Children & Age Policy
Minimum age, age assurance, parental consent, child-data prohibitions, advertising/tracking limits, rights and deletion for minors across all jurisdictions. Blocking decision: owner must set the minimum age and child-directed status before launch.
Draft for legal review
This document is an implementation draft written to match how the product actually behaves. It has not been reviewed by a qualified lawyer and must not be relied on as legal advice. Items marked or are unresolved.
1. Status — OWNER INPUT REQUIRED (blocking)
Minimum age: [PLACEHOLDER — decide, e.g. 18, or 16/13 with parental-consent path — OWNER INPUT REQUIRED]. Current website has no age gate. Product copy targets 'Families & Households' and 'keeping your kids safe' (TEAMS), and Her Safety Hub involves minors' location as data subjects — so child-directed/likely-to-be-accessed-by-children analysis is mandatory before launch. Do not write 'not for children' without verifying behaviour, signals, marketing and collection.
2. Draft position until decided (not final)
Website not directed to children; no knowing collection; if a child provides data without required consent we delete it on discovery. Mobile: family safety features require a guardian account; a minor's location is processed only within a guardian-initiated session with the minor's (and where required parental) consent. Behavioural tracking/behavioural advertising directed at children is prohibited (India DPDP s.9 model applied globally as defensive default).
3. Parental-consent and age-assurance matrix (when child-directed)
- US COPPA (under 13, child-directed or actual knowledge): verifiable parental consent (email-plus, ID, payment, video, government check per FTC methods), data minimisation, no behavioural advertising, parental access/deletion. FTC Rule review pending — confirm.
- EU GDPR Art.8 (under 16, member states 13-16): holder of parental responsibility consent where consent is the basis; age-verification proportionate.
- UK Children's Code: likely-to-be-accessed assessment + default high-privacy + DPIA.
- India DPDP s.9: verifiable parental consent + no detrimental tracking/advertising; exempt classes (confirm whether we qualify) + essential-services (healthcare/education/safety) nuance per Rules.
- Brazil LGPD Art.14: specific parental consent; best-interests. China PIPL: under-14 sensitive + guardian consent + heightened duties. South Korea: under-14 representative consent. Thailand: under-10 parental, 10-<20 joint (confirm). Indonesia Art.25: guardian consent. South Africa s.35: guardian consent. Israel/Mexico/Argentina/NZ/MY/PH: guardian/best-interests expectations (confirm).
4. Controls to build if child-directed
Age gate proportionate to risk (neutral, no dark pattern); guardian-consent flow with minimum data + deletion after verification; separate child privacy notice; no behavioural ads/tracking; default private safety sessions; guardian dashboard for access/correction/deletion; shorter retention; enhanced breach playbook; DPIA + LEGAL REVIEW REQUIRED before launch.
5. Version
Version 0.9.0-draft, last updated 2026-10-02, OWNER INPUT REQUIRED + LEGAL REVIEW REQUIRED.
Sources
This document is derived from the following entries in our legal source registry: US-COPPA, EU-GDPR, IN-DPDP, BR-LGPD, CN-PIPL, KR-PIPA, TH-PDPA, ID-PDP, ZA-POPIA, UK-GDPR. See for the full citations and the date each source was last verified.