Skip to content

What Happens if Kids Under 13 Use My App? (COPPA Explained)

6 min read

Are you breaking the law if a child under 13 signs up for your app? In the US, you are at risk the moment you knowingly collect personal data from an under-13, unless you have verifiable parental consent. The practical answer for most beta founders is simpler: do not knowingly let under-13s in, and make that explicit, so COPPA's heavy consent machinery never applies to you.

Why this matters for a vibe-coded app

COPPA (the Children's Online Privacy Protection Act) is a US federal law enforced by the FTC. It applies if your service is directed at children under 13, or if you have actual knowledge that you are collecting personal data from them. "Personal data" is broad: names, email addresses, and even a device identifier or persistent cookie count. If COPPA applies, you owe verifiable parental consent before collection, a children's privacy notice, data minimisation, and deletion on request. That is a serious compliance programme, not a beta-weekend task.

Here is the vibe-coded trap. You asked your agent to "let users sign up," and it built a clean signup form. It did not add an age gate, because you did not ask for one, and nothing in the demo suggested you needed it. So your app silently accepts a nine-year-old and starts collecting their email. The law does not care that you never intended a child to sign up; it cares what you knowingly collect once one does.

How to check

  1. Read your own signup honestly. Is there anything that asks for or confirms age? For most vibe-coded MVPs, no. That means you have no way to know a child signed up, which is not the safe position you might think.
  2. Ask who your app is for. If the subject matter, art style, characters, or marketing would appeal to children, the FTC may treat it as "directed to children" regardless of your intent.
  3. Look at what you collect at signup. Email, name, photos, location, or a third-party login (Google/Apple) all count as personal information under COPPA.
  4. Check your analytics and ad SDKs. Tools that set persistent identifiers (analytics, ads, session replay) also collect "personal information" from whoever uses the app, children included.

The fix

For the vast majority of beta founders, the goal is to stay out of COPPA's scope cleanly, not to build a parental-consent system.

  1. Add a neutral age gate at signup. Ask date of birth in a way that does not hint at the "right" answer (a real date field, not "Are you 13+? yes/no"). Store the result.
  2. Block under-13s. If the entered age is under 13, stop the signup and do not store their personal data. Show a plain message that the app is not for under-13s. Do not silently keep the record.
  3. State it in writing. Add "This service is not directed to and may not be used by children under 13" to your Terms and your privacy policy.
  4. Have a deletion path. If you learn a child got through anyway, delete their data promptly. Know where that data lives (your database, your email tool, your analytics) so you can actually remove it.
  5. If your app is genuinely for kids, stop and get advice. COPPA compliance with verifiable parental consent is real work and often needs a lawyer. Do not improvise it.

The trap to avoid

Do not rely on a checkbox that says "I am 13 or older" with no date field. It is weak, and worse, some founders "solve" this by quietly recording the under-13's data anyway "just in case." That is the exact thing COPPA punishes: knowingly collecting from a child without consent. Collecting less is safer than collecting and hoping. Also, do not assume COPPA is a US-only afterthought; the UK and EU have their own children's data rules, so if you take EU users, check whether GDPR applies to your app too.

Where this fits

An unguarded signup that any child can complete is the kind of gap that never shows up in a demo and is obvious the moment a regulator or a worried parent looks. The free Readiness Report checks what your app actually collects at signup and whether you have an age gate and children's-data language in place. If you would rather have the age gate, the wording, and the deletion path handed to you in order, that is what the Finishing Pass is for.