” If those words appear without clear limitations, treat it as a red flag.
Screen Time (iOS) and Family Link (Android) let you approve app installations before they happen. Use them. They’re not perfect — they don’t audit what approved apps do with data — but they stop your child from installing an unknown app at midnight.
Put children’s devices on a separate Wi-Fi network, the same as you’d do with smart home devices. This limits the apps’ ability to interact with other devices on your home network.
Prefer apps from reputable educational publishers over free, ad-supported alternatives when possible. Apps from Scholastic, Khan Academy, and similar organizations have more accountability and clearer privacy practices than anonymous app store entries. Paid apps have less incentive to monetize data.
Your rights as a parent
These rights exist under law — you just have to use them.
Under COPPA, you can request that a service disclose exactly what personal data has been collected from your child, and you can demand deletion of that data. Contact the app or service directly via their privacy policy contact information. They are legally required to respond and comply.
Under GDPR (if you’re in the EU), you can exercise your child’s rights on their behalf: access, erasure, restriction of processing, and portability. You don’t need a lawyer. Send a written request — email is sufficient — to the service’s Data Protection Officer. They have 30 days to respond.
Under India’s DPDPA, parents can exercise data rights on behalf of children under 18: access to what data is held, correction, and erasure. The DPDP Rules were notified in November 2025, and the Data Protection Board has been formally established. But its full powers and the main compliance duties phase in through 2027, so the request machinery is still settling. The rights exist in statute now.
Document your requests. If a company ignores a deletion request, that is itself a regulatory violation. You can report it to the FTC (US), your national data protection authority (EU), or the Data Protection Board of India.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.