Youth privacy was a central theme at this year’s ANA Masters of Advertising Law Conference, reflecting one of the most significant developments in privacy and advertising law over the past year: Lawmakers and regulators are increasingly looking beyond the traditional model of protecting children under 13. The Children’s Online Privacy Protection Act (COPPA) remains the federal baseline, and its recently amended rule strengthens requirements around third-party disclosures, data minimization, retention and security. But much of the recent activity has been at the state level, where lawmakers are increasingly extending protections to teenagers and regulating not simply how businesses collect minors’ information but also how products and advertising experiences are designed for younger users.
Age-Appropriate Design Codes
Rather than relying primarily on parental consent, these laws increasingly put the burden on businesses to build youth protections into their products. Maryland, Nebraska, South Carolina, Vermont and California have pursued versions of this approach, with requirements touching high-privacy defaults, data minimization, profiling, risk assessments and potentially harmful design features. Nebraska’s law illustrates how granular the requirements can become, requiring covered services to give known minors tools to control personalized recommendations and to limit engagement features such as infinite scroll and push notifications. In other words, privacy is moving out of the fine print and into the default settings. While the state laws differ on requirements, it is clear that states are increasingly treating privacy as a product design issue rather than solely as a disclosure and consent issue.
App Store Accountability Laws
Alabama, Louisiana, Texas and Utah have enacted versions of app store accountability laws that place age verification and parental consent responsibilities at the app store level while also imposing obligations on app developers, although effective dates and litigation have produced a complicated implementation landscape. These laws are significant because they reflect an emerging idea that an individual app should not necessarily bear the entire burden of determining a user’s age. Instead, age information may increasingly become an infrastructure-level signal that follows the user into individual apps. For developers, sharing the responsibility does not mean uninstalling their own obligations.
Advertising and Influencer Marketing
No advertising conference would be complete without a discussion of influencers, and while the content may be bite-sized, the compliance obligations are not. Illinois, California, Minnesota and Colorado are among the states that have moved toward protections involving earnings, trusts or other safeguards for child influencers through these “kidfluencer” laws. These protections can reach beyond children who run their own accounts to children featured in monetized family content, with covered creators required to track their participation and preserve a share of earnings in trust. For brands and agencies, these developments add another layer to influencer diligence and contracting beyond endorsement disclosures; campaigns involving children may require closer attention to compensation arrangements, trust obligations and the continued use of content.
For advertisers, the result is an increasingly interconnected compliance landscape: Determining whether an audience includes minors can affect not only COPPA compliance but also targeting and profiling, product design, age assurance architecture, parental consent and even the contractual structure of influencer campaigns. If there is one overarching takeaway from this year’s conference, it is that “youth privacy” is rapidly becoming something broader than privacy law itself. It is becoming a framework for how businesses design, monetize and market the digital experiences that young people use. Youth privacy should be a shared priority across legal, privacy, product, and marketing teams. By engaging with legal early and working on a youth privacy plan business teams can create a culture of compliance and build trust with kids and parents.
