Rules
Part of Age restrictions are four separate rules that get mistaken for one law
Age restrictions rules: the trigger decides
Age restrictions rules turn on two tests: the age band a service names and the trigger that brings it into scope. Passage and commencement are separate dates.
Age restrictions rules are fixed by two things: the age band a product names and the trigger that brings your service into scope. The date a rule takes effect is a third question, rarely the one in the headline.
Two examples set the pattern. A US service collecting personal information from a child under 13 falls under the FTC's COPPA rule, in force since 2000. A UK service likely to be accessed by anyone under 18 falls under the ICO's Children's Code, in force since 2 September 2021.
What to take away
- The band and the trigger are separate tests. Under 13 with "directed to children" is not the same rule as under 18 with "likely to be accessed".
- Passing is not commencement. California's AB 2273 was signed in 2022 and has still not taken effect.
- GDPR Article 8 sets the consent age at 16 and lets member states choose anything from 13 upward.
- Check the in-force date against the regulator's current text before you build to it.
The regimes that cover most products
Five instruments cover most of this for a US or Canadian operator serving a general audience.
| Instrument | Age band | Trigger | Status |
|---|---|---|---|
| FTC COPPA rule (US) | Under 13 | Directed to children, or actual knowledge of a user under 13 | In force since 2000, amended 2013 |
| ICO Children's Code (UK) | Under 18 | Service likely to be accessed by children | In force since 2 September 2021 |
| GDPR Article 8 (EU) | 16, or 13 to 15 where a member state lowers it | Consent-based processing by an information society service | Applying since 25 May 2018 |
| California AADC, AB 2273 | Under 18 | Service likely to be accessed by children | Court-paused, never in force |
| Online Safety Act children's codes (UK) | Under 18 | User-to-user and search services likely accessed by children | Codes published July 2025, duties phasing |
Contract terms form a layer of their own rather than a restatement of the statute: a service can promise a minimum age that no regulator requires.
The FTC sets out what consent requires in its answers on complying with COPPA. The ICO publishes Children's Code guidance and resources describing the standard of confidence it expects.
Read each row as four parts: band, trigger, obligation, and standard of confidence.
[figure 1]
Four parts of an age rule
- Who is protecteddefined age band
- What triggers the dutyscope test
- What is requiredcheck, default, consent
- To what standardeffort or method
When a rule takes effect
Passage and commencement are separate provisions. A statute can pass in one session and commence in stages, keyed to operator size. A court can pause part of it after commencement, and a later session can repeal it.
Four checks before you plan against a date:
- The date it passed, which is not the date it applies.
- The commencement provision, including any staged start.
- Any injunction, stay or repeal since commencement.
- The date you checked, recorded beside the source.
Run the checks before any date reaches a roadmap. Keeping each result dated is what makes the following round cheap.
The trigger decides scope, not the number
Two services can declare the same minimum age and land on opposite sides of one rule. One is built for adults, and teenagers arrive anyway. The other is plainly aimed at a mixed audience.
[figure 2]
Same threshold, different triggers
Adults-only service
- Actual knowledge
- Rarely in scope
- Likely access
- Often in scope
- Directed at band
- Usually out
- Offered in territory
- In scope
General-audience service
- Actual knowledge
- Only known minors
- Likely access
- Plainly in scope
- Directed at band
- Usually in
- Offered in territory
- In scope
"Directed to children" reaches the first service only if its design and marketing point that way. "Likely to be accessed" reaches the second on the facts alone. "Actual knowledge" reaches neither until a named user's age is known to you.
Example: California's Age-Appropriate Design Code
AB 2273, signed in September 2022, would have applied to services likely to be accessed by children under 18. It required a data impact assessment before launch and high privacy settings by default.
A federal court paused it in 2023, so no part of it currently binds a California operator. The text of AB 2273 shows the shape a US state code takes. Local detail is in Sacramento and the California code.
The threshold and the obligation were drafted together in 2022. The effective date never arrived.
What to fix before any date arrives
- Record who actually uses the product, and date the record. The trigger turns on facts only you hold.
- Name the age band you distinguish, and say why that band and not another.
- Describe what your check establishes, rather than what it feels like it establishes.
- Log what the check stores and for how long. Retention duties follow the check itself.
None of that homework is jurisdiction specific, and none of it waits on a commencement date. Keep the evidence, because a position without it is a hope. Plan the appeal path too, or a wrongly excluded adult becomes a support queue.
The value the check produces needs its own handling, which age as a data field covers in detail.
Common questions
Does our published minimum age settle the question?
No. A contractual minimum is one layer among several, and it says what your terms promise rather than which statute reaches you.
Can we apply the strictest rule everywhere and stop worrying?
Some operators do that for simplicity. Obligations can conflict rather than simply differ in strictness, so it is a business call rather than a legal answer.
A news report says a law applies from next January. Can we plan on it?
Check the commencement provision itself. Dates move, staged starts land on different operators at different times, and a challenge can change the effect.
