How to write a privacy policy for a kids app

Check every SDK and advertising service before describing the app as suitable for children. Review the configuration that ships in your build, including identifiers, location, diagnostics, and defaults that may transmit data on first launch. If you cannot explain a provider’s collection and retention, resolve that uncertainty before relying on the policy wording. Use this checklist:

• Every SDK in the build is listed, with what it collects from child users.
• No SDK transmits advertising IDs or other device identifiers that the Families policy or Kids Category forbid.
• Ads, if any, are contextual and served only by permitted SDKs, with personalization disabled for children.
• Analytics are disabled for children or limited to tools that meet the platform exceptions.
• Crash reporting does not send identifiers you are not allowed to collect.
• Location is off, or limited to what the rules allow.
• Chat and sharing features have parental controls and safety reminders.
• Retention periods are written down and enforced in code.
• Third parties that receive children's data are named in the policy, with purposes.

Our advertising privacy disclosures guide explains how to describe ad networks, and the game privacy policy guide covers chat, multiplayer, and in-app purchases that many kids apps share with games.

Everything starts with this question, and it is not answered only by what you intended. Under the COPPA Rule, the FTC decides whether a service is directed to children under 13 by looking at its subject matter, visual content, use of animated characters or child-oriented activities and incentives, music, the age of models, child celebrities, language, and advertising, along with evidence about the actual and intended audience, such as marketing plans and user reviews.

The rule also recognizes mixed audience services: a general audience app that includes children is not treated as directed to children for users not identified as under 13, which is why many apps use a neutral age screen. Separately, if you have actual knowledge that you collect personal information from a child, COPPA applies to that child's data.

The stores ask the same question. Google Play requires you to declare your target audience in Play Console and may review whether your imagery and terminology suggest children. Apple reserves terms like “For Kids” and “For Children” in app metadata for the Kids Category.

Be honest with yourself here. A bright cartoon game with a teen rating can still look child-directed to a regulator. The COPPA privacy policy guide summarizes the scope rules.

COPPA calls the privacy policy the online notice, and the rule lists what it must state. Under 16 CFR 312.4(d), a complete notice includes:

• the name, address, telephone number, and email address of all operators collecting or maintaining children's personal information, or one designated contact plus the names of all operators
• what information you collect from children, including whether children can make personal information publicly available
• how you use it, and your disclosure practices, including the identities and specific categories of third parties that receive it and the purposes
• your data retention policy
• where applicable, the internal operations for which you collect persistent identifiers and how you prevent them being used for other purposes
• where you collect audio files containing a child's voice under the rule's exception, how you use them and that you delete them immediately after responding to the request
• that parents can review or have deleted their child's information and refuse further collection, and how to do so

The rule also requires a prominent, clearly labeled link to this notice on the home or landing screen and at each area where you collect children's information, plus a separate direct notice to parents before you collect. A general privacy policy that never mentions children does not meet this standard.

The FTC published its amended COPPA Rule in the Federal Register on April 22, 2025. It took effect on June 23, 2025, and regulated businesses had until April 22, 2026 to comply with most provisions. If your app was written before that, review it now.

Changes that affect your policy and your app:

• Separate consent for third-party disclosures. Parents must be able to consent to collection and use without consenting to disclosure to third parties, unless the disclosure is integral to the service. Disclosures for purposes such as targeted advertising need separate verifiable parental consent.
• Written data retention policy. You must keep children's data only as long as reasonably necessary, never indefinitely, and include your written retention policy in the online notice.
• Written security program. Operators must establish and maintain a written information security program scaled to their size and the sensitivity of the data.
• Broader personal information. The definition now includes biometric identifiers and government-issued identifiers.
• Named third parties. The online notice must give the identities and specific categories of third parties receiving children's data.

Each of these needs operational work, not just new sentences. Your policy should describe what you actually built.

If children are any part of your target audience on Google Play, the Families policies apply on top of the general User Data policy. Key points from Google's policy:

• You must accurately complete the Target Audience and Content section, the Data safety section, and the content rating questionnaire, and keep them current.
• Apps that solely target children must not transmit the Android advertising ID, SIM serial, build serial, BSSID, MAC, SSID, IMEI, or IMSI; mixed-audience apps must not transmit them from children or users of unknown age.
• Apps that solely target children may not request location permission or collect, use, and transmit precise location.
• Ads shown to children must come only from Families Self-Certified Ads SDKs, and mixed-audience apps need age screening, such as a neutral age screen.
• Apps and features that let children share freeform content need an in-app online safety reminder and adult controls.
• Your app, including the APIs and SDKs it uses, must comply with COPPA, the GDPR, and other applicable laws, and your privacy policy must accurately reflect your data practices.

Your privacy policy should match these settings: say which SDKs run for child users, that ads are not personalized, and how location is handled. The Google Play privacy policy generator page covers the general Play Console requirements.

Apple's App Review Guidelines treat children's apps strictly. Guideline 1.3 says Kids Category apps may not send personally identifiable information or device information to third parties, and should not include third-party analytics or third-party advertising. Limited exceptions exist: analytics that do not collect or transmit the IDFA or identifiable information about children, their location, or their devices, and contextual advertising from services with publicly documented Kids Category practices that include human review of ad creatives.

Kids Category apps must also keep links out of the app, purchasing opportunities, and other distractions behind a parental gate. Apple notes that once users expect your app to follow these rules, it must keep meeting them in later updates even if you deselect the category.

Guideline 5.1.4 adds that apps in the Kids Category, or apps that collect personal information from a minor, must include a privacy policy and comply with children's privacy laws. Apps may ask for a birthdate and parental contact information only to comply with those laws. Apple also states that a parental gate is generally not the same as parental consent under privacy statutes.

The Apple App Store privacy policy generator page explains how your policy lines up with App Privacy labels.

If children in Europe or the UK use your app, two more frameworks apply.

GDPR Article 8. When you offer an information society service directly to a child and rely on consent, processing is lawful only if the child is at least 16, or if a parent gives or authorizes consent. Member states may lower the age, but not below 13, so the threshold varies across the EU. You must make reasonable efforts to verify parental consent, taking available technology into account. In the UK, the age for this rule is 13.

The UK Age appropriate design code. The ICO's Children's code is a statutory code of practice with 15 standards for apps, games, connected toys, and websites likely to be accessed by children under 18 in the UK. Among them: the best interests of the child, data protection impact assessments, transparency suited to the child's age, high privacy settings by default, data minimization, limited data sharing, geolocation switched off by default, age-appropriate handling of parental controls, profiling off by default, and no nudge techniques.

For your privacy policy, transparency is the standard that bites: information should be concise, prominent, and in clear language suited to the age of the child. The UK GDPR privacy policy guide and GDPR privacy policy guide cover the general requirements.

A kids app has two audiences, and one document rarely serves both. A practical structure uses layers:

1. The full privacy policy, written for parents and regulators, covering every COPPA and GDPR element: operators, data, purposes, third parties, retention, security, and parental rights.
2. A short, child-friendly summary at the top or on a separate screen, using simple words and short sentences.
3. Just-in-time explanations in the app at the moment something happens, such as before a microphone or camera permission request.

A child-friendly sentence might read: “We save your drawings on your tablet. We do not send them to anyone unless a grown-up says it is OK.” That only works if it is true, so write it after you have checked your data flows.

For parents, be specific about the controls they have: how to review data, how to delete it, how to withdraw consent, and how to contact you. Avoid legal language that hides the important facts in long paragraphs. If your app also has adult users or a teen version, consider separate policies so each audience reads only what applies to them.

Children's data is where generic templates are most likely to fail, and where mistakes are most costly. The FTC enforces COPPA with civil penalties, platform violations can remove your app, and European regulators treat children's data as deserving special protection.

A privacy policy is also only one part of the work. COPPA requires a direct notice to parents, verifiable parental consent before collection, separate consent for most third-party disclosures, a written retention policy, and a written security program. The policy describes those processes; it does not create them.

Legal Policy Generator includes a COPPA module among its advanced regional modules, which cost $5, alongside GDPR, UK, and other regional modules. In the app privacy policy generator, you answer questions about children and the regions you serve, and the clauses are selected deterministically from a versioned library, with the free preview showing the result before you pay. That gives you a structured, readable draft to bring to a lawyer, which can make review faster.

But treat the output as a draft. Generated text reflects your answers and is not legal advice. For any app directed to children, ask a qualified lawyer to review the policy, the consent flow, and your SDK setup before launch.