A cartoon tile-matching game with no App Store age restriction can attract under-13 users, while its default ad SDK setup assumes every user is an adult. If behavioral ads then appear, the developer is serving COPPA-violating ads to children, and FTC enforcement is real. The gap is technical and operational: casual games commonly have mixed-age audiences.
What COPPA Requires from App Publishers
In the United States, the Children's Online Privacy Protection Act (COPPA) bars operators of child-directed websites and online services from collecting personal information without verifiable parental consent. The FTC applies it to apps "directed to children" and to mixed-audience apps when the operator knows some users are under 13.
For ads, COPPA means no behavioral targeting, cross-app tracking, IDFA or GAID collection for advertising, or retargeting for child-identified users. Demand partners serving those sessions must rely on contextual signals such as app category, device type, and geo, rather than user-level behavioral data.
Google Play Families and Apple's age-rating rules add requirements. On iOS, apps rated for users 12 and under may use only networks Apple designates as meeting its child privacy requirements. Google Play's Families program similarly limits networks serving apps in the Families category. These platform rules apply even when a developer does not view COPPA as jurisdictionally applicable.
Mixed-Audience Apps: Two Practical Options
Most casual games with broad appeal have two paths. One is to treat every user as child-directed: set that treatment flag on every ad session, limit demand partners to contextual targeting, and accept the eCPM loss from excluding behavioral data. It is the simplest route and suits apps expecting a large under-13 audience.
The other path is an age gate before ad sessions start. Users identifying as 13 or older enter the standard flow with targeting enabled. Users identifying as under 13, or declining to provide age information, enter the child-directed configuration. Adult users retain the eCPM benefit of behavioral targeting while the child segment remains compliant.
Applying child-directed flags to everyone is valid in some cases. For an app with 40% or more users likely to be under 13, simpler compliance can outweigh lost revenue. An age gate becomes worthwhile when the adult segment is large enough for its preserved targeting to materially affect total revenue. For most mixed-demographic casual games below 150K DAU, age-gate complexity is not the first issue to solve.
Technical Setup: SDK Flags and Their Effect
Most major mobile ad SDKs provide a "tag for child-directed treatment" flag, set during initialization or on the ad request. Google's Mobile Ads SDK has this flag, while Meta Audience Network uses a mixed-audience flag on its object. Implementations differ by demand partner, but the result is similar: the request enters a child-safe pool, behavioral signals are removed, and targeting is contextual.
With mediation, the child-directed flag must travel through the mediation layer to every demand partner adapter, not only one network. Manual waterfall setups often set COPPA on the primary network but omit secondary and tertiary partners. A flagged child session can then reach a non-flagged partner farther down the waterfall.
When set at the ad unit level, Adrop's mediation layer passes the child-directed treatment flag to all configured demand partners. One Adrop setting covers each partner receiving the request, instead of requiring separate changes in every network SDK.
GDPR and COPPA Intersection
For publishers serving the European Economic Area, GDPR rules for minors under 16, or 13 in some member states, add to COPPA. A mixed-audience casual game serving the US and Europe needs consent management for both: COPPA parental consent for US children and GDPR lawful basis for EU users.
Your Consent Management Platform (CMP) must present jurisdiction-specific consent flows, then pass their signals to the ad SDK before the first request. An EU user declining consent must not receive behavioral targeting at any age. A US user under 13 must receive child-directed treatment regardless of consent state.
Most publishers using OneTrust, Usercentrics, or the IAB TCF stack have jurisdiction routing. The usual gap is downstream delivery to mediation and individual SDKs. Test explicitly: log requests before and after consent changes, then verify that targeting parameters change as expected.
Testing Your Compliance Configuration
Inspecting real ad requests is the dependable network-level COPPA check. Networks serving your inventory should include the child-directed flag, and responses should come from a child-safe pool without user-level behavioral signals in the bid response.
Before launch, run the app in a test environment with child-directed treatment explicitly enabled. Capture requests and responses through a network proxy, and confirm that every active demand partner receives and honors the flag. This is tedious, but it verifies that the waterfall has no compliance gap.
Google and Apple review teams increasingly check whether child-rated apps use compliant ad configurations. Since 2023, rejections for non-compliant ad content in child-rated apps have become more common. Correct setup before submission is less painful than fixing it after rejection or an FTC inquiry.