Terms of service red flag: children's data collection explained in plain language

Photo by Pavel Danilyuk from Pexels

When you sign your child up for an educational app, a gaming platform, or a social media account, you probably assume the company has strict rules about protecting their data. The reality is messier. Many terms of service quietly collect vast amounts of information about children, browsing habits, location, learning preferences, even biometric data, often with vague promises about how it will be used. Most parents never read these policies, and the ones who try give up after hitting walls of legal jargon. This article cuts through that fog and shows you exactly what to look for.

TL;DR

Children's data collection is often legal but must comply with laws like COPPA (US) and GDPR (EU); however, many companies bend these rules or exploit gray areas
Red flags include indefinite data retention, vague purposes ("analytics," "improvement"), third-party sharing without explicit consent, and weak parental controls
Terms Doctor's 101 consumer-protection checks include automated detection of child-unfriendly clauses and data practices
Always look for opt-out language, transparent retention policies, and clear explanations of what "your child's data" actually means
Use a three-step verification process: read the privacy notice, check parental consent mechanisms, and test data deletion requests

Consumer-protection checks in Terms Doctor that flag child data risks

What counts as "children's data" in terms of service?

reading contract — Photo by https://kaboompics.com/ from Pexels

Before you can spot red flags, you need to understand what companies are actually collecting. Children's data is any personal information linked to or identifying a minor, and the definition is broader than most parents realize.

Obvious data types:

Name, email address, date of birth
School name, grade level, learning performance
Photos or video (even profile pictures)
Location (GPS, IP address, device identifiers)
Device information (model, operating system, unique identifiers)

Less obvious but equally risky:

Behavioral tracking: what pages they visit, how long they stay, what they click
Inferred data: interests predicted from their activity ("this child likes anime")
Biometric data: voice recognition, facial recognition, fingerprints
Health or special-needs information: therapy notes, disability status, medications
Social data: friend lists, contacts, messages
Unique identifiers assigned by the company (cookies, user IDs, advertising IDs)

Key takeaway: If it can be connected to your child or reveal something about them, it's children's data, even if it seems anonymous at first.

"The type of personal information collected, the purpose of the collection, and how long the data will be retained."

>, Red Flags in Privacy Notices

This quote points to the three core questions you must answer when reading any terms of service for a child-facing app or website. Each one is a potential red flag if the answer is vague, broad, or missing.

Red flags to watch for in children's data policies

Percent of popular apps with unclear child data retention policies

Not every data collection practice is dangerous, but certain patterns are serious warning signs. Here are the red flags that should make you pause before letting your child use a platform.

Indefinite or excessive data retention

Red flag: "We retain your data for as long as your account is active and for a reasonable period thereafter."

What does "reasonable period" mean? Six months? Six years? Forever? This vagueness is a red flag. Best practice: companies should specify exactly how many days, months, or years they keep each type of data. Data about a 10-year-old's learning profile should not follow them into adulthood if they no longer use the service.

Better language: "We delete activity logs after 90 days. Account profile data is retained for 12 months after account closure, then permanently deleted."

Vague purposes for data collection

Red flag: "We use your data to improve services, enhance user experience, and for analytics."

This is so broad it justifies almost anything. "Improvement" could mean anything from fixing bugs to building an advertising profile. "Analytics" could mean counting users or tracking individual behavior patterns for sale to third parties.

Better language: "We use activity data to identify and fix app crashes. We do not use children's data for marketing or targeted advertising."

Automatic sharing with third parties

Red flag: "We may share data with service providers, partners, and other third parties as needed."

Who are these "partners"? Are they advertisers? Analytics companies? Toy manufacturers? Without naming them and getting explicit parental consent for each one, this clause is a major warning sign.

Better language: "We use Google Analytics (a tool that measures app traffic) and Zendesk (for customer support). Parents can opt out of analytics via Settings. We do NOT sell children's data to advertisers."

No parental access or control

Red flag: The terms mention no way for parents to review, download, or delete their child's data.

Under COPPA (Children's Online Privacy Protection Act in the US) and GDPR (in the EU), parents must be able to request and review data about their children. If the terms don't mention this right, it's a red flag.

Better language: "Parents can request a copy of their child's data, request deletion, or opt out of non-essential tracking at any time through the Parental Controls panel."

No age verification or weak consent mechanisms

Red flag: The service is labeled "for all ages" but requires no confirmation that an adult set up the account.

This is especially common in gaming and social platforms. If a 7-year-old can sign up with just an email address, what data protection are they really getting?

Better language: "Accounts for children under 13 require a parent's email address and verification. Parents receive a confirmation link and must actively consent before the account is created."

Example red flag in the wild: A popular educational app's terms say "We collect data to personalize learning experiences" but never specify whether that data is sold to ad networks, shared with insurance companies, or retained after a child graduates. Parents cannot download or delete their child's complete data history.

How to read children's data clauses step by step

online privacy — Photo by Markus Winkler from Pexels

Most parents skip the terms of service because they feel impenetrable. But if you know what to search for, you can decode the key clauses in 10 minutes.

Step 1: Find the privacy policy and age-specific sections

Not all policies mention children explicitly. Some bury it in a separate "Children's Privacy" or "COPPA Compliance" section. Others say nothing about children at all, which is itself a red flag.

What to search for:

"Children" or "minors" or "under 13"
"COPPA" (in the US)
"Parental consent" or "parental notice"
"Privacy Policy" (usually linked at the bottom of the website)

If you can't find a specific children's section, the company may not have one, meaning their standard data practices apply to kids with no extra protections.

Step 2: Extract the three core answers

Once you find the policy, look for these three answers:

What data is collected? Look for lists of data types. If the list is vague ("personal information," "usage data"), ask the company for specifics before signing up.

Why is it collected? Check the purposes. Are they tied to the core service (teaching math, showing progress) or broader marketing uses (advertising, selling insights)?

How long is it kept? Find the exact retention policy. "Reasonable time" is not good enough.

Step 3: Check for parental rights

The policy should mention:

How parents can request access to their child's data
How parents can request deletion
How parents can opt out of certain data uses
How to contact the company with privacy concerns

If none of these are mentioned, red flag.

data protection — Photo by Stefan Coders from Pexels

Your step-by-step verification checklist

How Terms Doctor helps you spot child data red flags

Terms of service red flag: children's data collection explained in plain language process — Figure 1: Terms of service red flag: children's data collection explained in plain language at a glance.

Manually reading every privacy policy is exhausting, which is why most of us don't do it. Terms Doctor is a free browser extension that automates this process.

When you visit a website or app signup page, Terms Doctor:

Finds the terms of service automatically (no hunting for tiny footer links)
Runs 101 consumer-protection checks, including specific checks for child-unfriendly practices: indefinite data retention, weak parental consent, third-party sharing without opt-out, and vague data purposes
Grades the terms A–F with plain-language explanations (not legal jargon)
Highlights red flags in color so you see "high risk" clauses immediately
Tracks changes so you're notified if a company updates their terms in ways that affect your child's privacy
Works on any website and is available for Chrome, Edge, Brave, Opera, and Vivaldi

Instead of spending an hour reading a policy, you get a grade and a summary of the top risks in under a minute.

FAQ

Frequently Asked Questions

What is COPPA and does it apply to my child?

COPPA (Children's Online Privacy Protection Act) is a US federal law that applies to websites and apps that knowingly collect data from children under 13. If a service is covered by COPPA, they must get verifiable parental consent before collecting data from your child, provide a detailed privacy policy, and allow parents to access or delete children's data. COPPA violations carry fines up to $43,792 per incident. However, COPPA only applies to US companies, international services may have different rules (like GDPR in Europe).

If a service says "parental consent required," does that mean my child's data is safe?

Not necessarily. Parental consent is a legal requirement in some jurisdictions, but it doesn't guarantee the data will be protected well. Some companies require consent just to check a box, then proceed to collect, retain, and share data anyway. You must verify that parental consent is verifiable (you receive a confirmation), informed (you see exactly what data will be collected and why), and enforceable (you can withdraw consent anytime). If the consent process is unclear or one-way, it's a red flag.

Can I request my child's data be deleted, and what happens if the company refuses?

Yes. Under COPPA and GDPR, parents have the right to request deletion of their child's data. The company should delete it within 30 days (often less). If they refuse or delay, you can file a complaint with your country's privacy regulator (the FTC in the US, the relevant Data Protection Authority in the EU). Keep records of your deletion request and any responses for evidence.

What's the difference between "anonymous" data and "personal" data?

Anonymous data has all identifying information removed, no name, email, ID, or device identifier linked to your child. However, "anonymous" is often overstated. A company that collects "anonymous" behavior data but links it to a unique device ID can still re-identify your child later. Read carefully: if they say data is anonymous but later mention unique identifiers, user accounts, or re-identification, it's not truly anonymous.

Should I be worried about children's data being sold to advertisers?

Yes, if it's happening. Many companies claim they don't sell children's data directly to advertisers, but they share it with "service providers" (analytics, ad networks) or keep it for their own targeted marketing. This is a red flag. Before signup, search the policy for "sell," "share," "third party," and "advertising." If data will be used for targeted ads, the policy should say so explicitly and give you an opt-out option.

Next steps: Take control of your child's digital privacy

Reading terms of service is not thrilling, but it is one of the most effective ways to protect your child's data. The practices you allow now, data collection, retention, sharing, shape your child's digital footprint for years.

Right now:

Pick one app or website your child uses regularly and review its privacy policy using the checklist above.
Install the free Terms Doctor extension and run a check on that same service. Compare what the extension flags with what you found manually, you'll spot patterns faster next time.
If you find a serious red flag, contact the company's privacy team and request clarification before your child uses the service again.

Terms Doctor is a free browser extension that finds terms of service on any website, runs automated checks for 101 consumer-protection issues (including child data risks), and grades terms A–F in plain language. No legal training required. Available for Chrome, Edge, Brave, Opera, and Vivaldi. Use it as your shortcut: instead of reading policies for hours, get a clear summary and risk score in seconds. Get Terms Doctor free today. Remember: automated checks are not a substitute for professional legal advice, but they give you a smart head start before signing your child up for anything.

Additional Resources

Red Flags in Privacy Notices - Some common red flags to look for are: Missing Information Lack of Specificity Contradictory Statements. Reference to how children/minor's data is handled and ...
Privacy Policy Red Flags: How To Spot a Bad ... - Red Flag #3: It Collects a Lot of Data (or is Very Vague) It's a red flag when businesses ask to collect too much unnecessary data in their ...
K-12 Privacy Policy Guide: How to Quickly Spot Red Flags - Red Flags Lack of Data Minimization: The policy does not state that they only collect the minimum amount of data necessary to provide the service.