Map the actual data flows and determine which rules apply to the publisher, supplier and audience. Do not assume that a non-wagering game is data-free, or that one age gate satisfies every contractual and legal requirement. COPPA can apply to child-directed commercial services collecting personal information and to general-audience services with actual knowledge of collection from children under 13. (ftc.gov)
For an implementation review, request:
- A list of network destinations and participating vendors.
- Data collected before and after launching the game.
- Cookies, identifiers, storage and retention periods.
- Purposes for analytics, advertising, security and age verification.
- The parties’ legal roles and applicable contractual terms.
- Behaviour when consent is declined or an applicable opt-out is received.
- Deletion, access-request and incident-handling procedures.
Date-sensitive points: the general compliance deadline for most 2025 COPPA Rule amendments was 22 April 2026, so it is already past at this document’s cut-off. California’s 2026 updates also include a means for consumers to confirm the status of sale/sharing opt-out requests, including preference signals such as GPC, where the rules apply. (reginfo.gov)
CCPA applicability depends on the statutory business criteria and relationships; do not assume every small publisher is covered or exempt solely because of size. (cppa.ca.gov)
Test enforcement, not just the banner: compare requests and storage across the relevant privacy states. Where collection must not occur before a required choice, ensure the implementation actually prevents that collection.
Finally, distinguish US requirements from UK-facing supplier features. The UK Gambling Commission’s affiliate guidance says self-declaration alone is insufficient for the age-verification requirements it discusses. Do not market a UK-oriented age-control feature as universal US compliance. (gamblingcommission.gov.uk)