Rules, Laws, and/or Regulations Surrounding App/Website Marketing to Children in the U.S., U.K., E.U., Australia

Research analysis of rules, laws, and/or regulations surrounding app and website marketing to children in the United States, the United Kingdom, the European Union, and Australia, has been provided below. Overall, overtly granular guidelines which would or could answer questions like ‘Can you embed a link to the app in the ad itself?’ or ‘Can only give an app name and a download location?’ were not uncovered during the research process. The majority of countries reviewed have implemented regulations related to major initiatives developed like the COPPA Act (in the US) and general GDPR (General Data Protection Regulation) provisions.
Additionally, major mobile marketplaces (like the App Store from AppleYouTube Kids, and the Play Store from Google) provide guidance for apps and sites developed for children. Complete analysis from these sources on a country-by-country basis was not feasible during the research process, however have been provided for reference and review.
Also, UNICEF has produced two in-depth papers which look at this topic. Links to both are provided to allow for full review. In 2018, “Children and Digital Marketing: Rights, Risks and Responsibilities” was released. Though older (and uncovered late in the research process), the 2016 “Advertising & Marketing to Children Global Report” provides a review of regulations for 37 countries (some of which are covered in this research).
Finally, much of this research is provided verbatim from sources as it is essential due to the nature of legality surrounding the topic.


In the United States, children are protected by the Children’s Online Privacy Protection Act (COPPA) which was enacted by Congress in 1998. Full text of the code can be reviewed here, however highlights (provided verbatim) are included below:

  • The code “prohibits unfair or deceptive acts or practices in connection with the collection, use, and/or disclosure of personal information from and about children on the Internet.”
  • A child is defined as “an individual under the age of 13.”
  • The regulation covers apps as well as websites. “Internet means collectively the myriad of computer and telecommunications facilities, including equipment and operating software, which comprise the interconnected world-wide network of networks that employ the Transmission Control Protocol/Internet Protocol, or any predecessor or successor protocols to such protocol, to communicate information of all kinds by wire, radio, or other methods of transmission.”
  • “§312.3 — Regulation of unfair or deceptive acts or practices in connection with the collection, use, and/or disclosure of personal information from and about children on the Internet.
  • General requirements. It shall be unlawful for any operator of a Website or online service directed to children, or any operator that has actual knowledge that it is collecting or maintaining personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed under this part. Generally, under this part, an operator must:
    • (a) Provide notice on the Website or online service of what information it collects from children, how it uses such information, and its disclosure practices for such information (§312.4(b));
    • (b) Obtain verifiable parental consent prior to any collection, use, and/or disclosure of personal information from children (§312.5);
    • (c) Provide a reasonable means for a parent to review the personal information collected from a child and to refuse to permit its further use or maintenance (§312.6);
    • (d) Not condition a child’s participation in a game, the offering of a prize, or another activity on the child disclosing more personal information than is reasonably necessary to participate in such activity (§312.7); and
    • (e) Establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children (§312.8).”
  • “§312.7 — Prohibition against conditioning a child’s participation on collection of personal information. An operator is prohibited from conditioning a child’s participation in a game, the offering of a prize, or another activity on the child’s disclosing more personal information than is reasonably necessary to participate in such activity.”
  • “§312.8 — Confidentiality, security, and integrity of personal information collected from children. The operator must establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children. The operator must also take reasonable steps to release children’s personal information only to service providers and third parties who are capable of maintaining the confidentiality, security and integrity of such information, and who provide assurances that they will maintain the information in such a manner.”

Iubenda, a leading online legal resource and compliance solutions provider, provides the following layman interpretations of the code requirements:

Advertising within a game, app, or website, though, has some inherent issues.

  • According to a study conducted by Jenny Radesky, an assistant professor of developmental behavioral pediatrics at the University of Michigan Medical School, in 1998, many of the apps designed for children under the age of 5 contained “pop-up ads with disturbing imagery” and as many as “95% of commonly downloaded apps marketed to be played by children ages 5 and under contain at least one type of advertising.”


briefing paper to the United Kingdom House of Commons dated November 20, 2020, outlines regulations surrounding advertising to children. As with the US data, much of this data is provided verbatim to guard against misinterpretation.

  • ” The Advertising Codes contain strict rules to protect children (and young people) from potentially misleading, harmful or offensive material. For example, the rules:
  • prohibit advertisements from depicting children in hazardous situations or encouraging them to engage in dangerous behaviour;
  • and prevent advertisements from undermining parental authority or placing unfair pressure on children to buy products.”
  • “The Advertising rules are regularly reviewed and updated by the ASA.”
  • “The Advertising Codes are written and maintained by two industry bodies:
    • The Committee of Advertising Practice (CAP) — The CAP is responsible for the UK Code of Non-Broadcast Advertising, Sales Promotion and Direct Marketing, known as the CAP Code.
    • The Broadcast Committee of Advertising Practice (BCAP) — The BCAP is responsible for the “UK Code of Broadcast Advertising”, known as the BCAP Code.”
  • “5.6 Promotions addressed to or targeted directly at children:
    • 5.6.1 Must make clear that adult permission is required if a prize or an incentive might cause conflict between a child’s desire and a parent’s, or other adult’s, authority
    • 5.6.2 Must contain a prominent closing date if applicable (see rule 8.17.4)
    • 5.6.3 Must not exaggerate the value of a prize or the chances of winning it.
  • 5.7 Promotions that require a purchase to participate and include a direct exhortation to make a purchase must not be addressed to or targeted at children.”

Additional parameters set forth in the CAP Code include:

  • A child is defined as someone under the age of 16.
  • 5.3 Marketing communications addressed to or targeted directly at children:
    • 5.3.1 must not exaggerate what is attainable by an ordinary child using the product being marketed
    • 5.3.2 must not exploit children’s susceptibility to charitable appeals and must explain the extent to which their participation will help in any charity-linked promotions.”

The Advertising Standards Authority Ltd. (ASA) actively monitors advertising on children’s websites and YouTube channels. A November 20, 2020, report on their activities includes the following:

  • published list of offending websites and a commitment to engage “directly with advertisers found to have breached the rules.”
  • The most recent sweep was conducted over a three-month period (July to September 2020) and used “monitoring tools to capture age-restricted ads served on a sample of 49 websites and 7 YouTube channels attracting a disproportionately high child audience.” During that time frame, the ASA:


The European Advertising Standards Alliance (EASA) states the “majority of the national advertising codes which are enforced by the self-regulatory bodies are based on the International Chamber of Commerce (ICC) Consolidated Code of Advertising and Marketing Communication Practice (2018). The ICC Code contains several provisions regarding advertising to children like article 18 ‘Children and young people’ and article D5 ‘Digital marketing communications and children’ created because children are often very adept at adopting new technologies, media and devices ” and further that “most European self-regulatory organizations in EASA membership have developed additional rules aimed at protecting children, including recommendations to not advertise products to children that are deemed unsuitable, such as alcoholic beverages, gambling, or foods and drinks that are high in fat, sugar and salt.” Though not country specific, the ICC code is used as a baseline for many national codes in the EU.
Article 18 of the ICC Code lays out the following (verbatim):

With regard to data privacy, the following is set forth in Article 19 of the ICC Code:

  • “When personal data is collected from individuals known or reasonably believed to be children, guidance should be provided to parents or legal guardians about protecting children’s privacy if feasible.
  • Children should be encouraged to obtain a parent’s or responsible adult’s consent before providing personal data via digital interactive media, and reasonable steps should be taken to check that such permission has been given.
  • Only as much personal data should be collected as is necessary to enable the child to engage in the featured activity. A parent or legal guardian should be notified and consent obtained where required.
  • Personal data collected from children should not be used to address marketing communications to them, the children’s parents or other family members without the consent of the parent.
  • Personal data about individuals known or reasonably believed to be children should only be disclosed to third parties after obtaining consent from a parent or legal guardian or where disclosure is authorized by law. Third parties do not include agents or others who provide technical or operational support to the marketer and who do not use or disclose children’s personal data for any other purpose.
  • For additional rules specific to marketing communications to children using digital interactive media, see chapter C, article C7.”

In terms of marketing to children, including the marketing of apps, the ICC Code provides the following in Chapter C:

Additionally, the “Audiovisual Media Services Directive 2010/13/EU includes rules for the protection of minors that apply to all audiovisual services. In particular, article 9.2 of the Directive exhort Member States and the Commission to encourage media service providers to develop codes of conduct regarding inappropriate audiovisual commercial communications for foods and drinks that are high in fat, sugar and salt, aired around or in children’s programmes.”


The Australian Association of National Advertisers (AANA) has adopted a code as it applies to marketing to children. This self-regulated code helps to “ensure that advertisers and marketers develop and maintain a high sense of social responsibility in advertising and marketing to children in Australia.”

  • “Children means persons 14 years old or younger and Child means a person 14 years old or younger.”
  • Advertising or Marketing Communication to Children:
    • (a) must not mislead or deceive Children;
    • (b) must not be ambiguous; and
    • (c) must accurately represent, in a manner that is clearly understood by Children: (i) the advertised Product; (ii) any features (including the size and performance of the product) which are described or depicted or demonstrated in the Advertising or Marketing Communication; (iii) the need for and the price of any accessory parts; and (iv) that the Advertising or Marketing Communication is in fact a commercial communication rather than program content, editorial comment or other non-commercial communication.
    • (d) Price. (i) Prices, if mentioned in Advertising or Marketing Communication to Children, must be accurately presented in a way which can be clearly understood by Children and must not be minimized by words such as “only” or “just”; (ii) Advertising or Marketing Communication to Children must not imply that the Product being promoted is immediately within the reach of every family budget.
  • “Advertising or Marketing Communication to Children must not use popular personalities or celebrities (live or animated) to endorse, recommend, promote or advertise or market Products or Premiums in a manner that obscures the distinction between commercial promotions and program or editorial content.”
  • “If an Advertising or Marketing Communication indicates that personal information in relation to a Child will be collected, or, if as a result of an Advertising and Marketing Communication, personal information of a Child will or is likely to be collected, then the Advertising or Marketing Communication must include a statement that the Child must obtain a parent or guardian’s express consent prior to engaging in any activity that will result in the collection or disclosure of such personal information. Personal information is information that identifies the child or could identify the child.”

Ad Standards is tasked with monitoring and enforcing the codes set forth in the AANA guidelines as well as from other regulatory bodies.

Previous Post
Next Post