Age restrictions are four separate rules that get mistaken for one law

Ask how old someone has to be to use an app and you will get several answers, all of them true, because the question hides four separate systems. Most arguments about age limits are really arguments between two people who are each looking at a different one.

What to take away

Four rules that get mistaken for one

The service's own minimum age. This lives in the terms of service or user agreement. It is a contract term the company sets for itself, and it is the number it will point to when it closes an account. It is not an assessment of whether the content suits a particular child, and it is not a legal age of majority.

The store's content rating. App stores attach a rating or descriptor to a listing, generally derived from what the developer declares about the content: violence, gambling-style mechanics, user-generated material, in-app purchases. A rating describes content. It does not create an eligibility rule, and it routinely disagrees with the number in the terms.

Product tiers inside the service. Many services run different defaults for accounts registered below a certain age: restricted messaging, limited discovery, different advertising treatment, a supervision link to a parent's account. This is a product configuration rather than a rule, and it is the layer that actually changes what a young user sees every day.

The law where the user is. Statutory rules about minors, consent, data handling and access differ by country and, in several countries, by state or province. They also change often. Nothing on a general-interest page, this one included, should be read as a statement of what currently applies to you. That answer comes from your own regulator or from a qualified adviser.

When someone tells you "the age limit is X," ask which of the four they mean. A surprising number of disputes end there.

Where each number actually lives

That last row deserves care. Rules covering minors online are among the fastest-moving parts of technology regulation, and they vary enough between jurisdictions that a summary written elsewhere is a poor substitute for the primary text. Open the regulator's page and read the current version rather than trusting a secondhand figure, including one you read here.

Age assurance and what each method trades away

Every method of establishing age is buying accuracy with some mix of friction, privacy and exclusion. None of them is free.

There is no winner in that list. The useful question for a product team is not which method is best but what a false result costs and who pays for it.

Turning away an adult from a general-purpose service differs from admitting a young child to an unrestricted one. A system tuned to avoid one error will make more of the other.

Decide which error you can accept before you pick the method, then write the reasoning where the next person can find it.

Questions that get you a real answer

If you are a parent, ask the service, not the internet: what is the minimum age for this account, what changes on a teen account, can I link supervision, and how do I see what is currently switched on. Then check the device controls separately, because they operate independently of anything the app does.

If you run a school or a youth organization, the question is narrower. Which of these apps do we require, which do we merely permit, and what happens to a student who cannot meet the age requirement for a required one? A tool nobody under a certain age can lawfully use is not a tool you can make mandatory.

The related question of who owns the resulting accounts and data belongs in your school technology policies, and it is a governance question rather than a product one.

If you are building the product, work out early which of the four layers you are setting, and whether your stated minimum matches your store rating. Decide too what you will do about accounts created with a false birthdate, and how someone wrongly blocked gets back in.

A US business handling personal data can start with the Federal Trade Commission's business guidance on privacy and security.

A service reaching UK users can start with that country's information regulator and its children's code guidance and resources. Anywhere else, start with your own national data protection authority, because these two cover two jurisdictions and nothing more.

When the stated age is wrong

Accounts get flagged, sometimes years later, usually when something else triggers a review. The mechanics are worth knowing in advance.

A flagged account is typically restricted first and reviewed second, so access disappears before anyone explains why. Re-verification usually asks for proof of the correct age: the least sensitive document with a date of birth, not the most complete one.

Success often restores the account but not everything in it. Some services treat an under-age registration as unrecoverable, regardless of the user's age today.

Act preventatively. Export anything you would miss while you still have access, and keep a record of the address and recovery method attached to the account.

Do not open a second account to get around a restriction. That reads as evasion and draws far harsher handling than the original problem.

What happens next follows the same path as any other enforcement decision: restriction first, explanation later, and an internal review, not an independent one.

Where to look, in order

Record the date you checked each one next to whatever you concluded. Every layer above changes on its own schedule and none of them will tell you when it has. The first of the four layers, the service's own contract term, sits inside a wider relationship whose asymmetries are described in what you agreed to.

Common questions

My child is under the stated minimum. Is it illegal for them to have an account?

Those are two different questions. The stated minimum is a contract term the service sets, and breaching it usually means the account can be closed. Whether anything legal is engaged depends entirely on where you are, and that answer comes from your own regulator rather than from a page like this.

The store rating and the app's stated minimum disagree. Which one is right?

Both, because they are answering different questions. The rating describes content. The minimum is an eligibility term. They routinely disagree and neither overrides the other.

Can I get an account restored after an age flag?

Sometimes. Services differ, some treat an under-age registration as unrecoverable whatever the user's age today, and the review usually restricts first and explains second. The preventative steps above are worth more than any appeal.

Which age assurance method should we build?

The question to answer first is what a false result costs and who pays for it. A method that is right for a service where wrongly admitting a child is severe is the wrong method where wrongly excluding an adult is severe.

How often does any of this change?

Often enough that a summary written last year is unreliable, and none of the four layers announces its changes to the others. Record the date beside every answer you write down.