Age restrictions laws hinge on the place and the date, not the page you are reading

Age restrictions laws are checkable, but only when a claim carries three things: a place, a date, and a status. This page sets out how to establish all three, and names the instruments that make the method concrete.

Rules about minors online differ between countries and within countries, and they change faster than almost any other technology policy. Litigation alters several after they pass, so a page that gave the answer would mislead half its readers on publication day.

What it can do is give you the three things that make a claim about the law checkable. Which place's rules reach a given user, which date a claim is talking about, and whether the source in front of you can settle the question at all.

What to take away

Which place's rules reach a user

Three connecting factors do most of the work, and they frequently point in different directions.

Where you are established. The obvious one, and often the least decisive for a service used from elsewhere.

Where the user is. Rules protecting minors are typically written to protect people in a territory, which means the applicable set travels with the user rather than with you. It is also the factor you know least reliably, since location signals are approximations.

Whether you direct the service there. Language, currency, marketing, local payment methods and local support all speak to this, and it can pull a service into scope in a place it never intended to serve.

A fourth question sits underneath all three: which level within that place. National, state or provincial, and occasionally local bodies can each hold a piece of this subject. An answer complete at one level can be silent about a requirement at another.

Where a country has sub-national variation, treat each unit as its own question, not assuming the national answer covers it.

Three dates and a status

The status row is peculiar to this area. Rules about minors are challenged in court often enough that an instrument can be in force, partly suspended, or unenforceable in part while a case runs, and coverage of the original passage will say none of that. California's Age-Appropriate Design Code Act is the plain example: it was adopted and published, then preliminarily enjoined in NetChoice v. Bonta before it took effect, so its status reads enjoined rather than in force. Texas's SCOPE Act, challenged in NetChoice v. Paxton, is the harder version of the same problem, where one instrument can end up enforceable in part and blocked in part.

If a claim comes to you without a status, it is a claim about a moment in the past.

Record the date you checked alongside whatever you conclude. Nothing will tell you when your answer expires. The general form of this check is in passed, in force, enforced.

The instruments, named

Three examples, so the method has something to bite on.

United States: COPPA. The Children's Online Privacy Protection Act is a federal statute, enacted in 1998. The Federal Trade Commission's COPPA Rule, which implements it, has applied since April 2000 and has been amended since, with amendments that took effect in July 2013. The statute sits in the U.S. Code, the rule in the Code of Federal Regulations, and amendments to it are announced in the Federal Register. Both are published by the government, not by a vendor or a summary site.

United Kingdom: the Age Appropriate Design Code. The Information Commissioner's Office issues the Age Appropriate Design Code, also called the children's code, as a statutory code of practice under the Data Protection Act 2018. It came into force on 2 September 2021, followed by a twelve-month transition before the regulator's full enforcement began. It reaches a different set of services than COPPA does, so a service can sit comfortably outside one and squarely inside the other.

European Union: the age in the data protection regulation. The General Data Protection Regulation sets a default age of 16 for consent to information society services offered directly to a child, and lets each member state lower that, but no lower than 13. Which of the two figures binds you therefore depends on the member state the user is in, and the instrument to read is Article 8 of the regulation together with the national law that fixes the age.

One level down. California and Texas have each adopted their own online-safety rules for minors: the California Age-Appropriate Design Code Act (AB 2273), which the California Attorney General enforces, and the Texas SCOPE Act, the Securing Children Online through Parental Empowerment Act (HB 1181), which the Texas Attorney General enforces. Each has drawn court challenges, which is why "the US rule" can be wrong at the federal level and wrong again at the state level. State statutes appear on the legislature's own site and in the state code; state regulations appear in the state register, and the state attorney general's own site carries enforcement announcements.

Walk COPPA through the four questions — what the instrument is, who owns it, when it started to apply, and whether it still does — and a checkable claim appears: the instrument is the statute plus the rule that implements it, the body is the Federal Trade Commission, commencement is settled because both are in force, and the status reads in force, subject to the usual amendment cycle. Run AB 2273 or the SCOPE Act through the same questions and the last one stops being simple, because the status answer tracks the litigation rather than the text.

Checking a claim

A routine that takes about fifteen minutes and settles most disagreements.

Steps 4 and 6 are the ones people skip and the ones that pay. Scope answers most questions on its own, and a dated copy is the only way to show later what the position was when you decided.

Why summaries fail here specifically

Four causes, and they compound.

Movement: rules change fast, so an article a year old may describe a rule since amended. Sub-national variation: a summary about one state or province gets read as national.

Litigation: a challenge changes what is enforceable without changing the text. Drafting stages: proposals, consultations, and committee versions are reported in the same register as adopted instruments, so a rule that may never take effect circulates as though it had.

Add the ordinary problem that a rule from one country is written about in every other, and the confident secondhand answer is more likely to be wrong than right. The antidote is to read a responsible body's own current pages rather than an account of them.

The Federal Trade Commission's questions and answers on complying with the Children's Online Privacy Protection Act and its children's privacy rule, and the United Kingdom Information Commissioner's Office's children's code guidance for the Age Appropriate Design Code, are examples of what a primary source page looks like. Each covers one jurisdiction only, and neither travels.

Tracking movement properly is its own routine, described in following policy news and timelines.

Briefing an adviser without paying them to teach you

The cost of advice here is mostly the cost of establishing facts a lawyer has to get from you anyway. Arrive with them written down.

That package converts an open ended question into a bounded one, and it is the single most effective way to reduce what this costs you. The product facts behind it are set out in the four parts of an age rule and in age as a data field.

What to do with the answer

Write it down where a successor will find it: the question, the place, the instrument, the date you checked, what you concluded, what remains uncertain, and what would make you revisit it. Then put the conclusion into the document that actually governs behavior, usually your internal policy rather than a research note.

A skeleton for that document is in the eligibility policy outline, and the layers this all sits on are in four rules that get mistaken for one.

Nothing here is legal advice, and none of it substitutes for a qualified adviser in the places you operate.

Common questions

Can we just apply the strictest rule we can find, everywhere?

Some organizations do, and it can be a reasonable business decision. It is not a legal conclusion, and it does not always work, because obligations can conflict rather than simply differ in strictness.

Our users are all in one country. Is this simpler?

Somewhat, though you still have the level question inside that country, and you still have the date and status questions. It also stops being true the moment anyone signs up from elsewhere.

A vendor's compliance page says we are covered. Is that a source?

It is a marketing document about their product. Take the instrument and the body's name from it if they are given, then check both yourself. A page that claims COPPA coverage should be sending you to the Federal Trade Commission's own pages; without that, you have a claim, not a source.