Building for Someone Who Cannot Consent: COPPA, Age Signals, and the New Design Duties
By Casey Scott McKay ·
The children's privacy regime asks a question no other privacy law asks - whether the product is for children at all - and the answer determines whether an ordinary consent model works or is unavailable entirely. This article explains the two triggers, directed to children and actual knowledge, and why the second is the one companies stumble into. It works through what verifiable parental consent actually requires, the exceptions that let a service operate without it, and the design of an age gate that does not itself create the knowledge it was meant to avoid. It covers the advertising restrictions that reshape monetization, the mixed-audience path, and the retention rule that most services fail. It then addresses the newer state design codes and the constitutional litigation reshaping them, and closes with what a defensible program looks like.
IP and Technology > Privacy Data Security | Article | Published 8 April 2026 - Updated 22 May 2026 | Casey Scott McKay - marksy.us
Summary. The children's privacy regime asks a question no other privacy law asks — whether the product is for children at all — and the answer determines whether an ordinary consent model works or is unavailable entirely. This article explains the two triggers, directed to children and actual knowledge, and why the second is the one companies stumble into. It works through what verifiable parental consent actually requires, the exceptions that let a service operate without it, and the design of an age gate that does not itself create the knowledge it was meant to avoid. It covers the advertising restrictions that reshape monetization, the mixed-audience path, and the retention rule that most services fail. It then addresses the newer state design codes and the constitutional litigation reshaping them, and closes with what a defensible program looks like.
Keywords: COPPA · directed to children · actual knowledge · mixed audience · verifiable parental consent · age gate design · age assurance · internal operations exception · conditioning participation · retention and deletion · safe harbor programs · advertising identifiers · contextual advertising · teen data · age appropriate design codes · First Amendment challenges · edtech and school consent · dark patterns · persistent identifiers · enforcement posture
This is premium Marksy content — the full document is available to subscribers.