Children's privacy rules are nudging games toward checking every player's age
Laws protecting children's data limit what games offer young players. Applying them means knowing who is a child, and the surest checks are a face scan or an ID. So rules meant to collect less data are nudging platforms toward collecting more, from everyone.
Where it stands
The US rewrote its children's privacy rule in 2025, with compliance due by April 2026. It does not require age checks, but in February 2026 the Federal Trade Commission said it would not punish data collected only to check age. Roblox now asks anyone who wants to chat for a face scan or an ID, a step it took under the safety pressure covered on the child-safety page, not because a privacy law required it. The UK still accepts a stated age where risk is low, and the EU's guidelines are voluntary. Privacy groups object, and the first leaks have already happened.
| Market | Proof of age | What the rule asks for | Source |
|---|---|---|---|
| USA | Encouraged, not required | The federal children's privacy rule, amended in 2025 with compliance due by 22 April 2026, does not require age checks. In February 2026 the Federal Trade Commission said it will not pursue companies that collect personal data solely to check a user's age, if they meet its conditions. | |
| USA | California: age signals required in apps | A package of state laws signed on 10 September 2026 restricts features such as autoplay and algorithmic feeds for under-16s, and requires software applications to carry a signal of the user's age. | |
| UK | As certain as the risk demands | The Children's Code applies to any online service a child is likely to use, games included. A service must establish age with a level of certainty that fits the risks, or apply the code's protections to every user. Asking users to state their age is still accepted where the risk is low. | Information Commissioner's Office, Children's Code, standard 3 2021 |
| India | A parent's verified consent, from 2027 | The 2023 data protection law requires a parent's verifiable consent before any personal data of an under-18 is processed, and bars tracking, behavioral monitoring and targeted advertising aimed at children. The rules of 13 November 2025 say how the parent is checked, from identity and age details held or supplied, or a government-backed token, and take effect 18 months after publication. | Digital Personal Data Protection Rules, 2025 (India), rule 10 (13 November 2025) |
| EU | Voluntary guidelines, and a proposal for stricter limits | The Commission's 2025 guidelines under the Digital Services Act call for age verification where there is a hard minimum age and age estimation elsewhere, by methods that are accurate and do not intrude. The guidelines are voluntary. On 17 September 2026 the Commission adopted a draft KIDS Act, a regulation that would require certified age verification independent of the platform, a free option in every member state, and zero knowledge proof technology. It is a proposal and has to pass the Parliament and the member states. | European Commission, The KIDS Act explained (17 September 2026) |
| Brazil | Required, and self-declaration does not count | Since 17 March 2026, app stores and operating systems must check users' ages and pass an age signal to apps. A service selling anything barred to under-18s, loot boxes included, may no longer accept a user's own statement of age. The data protection authority enforces the law. | Law 15211 (Brazil), via the Justice Ministry's ECA Digital FAQ 2026 |
Timeline
2022
Epic Games pays the largest children's privacy penalty on a game
The maker of Fortnite agrees to pay $275 million for collecting children's data without their parents' consent, and must switch voice and text chat off by default for children and teenagers. The Federal Trade Commission calls it the largest penalty it has obtained for breaking one of its rules.
2023
Microsoft pays $20 million over Xbox sign-ups
Microsoft settles charges that it collected personal information from children who signed up for Xbox without telling their parents or getting their consent. The order says avatars made from a child's image, and biometric and health data, are covered by the children's privacy rule.
2025
The US children's privacy rule is rewritten for the first time since 2013
The Federal Trade Commission finalizes changes to the rule under the Children's Online Privacy Protection Act, the law known as COPPA that requires a parent's consent before a service collects data from a child under 13. Face scans, fingerprints and government IDs now count as personal information, and targeted advertising needs a separate consent. Companies have until 22 April 2026 to comply.
The maker of Genshin Impact pays $20 million
HoYoverse settles charges that it collected children's data and misled players about the cost and odds of loot boxes, the paid random prizes in its game. It must delete data on under-13s and may not sell loot boxes to under-16s without a parent's consent.
The European Commission publishes guidelines and an age-check app
The Commission issues guidelines on protecting minors under the Digital Services Act and a blueprint for its own age-verification app, meant to let someone prove they are old enough without revealing who they are.
The UK starts enforcing age checks under its Online Safety Act
From 25 July 2025, services that show harmful content to UK users must check ages by a selfie, an identity document or similar means.
Identity documents sent in for age appeals leak from Discord's contractor
Discord says photos of government IDs belonging to about 70,000 users were exposed when a company that handles its customer support was breached. The IDs had been submitted by users appealing a decision about their age.
2026
Roblox requires an age check from every user who wants to chat
Roblox makes age checks mandatory worldwide for access to chat, by a face scan that estimates age or by an identity document, and sorts users into six age groups. Roblox says its contractor deletes the images after processing.
The US regulator says it will not punish data collected only to check age
Checking a child's age means collecting data about the child, which the privacy rule restricts. The Federal Trade Commission says it will not enforce the rule against companies that collect data solely to verify age, under conditions, and promises to review the rule.
TikTok pays $400 million over children's data
TikTok and its owner ByteDance settle with the US Department of Justice for $400 million: $300 million now, and $100 million when a court cancels an earlier 2019 order. The department calls it one of the largest recoveries in a children's privacy case. TikTok is not a game. The last penalty against a game company was in January 2025.
California restricts feeds for under-16s and requires age signals in apps
Governor Gavin Newsom signs thirteen bills on children's online safety. One restricts features such as autoplay and algorithmic feeds for under-16s. Another requires software applications to carry a signal of the user's age.
The European Commission proposes age checks that are meant not to identify anyone
The Commission adopts a draft KIDS Act on 17 September 2026. Age is to be verified through certified solutions independent of the platforms, including a free EU age verification app and, in time, the European Digital Identity Wallet. The Commission states that platforms do not check identity documents and do not learn who the user is, and that the law requires zero knowledge proof technology that cannot identify, locate, track or profile anyone. Every member state must offer at least one free way to prove age, including for people without digital identification.
European Commission, The KIDS Act explained (17 September 2026)
Discord runs age checks for every user without taking a face or an ID
Discord re-launches age verification for all users on 22 September 2026, seven months after postponing it over privacy objections. Users can verify by credit card, the Apple App Store, Google Play, Google Wallet or AgeKey, with no video selfie and no identity document. Chief technology officer Stanislav Vishnevskiy says the non-biometric approach is meant to get ahead of laws that might require something less privacy-focused. Discord says it will name every age assurance vendor it uses and has published its first age assurance data.
Consequences
012025
A game cannot escape the rule by saying it is not for children
Stacy Feuer, who runs the privacy program at the US games ratings board, reads the Genshin Impact case as a warning to every studio. Regulators look at a game's art style and promotions, not at what its terms say, so a game that appeals to children is covered whether it wants to be or not.
022025
The regulator now writes age checks into its settlements
In its settlement with Disney, the Federal Trade Commission relieved Disney of reviewing its own videos if YouTube adopts age assurance, meaning any method of establishing a user's age, for all users. Together with its 2026 statement, the agency is steering companies toward checking age rather than ordering them to.
032026
Protecting children means collecting more data from everyone
The Electronic Frontier Foundation argues that settlements and laws requiring age checks force services to collect more personal data from every user, adults included, and that every new store of faces and IDs is another thing that can be breached.
Electronic Frontier Foundation, David Greene (26 August 2026)
042026
A leaked face cannot be changed
Alexis Ingber of Syracuse University tells TechCrunch that protections for teenagers are only as good as the age checks behind them, and that those checks often fail. Unlike a password, she notes, a leaked face or fingerprint cannot be replaced.
Objections
Counterpoint2021
The rules do not all demand proof of age
The UK's code still lists asking users their age as acceptable where the risk is low, and lets a service skip age checks altogether by giving every user the children's protections. The European Commission's guidelines are voluntary. The US rule does not require age checks at all. The direction is the same everywhere. The letter of the rules is not.
Information Commissioner's Office, Children's Code, standard 3
Counterpoint2026
The penalties on games have shrunk, not grown
The Federal Trade Commission's children's privacy penalties against game companies run $275 million in 2022, $20 million in 2023 and $20 million in 2025, with none listed in 2026. The Genshin Impact figure also covered loot boxes. The large 2026 case is a social video app. Nobody publishes a yearly total, or how many children's faces and IDs game platforms have collected.
Counterpoint2026
Age can be checked without keeping the data
Philip Yannella, a privacy lawyer at Blank Rome, tells TechCrunch that age can be established without storing personal data, which would greatly lessen the privacy problem. The European Commission's planned digital identity wallet is built on that idea.
Counterpoint2026
The EU's answer is that the check need not collect anything
This page's argument is that age assurance means collecting more data from everyone. The KIDS Act is designed against exactly that: verification is handled by certified services independent of the platform, which return only whether the user is above or below an age. If zero knowledge proofs work as described, the trade this page describes is not a necessary one. In September 2026 Discord began checking every user's age by credit card or app store account, with no ID and no face, which is the first deployment at this scale and by the company whose contractor leak is the evidence above. Whether the estimate is accurate, and whether the vendors hold what they say they hold, is not yet measurable from outside.
European Commission, The KIDS Act explained (17 September 2026)
What to watch
2026
The EU's digital identity wallets
The end of 2026, when the EU's digital identity wallets are due. They are the Commission's preferred way to prove age without revealing identity. The test is whether games platforms adopt them in place of face scans.
2027
The UK's limits for under-16s
Spring 2027, when the UK's planned restrictions for under-16s are expected. Gaming apps would not be banned, but would have to remove features such as chat with strangers for younger users.
Further reading
- ReportingRoblox to face external audits to prove it is safe for Australian childrenabc.net.au
- AnalysisUnderstanding the updated COPPA rules and their impact on child safetygamesbeat.com
- ReportingCalifornia enacts new social media curbs for children under 16pocketgamer.biz
Where to follow it FTC press releases and enforcement actions, IAPP coverage, ICO (UK), law-firm COPPA trackers
- Old games take most of players' time
- Older players are a large audience the industry overlooks
- Campaigners are pressing to keep sold games playable
- Players are using review scores as a protest vote
- Regulators are age-gating loot boxes
- Governments are weighing legal caps on children's playtime
- Problem-gaming research is shifting from hours to compulsion
- China is using game approvals as a policy dial