COPPA-certified ad SDKs used in children's apps
Why it matters
COPPA §312.5 and §312.7 prohibit using ad networks in children's apps that collect persistent identifiers or engage in behavioural targeting unless those networks are COPPA-certified. Using AdMob mediation in a Kids app without explicitly disabling non-certified mediated networks means you cannot guarantee which network actually served an ad — and if a non-certified network served it, you are liable. The FTC has pursued enforcement actions against app developers for exactly this configuration gap, resulting in consent decrees and civil penalties.
Severity rationale
Info because the certification status of ad SDKs is an advisory finding — the hard pass/fail is covered by the COPPA/GDPR-K check — but uncertified networks in Kids apps are a direct FTC enforcement risk.
Remediation
For Kids apps, disable all ad mediation that includes non-certified networks. In AdMob (https://apps.admob.com) → App settings → Ad units, explicitly disable non-Google-certified partner networks for your Kids app ad units — the setting is per ad unit, not per app.
If you use AdMob mediation, review the mediation waterfall and remove any network that does not appear on Google's Certified Publishing Partners list (https://support.google.com/admob/answer/9683718). Consider eliminating advertising entirely from Kids apps and monetising through premium pricing or in-app purchases — this removes COPPA ad-network complexity entirely and is the approach Apple's own Kids apps take.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the App Store Privacy & Data Compliance Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- coppa · §312.5 — Parental consent — only verifiable parental consent mechanisms and COPPA-safe operators may be used in children's apps
- coppa · §312.7 — Prohibition on conditioning a child's participation on collection of more personal information than reasonably necessary
- gdpr · Art. 8 — Conditions applicable to child's consent in relation to information society services
Taxons
History
- 2026-04-18·v1.0.0·Initial import from app-store-privacy-data·automated