# Age rating and IARC classification match actual content

- **Pattern:** `ab-000483` (`app-store-privacy-data.children-sensitive.age-rating-accuracy`)
- **Severity:** low
- **Lifecycle:** active
- **Last modified:** 2026-04-18
- **Canonical URL:** https://auditbuffet.com/patterns/ab-000483
- **License:** CC-BY-4.0 — attribute to AuditBuffet Pattern Catalog (https://auditbuffet.com/patterns/ab-000483)

## Why it matters

An inaccurate age rating misdirects parental controls and content filtering on both platforms. Apple and Google use age ratings to enforce parental control features: a gambling mechanic in a 4+ app bypasses every parental restriction a parent has set. COPPA §312.2 and CCPA §1798.120(c) extend protections to users under 13 — an under-rated app with data collection features triggers child-privacy obligations the developer may not have implemented. Apple rejects apps with gambling or casino mechanics rated below 17+; Google will restrict or remove apps where the rating does not match detected content.

## Severity rationale

Low because rating mismatches are correctable during review, but a Kids category app with gambling mechanics or ad SDKs is an escalation to COPPA violation territory.

## Remediation

Use Apple's rating questionnaire in App Store Connect to obtain an accurate rating — do not estimate. The questionnaire maps specific content types to specific rating levels and removes the guesswork.

For gambling or casino content, the minimum rating is 17+ on iOS and Teen (13+) with a gambling content disclosure on Android. For apps in the Kids category, the content rating must be 4+ or 9+. Search your codebase for `slots`, `spin`, `wager`, `casino`, `poker` in component names or game logic files before submission — any match in a 4+ app is a rejection waiting to happen.

## Detection

- **ID:** `age-rating-accuracy`
- **Severity:** `low`
- **What to look for:** Count all relevant instances and enumerate each. Check declared age rating signals: `app.json` `ios.appStoreMetadata.ageRating` or equivalent; `fastlane/metadata/ios/` rating-related files; `fastlane/metadata/android/` IARC classification files; any `store-listing/` directory. Compare to actual content: look for violence (`damage`, `kill`, `weapon`, `blood`, `gore` in UI components or game logic); gambling (`slots`, `poker`, `casino`, `betAmount`, `wager`, `spin-to-win`, `gacha`); alcohol/drug references (`beer`, `wine`, `cannabis`, `drug` in non-health contexts); sexual content indicators (`nude`, `explicit`, `adult`, `18+` in component names); horror themes; strong language (search for profanity in string literals rendered to users). Flag mismatches where the rating appears too low for the detected content, or where a Kids category app (4+/ages-5-and-under) has content that would violate Kids category rules. Also look for simulated gambling features in apps rated for younger audiences — this is a common rejection pattern.
- **Pass criteria:** Declared age rating is consistent with detected content types in the source. At least 1 implementation must be verified. No obvious under-rating or Kids category content violations.
- **Fail criteria:** Not applicable — this is a low-severity informational check. Result is `pass`, `fail` (with detail for clear mismatches), or `skip`.
- **Skip (N/A) when:** No age rating metadata files found and no content markers detected.
- **Detail on fail:** `"App declared as 4+ in app.json but source contains casino/gambling mechanics (spin logic in src/games/slots.ts) — gambling content requires 17+ rating"` or `"Kids category app detected but Ad SDK without child-directed treatment flag initialized — violates Kids category policy"`
- **Remediation:** Under-rated apps are rejected; over-rated apps miss their target audience.
  1. Use Apple's rating questionnaire in App Store Connect to get the accurate rating based on your content — don't guess
  2. For gambling/casino content, the minimum rating is 17+ on iOS and Teen (13+) with gambling content disclosure on Android
  3. For Kids category apps, the content rating must be 4+ or 9+

  Review the configuration in `src/` or `app/` directory for implementation patterns.

## External references

- coppa §312.2
- ccpa §1798.120(c)

Taxons: regulatory-conformance, content-integrity

HTML version: https://auditbuffet.com/patterns/ab-000483