COPPA Compliant Games for Kids: What "No Data Collected" Really Means

If you have shopped for a kids game recently you have seen the phrase everywhere. It sounds like certification. It is closer to a promise, a real one, with real consequences for breaking it, but a promise all the same. Knowing what it covers is what turns it from marketing into something you can use.

What COPPA actually requires

The Children's Online Privacy Protection Act is a US federal law, enforced by the Federal Trade Commission, that applies to online services directed at children under 13, or that knowingly collect personal information from them. Boiled down, an operator must:

• Get verifiable parental consent before collecting personal information from a child under 13.
• Publish a clear privacy policy saying what is collected, how it is used, and who it goes to.
• Not require more data than the activity needs. A colouring game cannot demand a phone number to unlock crayons.
• Let parents review and delete what has been collected about their child, and refuse further collection.
• Keep it only as long as necessary, under a stated retention policy, and secure it properly.

"Personal information" is broader than most people expect. It is not only a name and email. It includes persistent identifiers such as an advertising ID or device ID, photos, audio and video of a child, geolocation, and, under the amended rule, biometric identifiers. That breadth is the whole point: an advertising ID follows a child around just as effectively as a name would. The FTC's COPPA compliance FAQ is the primary source if you want the exact text.

The three things "COPPA compliant" does not mean

It does not mean "collects nothing"

This is the big one. A compliant app can gather plenty of data, provided it got proper consent and handles it by the rules. Compliance is about permission and process, not abstinence. If what you want is an app that gathers nothing at all, "COPPA compliant" is not the phrase that tells you so.

It does not mean anyone checked

There is no pre-approval body. A developer writes the claim; the FTC can act afterwards if it is false, and the penalties are substantial. Programs like Google Play's Teacher Approved and Designed for Families add a layer of review, and independent safe-harbor programs certify some apps, but no one is inspecting every app's network traffic. Which is fine, it just means the claim is a starting point.

It does not mean "safe" in the everyday sense

COPPA is a privacy law. It has nothing to say about whether a game is full of ads for other games, pushes in-app purchases at a 4 year old, has a chat feature, or is simply overstimulating rubbish. An app can be fully compliant and still be one you would not want on the tablet. For that side of it, see the red flags that mean a kids app is not safe.

How to read a Google Play Data safety card

This section is more useful than the compliance claim, because it is specific. On any listing, scroll to Data safety and tap to expand. Four things are worth your attention.

"Data shared", read this first

Shared means the data goes to a third party: an ad network, an analytics provider, a partner. This is the line that matters most for a young child, because it is how information about them ends up with a company you have never heard of and have no relationship with. For a children's app, the number you want here is zero.

"Data collected", read this second

Collected means it leaves the device for the developer's own servers. Some collection is defensible, crash logs help fix bugs, cloud saves need an account. For a young child's game, none of that is necessary, and "No data collected" is both achievable and common among small paid apps.

Security practices

"Data is encrypted in transit" and "You can request that data be deleted" are the two lines to look for if the app does collect something. Their absence, on an app that collects, is a bad sign.

What is not on the card

Data safety does not tell you about ads. That is a separate label, a "Contains ads" tag under the app title. An app can honestly report no data collection and still show advertising, and we cover how to check that properly in no-ads kids games: what to check before you download.

The five-minute verification

You do not have to take anyone's word for it. This sequence takes about five minutes and settles most questions.

1. Data safety, expanded. Note what is collected and what is shared. Screenshot it if you are comparing apps.
2. The "Contains ads" tag. Present or absent, right under the app title.
3. In-app products. Also on the listing. "In-app purchases" with a price range tells you the business model at a glance, the subject of kids apps without subscriptions.
4. Permissions. Under About this app → App permissions → See more. Ask why a puzzle game would want the microphone, contacts, or precise location. There is rarely a good answer.
5. The privacy policy. Open the link, then search the page for advertis, third part, analytic, and retention. A policy that never mentions children, or that reads like a generic template for a website, is telling you something.
6. The airplane-mode test. The strongest one, and the only one that does not rely on anybody's word. Install, enable airplane mode, and let your child play. If everything works with no connection, nothing is going anywhere while they play, no ads served, no events logged, no identifiers sent. See offline kids games: download once, play anywhere.

What changed in the 2026 rule

The amended COPPA rule sharpened several points that matter for the apps in this age range:

• Separate consent for advertising and AI. Disclosing a child's information to third parties for targeted advertising, or using it for purposes such as training AI models, now needs its own opt-in rather than being folded into a general agreement.
• Written retention limits. Operators must have and publish a retention policy, and may not keep children's data indefinitely "just in case".
• A wider definition of personal information, explicitly covering biometric identifiers.

The direction of travel is clear: apps must say more, more plainly. That helps a parent who reads the label. It does not replace reading it. We look at the related age-verification changes in app store age verification in 2026, and at what all this means for AI features specifically in are AI apps safe for kids?

Why free games are the harder case

There is no rule that free means invasive, and there are excellent free apps, public broadcasters and non-profits run several. But a free app with no visible business model has to be paid for somehow, and the usual answer is advertising. Ads need targeting and counting, targeting and counting need an identifier, and an identifier tied to a child is exactly what COPPA restricts. That is why free kids games appear so often in enforcement actions, and why "free" deserves one extra look rather than one less. We work through the arithmetic in free vs paid kids games.

The cleanest structure for a young child's app is unglamorous: someone pays a small amount once, the app has no reason to collect anything, and there is no third party in the room. That is not a privacy policy, it is a business model that makes the privacy policy short.

Frequently asked questions

What does COPPA compliant mean?

COPPA is the US Children's Online Privacy Protection Act, and it applies to online services aimed at children under 13 or that knowingly collect data from them. Saying an app is COPPA compliant means the developer states it follows those rules: no collecting a child's personal information without verifiable parental consent, a clear privacy policy, no requiring more data than the activity needs, letting parents review and delete what was collected, and not keeping it longer than necessary. It is a self-declaration enforced by the FTC after the fact, not a badge issued in advance, so it is worth verifying rather than taking on trust.

Does COPPA compliant mean an app collects no data?

No, and this is the most common misunderstanding. A COPPA compliant app can collect a great deal of data, as long as it obtained verifiable parental consent and follows the rules on use, retention and deletion. Compliance is about permission and process, not abstinence. If you specifically want an app that collects nothing, look for that stated on the Data safety card as "No data collected", which is a stronger and much easier claim to check.

What is the difference between data collected and data shared?

Collected means the data leaves your child's device and goes to the developer's servers. Shared means it is passed on to a third party, such as an advertising network or analytics provider. Shared is the one that matters most for a young child, because it is how a profile ends up somewhere you have no relationship with. An app can collect a little and share nothing, which is reasonable, or collect a little and share it widely, which is not.

How do I check if a kids game collects data?

On the Google Play listing, scroll to the Data safety section and expand it. It lists what is collected, what is shared, whether data is encrypted in transit, and whether you can request deletion. Then check the app's permissions under About this app, read the privacy policy linked from the listing, and after installing put the device in airplane mode and play. If the game works fully offline, there is no channel for data to leave while your child plays.

Is the Google Play Data safety section verified?

It is a developer declaration, not an independent audit. Google requires it to be accurate and can remove apps for false statements, and apps in the Teacher Approved and Designed for Families programs face extra review, but nobody inspects every app's network traffic. Treat the card as a claim the developer is accountable for, and give more weight to a claim you can also verify yourself, such as an app that keeps working with the internet turned off.

What changed in the COPPA rule for 2026?

The amended rule tightened several things: separate parental consent is required before a child's personal information is disclosed to third parties for targeted advertising or used for purposes such as AI model training, operators must set and publish a data retention policy rather than keeping children's data indefinitely, and the definition of personal information was widened to include identifiers such as biometric data. For parents the practical effect is that listings and privacy policies must be more explicit, which makes these checks easier rather than less necessary.

Are free kids games COPPA compliant?

Some are and some are not, but free games face a structural pressure paid ones do not: if the app shows ads, something has to identify the device to target and count them. That is exactly the kind of collection and sharing COPPA restricts for children, and it is why free kids games are over-represented in enforcement actions. A free game can be perfectly clean, and plenty are, but check the Data safety card rather than assuming.

The bottom line

Treat "COPPA compliant" as the start of the conversation. The sentence that actually settles it is on the Data safety card, no data collected, no data shared, and the test that confirms it costs you one flick of airplane mode. For a child of 2 to 8, an app that never needs a connection is the simplest privacy policy there is.

An app with a very short privacy policy

Sticker Builder was built to make this check boring. Children ages 2 to 8 drag stickers onto the right spot to complete a scene. There are no ads, no third-party SDKs, no analytics, no accounts and no chat, so there is nothing to collect and nobody to share it with. It works fully offline after download, it is COPPA compliant, and it is a one-time $1 on Google Play with no subscription and no in-app purchases. Turn on airplane mode and check for yourself, that is rather the point.