Children’s privacy

Can I show ads in a kids app, and which ad SDK can I use?

Sometimes — but on different terms in each store, and there is no single ad configuration that ships on all three. Apple permits third-party advertising in the Kids Category only where it is contextual and the ad provider publicly documents Kids Category practices that include human review of ad creatives. Google Play permits ads to children or users of unknown age only from a Families Self-Certified Ads SDK version, with no interest-based advertising and no remarketing. Amazon bars its own Amazon Advertising and Associates programmes from child-directed apps and areas outright, and parental consent does not lift that — which makes Amazon the binding constraint. COPPA is US law; these three are store contracts, and complying with COPPA satisfies none of them.

COPPA is law. The store rules are contracts.

COPPA — the FTC’s Children’s Online Privacy Protection Rule, 16 CFR Part 312 — is US law, and it binds operators of services directed to children under 13 and operators with actual knowledge they collect personal information from a child. The Apple, Google Play and Amazon children’s rules are none of those things: they are programme terms inside a developer agreement, each store can revise them in place without notice, and each is stricter than COPPA in places. Keep the two separate when you plan the work. A programme that satisfies COPPA satisfies no store on its own, and removal from a store is a commercial outcome that does not wait for a regulator.

Apple: contextual only, from a provider that publishes its Kids Category practices

Apple treats third-party advertising in the Kids Category as excluded by default, and permits it in limited cases only where the advertising is contextual and the ad service has publicly documented Kids Category practices and policies that include human review of ad creatives for age appropriateness. Two things follow. Behavioural or interest-based serving is outside the carve-out entirely, so this is not a matter of configuring a general-purpose network more carefully. And the vendor’s policy has to be publicly documented — a private assurance from a sales contact does not satisfy it. Separately, Apple requires that any advertising displayed in a kids app be human-reviewed for age appropriateness, which reaches your own house ads and cross-promotions as well as a third party’s inventory. Apple also states that apps intended primarily for kids should not include third-party analytics or third-party advertising whether or not they sit in the Kids Category, so declining the category does not lift the limits.

The Apple rule that actually decides which SDK you can integrate

A Kids Category app may not send personally identifiable information, or device information, to third parties. Apple states this without the “in limited cases” qualifier it attaches to analytics and advertising, and its guidance on designing safe and age-appropriate experiences adds two things that widen it and are easy to miss: the rule applies even in sections of the app intended for adults, and the only stated route through it is explicit parental consent. So an ad SDK that transmits identifiers or device information off-device is a problem regardless of how its serving is targeted, and an adult-facing settings or parent area does not escape the rule. This, rather than the targeting rule, is usually what disqualifies a candidate SDK.

Google Play: a self-certified ads SDK, certified per version

Ads shown to children, or to users whose age you do not know, may be served only through a Google Play Families Self-Certified Ads SDK — and certification is per SDK version, not per vendor. “Our SDK is certified” is therefore not an answer to the question; the specific version you ship has to appear on Google’s published list. Interest-based advertising and remarketing to those users are prohibited outright, which leaves contextual serving chosen from what the user is currently looking at rather than from a profile of them. Two cases sit outside the self-certification requirement and are worth knowing so the rule is not over-applied: in-house advertising that cross-promotes your own apps, media or merchandise, and direct deals with advertisers where an SDK is used for inventory management. Both still have to satisfy Google’s ad-content and data-collection rules.

Google’s identifier and location rules constrain the same choice

An app that solely targets children must not transmit the Android advertising identifier (AAID), the SIM serial, the Build serial, the BSSID, the MAC address, the SSID, the IMEI or the IMSI. It must not declare the AD_ID permission when targeting API level 33 or above — a manifest-level check that is visible whether or not the identifier is ever read. And it may not request location permission or collect precise location at all. In a mixed-audience app the same transmission ban covers children and users of unknown age, which is why a neutral age screen is the usual mechanism: without a reliable age signal, every user has to be treated as a child for these purposes. An ad SDK whose ordinary operation depends on the advertising identifier is not going to fit inside those rules.

Amazon: an absolute bar that consent does not lift

Amazon is the strictest of the three, and the reason there is no universal configuration. Ads must not be served through any Amazon Advertising programme — Amazon Publisher Services and the Amazon Mobile Ad Network are Amazon’s own examples — or through Amazon Associates, either to anyone you know to be a child or anywhere in a child-directed portion of the app. Obtaining parental consent does not lift it. Amazon says that separately and explicitly, which inverts the logic developers carry over from COPPA, where verifiable parental consent is what unlocks the activity. And where an app is directed only at children, those programmes may not be used at all: a mixed-audience app can solve the problem by confining ads to non-child-directed areas and non-child users, but a child-only app has no compliant placement and has to monetise another way.

Who counts as a child does not line up either

Amazon defines children as under 13, or under 16 in the European Union, Australia and Japan, together with children of any age whose personal data applicable law restricts collecting. That is wider than COPPA’s under-13, so a programme scoped to COPPA alone is under-scoped for that store in three markets. Amazon also treats a mixed-audience app as child-directed unless the developer confirms children are not using it — child-directed is the default and the confirmation is the thing you have to evidence, not the other way round. Google’s ads and identifier rules extend to users of unknown age, not only to known children. Apple’s Kids Category duties are triggered by the category and by an app being intended primarily for kids.

The conclusion: plan per store, not once

There is no single ad configuration that ships on all three stores. Amazon is the binding constraint, because its bar on its own advertising and affiliate programmes cannot be consented around and is absolute in a child-only app. Below that, Apple and Google both leave contextual advertising available but qualify the supplier differently — Google by a published per-version SDK certification, Apple by the vendor publishing Kids Category practices that include human creative review — so the same SDK build can satisfy one and not the other. Treat the ad decision as a per-store decision with its own evidence: which inventory source, which SDK version, what the vendor publishes, and for Amazon, whether the app is child-directed at all.

These policies change in place, without notice

None of the three carries a version number or a deprecation notice; the stores rewrite the pages and the new text is simply what binds you. Keel models each against the text retrieved on 13 August 2026, which is why its frameworks carry a retrieval date rather than a version. Google has announced a replacement Families policy taking effect on 26 August 2026, expanding the restriction on anonymous chat apps targeting children; Keel scores the policy in force rather than a published preview, and re-verifies on or after that date. Keel also runs a monthly drift monitor over these source pages, which reports a change for a human to read and never edits framework content on its own. Check the live policy before you rely on any of this for a submission.

FAQ