Kids’ data privacy: what the rules ask, and what we do
Children's privacy rules got stricter in 2025. Here's what they ask of apps, in plain English, and how OurDot keeps children's data to a minimum.
The US COPPA rule was updated in 2025: the changes took effect June 23, 2025, with compliance required by April 22, 2026. It requires separate parental consent before sharing a child's data with third parties, bans keeping children's data indefinitely, requires a written security program, and treats biometrics like voiceprints as personal information. The UK Children's Code asks for data minimization, high-privacy defaults and honesty with kids about monitoring.
What the research found
- COPPA amendments (FTC, 2025): separate verifiable parental consent for disclosures to third parties (unless integral to the service); data kept only as long as reasonably necessary; a written information security program; biometric identifiers like voiceprints and faceprints count as personal information; notices must explain how children's audio is used and that it's deleted promptly.
- UK Age Appropriate Design Code (the "Children's Code"): 15 standards, including high-privacy defaults, collecting only the minimum data needed, location off by default, profiling off by default, no nudges toward weaker privacy, and telling children when a parent can see their activity.
- UK Data (Use and Access) Act 2025 adds a duty to consider children's higher protection needs; the UK regulator updated its children's guidance in May 2026.
Where experts disagree
Privacy advocates say rules like COPPA still leave teens 13 to 17 with fewer protections, and a broader "COPPA 2.0" had not passed as of our sources. Some industry groups argue the new consent rules add friction for families.
How this shaped OurDot
- We collect what a family app needs to work, and we don't ask for a child's own email or birthday, only an age range a guardian picks.
- No ads, no outside tracking tools, no profiling, and we never sell data.
- Photo location data is removed before upload. OurDot doesn't track location.
- Voice is transcribed on the phone when it supports it, and we never build voiceprints.
- Draw & Guess drawings are deleted after 30 days; deleting an account deletes its content. Read the privacy policy.
- Kids are told in the app what guardians can see, and the journal stays private to the writer.
What we don't claim
- That OurDot is "COPPA-certified." No such government certification exists.
- Legal compliance claims beyond what our attorney has reviewed.