No behavioral advertising targeting minors
Why it matters
Behavioural advertising targeting minors is prohibited under COPPA §312.2, GDPR Art.8, CCPA §1798.120(c), and the UK Children's Code. These are not soft guidelines — they are enforced with fines, app removal, and in the US, FTC consent decrees. Apps that serve interest-based ads to all users without age verification treat every minor as an adult for advertising purposes. The failure is structural: if the ad SDK does not have a 'user may be a minor' code path, and the app does not pass age data to the SDK, behavioural targeting of minors is happening by default for every minor who uses the app.
Severity rationale
High because serving behavioural ads to minors without age verification violates COPPA, GDPR Art.8, and CCPA §1798.120(c) simultaneously — each serving event is a potential separate violation.
Remediation
Add tagForUnderAgeOfConsent to ad requests for users under 16. In Swift:
GADMobileAds.sharedInstance().requestConfiguration.tagForUnderAgeOfConsent = .true
Implement age verification at account creation and pass the verified age to ad SDK configuration — do not rely on self-reported age from a client-side form alone. For apps where users below 13 may be present, serve contextual-only ads to all users, or use COPPA-certified networks exclusively. Behavioural targeting must be opt-in for all adults and off-by-default for any user who may be a minor.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the App Store Privacy & Data Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- coppa · §312.2 — Definition of 'child' — behavioral advertising to under-13 prohibited without verifiable parental consent
- gdpr · Art. 8 — Conditions applicable to child's consent in relation to information society services
- ccpa · §1798.120(c) — Minors under 16 require opt-in consent for sale of personal information
- external · uk-childrens-code — UK Age Appropriate Design Code (Children's Code) — Principle 12: no profiling of children by default
Taxons
History
- 2026-04-18·v1.0.0·Initial import from app-store-privacy-data·automated