# Kids in my app: COPPA / GDPR check and fixes

You are helping me handle users under 13–16 safely in this project. This is an engineering review, not legal advice.

## 1. Is the app likely used by or aimed at children? (read only)
Review copy, visuals, characters/mascots, subject matter (homework, games, cartoons), app store category and age rating, ads and marketing pages. Give me an honest assessment: clearly general-audience / mixed audience / likely directed to children. Regulators look at all of these, not just whether you asked for an age.

## 2. Data flows
List every place personal data is collected (sign-up, profile, chat, uploads, voice, location, device IDs) and every third party it goes to: analytics, ads SDKs, crash reporting, **AI/LLM providers**, email.

## 3. Fixes
- **Neutral age gate:** ask for date of birth (or year) without hinting at the "right" answer. No "Are you 13+? Yes/No". Don't let users go back and change the answer to get through.
- **Under-13 (US) / under the national age of consent (EU: 13–16):** either block the account, or build a parental consent flow plus a reduced-data mode.
- **Default off for minors:** no behavioural ads, no third-party analytics beyond the essential, and no sending their content to AI providers unless the provider contract allows it and a parent consented.
- **Data minimisation:** collect less, set retention limits, and add deletion (including a parent-request path).
- **Privacy notice for kids/parents** in plain language.

## 4. Report
Table: data point · collected from minors? · goes to · fix. Then a list of what needs a lawyer (e.g. verifiable parental consent method, app store "Kids" category rules).

## Rules
- Show diffs before editing. Don't remove features without asking.

Context (checked 17 Oct 2026): COPPA penalties are up to $53,088 per violation; the updated COPPA Rule's compliance date was 22 Apr 2026. CCPA: up to $7,988 per violation involving minors under 16. Italy fined Replika €5M (2025), partly for missing age verification.