What Data Do Kids' Apps Collect? A Plain-English Guide

What actually counts as "data" in a kids' app?

Most parents picture a name and maybe an email address when they hear "the app collects data." The federal law that actually governs this, the Children's Online Privacy Protection Act, defines personal information as eleven specific categories, and several of them have nothing to do with a name at all (16 CFR §312.2, Cornell Legal Information Institute).

The one most parents miss is the persistent identifier. It is legally defined as an identifier that lets a company recognize the same user over time and across different apps or sites (16 CFR §312.2, Cornell Legal Information Institute). It does not need a name attached to be personal information under the law. An advertising ID quietly picked up by a game your child plays can, on its own, count.

What does COPPA require, and what does it not require?

COPPA only binds an "operator," meaning a site or app that itself collects or maintains children's data, and only when that service is commercially targeted to children, or a general-audience app has actual knowledge a child is using it (15 U.S.C. §6501(2) and §6501(10)(A)). It also has a strict age line: a "child" under the statute is an individual under the age of 13, full stop, so a teen-focused app is not covered by COPPA at all (15 U.S.C. §6501(1)).

Where it applies, COPPA requires three things up front. The operator must post notice of exactly what it collects, how it uses that data, and who it discloses it to (15 U.S.C. §6502(b)(1)(A), U.S. Code). It must get verifiable parental consent before collecting, using, or disclosing anything, meaning you say yes first, not find out after (15 U.S.C. §6502(b)(1)(A)(ii), U.S. Code). And it must keep whatever data it holds reasonably secure and confidential (15 U.S.C. §6502(b)(1)(D), U.S. Code).

Here is what it does not require, and this trips people up: there is no fixed deletion deadline in the statute. You will not find a "must delete within 30 days" rule anywhere in COPPA. The law's security duty is written as "reasonable procedures," which is a standard, not a countdown clock. And enforcement runs through the Federal Trade Commission under its general authority, not through a lawsuit you file yourself (15 U.S.C. §6505(a), U.S. Code).

What rights do you have as a parent under COPPA?

Three rights matter most day to day. First, you can see exactly what specific types of personal information an app collected about your child, not a vague summary (15 U.S.C. §6502(b)(1)(B), U.S. Code). Second, you have a standing right at any time to refuse further use or retention of that data, which functions like a deletion request even though the statute does not use that word (15 U.S.C. §6502(b)(1)(B), U.S. Code). Third, nothing should be collected in the first place without your affirmative consent, given before collection starts, not buried in a settings screen you find later.

How many kids' apps really carry trackers they shouldn't?

A single peer-reviewed study gives a real number here, and it is worth naming precisely rather than repeating "studies show" the way a lot of compliance blogs do. Researchers analyzed 20,195 mobile apps from the Google Play Store, either built specifically for children or listing children among their target users (Sun et al., "Not Seen, Not Heard in the Digital World," The Web Conference 2023).

Among the apps Google Play itself classifies as "Family" apps, a category where Google's own rules do not permit trackers, 81.25 percent used them anyway (Sun et al. 2023). Just under 4.5 percent of those Family apps requested location permissions, despite location collection from children being against Play Store policy (Sun et al. 2023). And this was not limited to small, fly-by-night developers: the study found that even developers with 40 or more kids' apps on Play used ad trackers (Sun et al. 2023). A smaller, separate finding from the same paper worth a footnote: 19.25 percent of the apps studied carried inconsistent content age ratings across different rating authorities, meaning the same app was labeled differently depending on where you checked (Sun et al. 2023).

A few caveats matter here. This is one 2023 study of Android apps on Google Play specifically, not a universal audit of every kids' app on every platform. And the paper's own framing is that these trackers were "not allowed" under Play Store category rules, which is a platform policy finding, not a legal ruling that every one of those apps broke COPPA. A tracker being present does not automatically mean a law was broken; it means the app is worth a closer look. If you want to see what the alternative looks like in practice, we wrote up how we keep trackers out of a kids' app as a worked example of what a from-scratch, no-tracker build actually involves.

How do you read a kids' app privacy policy in five minutes?

You do not need a law degree. Open the policy and the app's store listing side by side and run this checklist:

If a policy makes you search more than five minutes to answer these, or if it uses only vague language like "we may share data with our partners" without naming who those partners are, treat that as a strike against the app on its own.

What are the specific red flags to look for?

Four things are worth flagging every time you see them. Third-party SDKs you do not recognize by name, especially ad networks or analytics companies bundled into an app that has no obvious need for them. Ad identifiers, meaning any advertising ID or device identifier used to track behavior across apps rather than just to run the app itself. Location requests with no clear gameplay reason, since a coloring app or a math game has no legitimate need to know where your child is standing. And persistent identifiers generally, since they are the mechanism that turns "this app" into "this company can now recognize my kid across other apps too."

None of these four are automatically illegal on their own. What they tell you is that the operator built infrastructure for tracking into an app aimed at children, and that is worth understanding before you decide the app stays on the device.

What should you do if you find something you don't like?

Start with the app itself. Check whether it has in-app parental controls that let you review or delete a child's data directly, many do. If it does not, or the policy is vague about how to reach anyone, email the developer directly. Ask what specific data they collected about your child, and tell them plainly that you want them to stop further use and retention of it. That request tracks your actual legal right under COPPA, and a legitimate operator should be able to respond to it.

If you get no real answer, or the response confirms something you are not comfortable with, uninstall the app and move on. You can also raise a concern with the Federal Trade Commission, the agency that enforces COPPA. We won't spell out an exact filing process here, since that is worth checking directly on the FTC's own site when you're ready.

We built fruutium with these same categories in mind before a single line of tracking code went in, not after a complaint. If you are comparing options, our guides to ad-free learning apps for kids and how much screen time is too much for kids are both good next reads, and the full pillar overview lives at building healthy habits as a family. You can see fruutium's own approach at fruutium.web.app.