# Marketing to kids and vulnerable audiences without crossing the line
In 2019, the FTC fined Google and YouTube $170 million for collecting personal data from children watching toy-review and nursery-rhyme channels without parental consent, then using that data to serve targeted ads. The channels were rated "made for kids" in name only. Nobody had checked.
That gap between what a platform labels content and what it actually does with audience data is where most kids-marketing violations live. This lesson shows you how to close it before launch, not after a regulator finds it.
Kids and other vulnerable audiences (people with cognitive impairments, problem gamblers, financially distressed consumers) get special protection because standard "reasonable consumer" tests do not apply to them. Regulators assume they cannot fully evaluate persuasion, risk, or data trade-offs the way an adult can.
That assumption changes your obligations in three concrete ways:
European Union: GDPR (General Data Protection Regulation) Article 8 sets the digital consent age at 16, though member states can lower it to 13 (the UK, post-Brexit, uses its own UK GDPR with an Age Appropriate Design Code, sometimes called the "Children's Code," enforced by the ICO, Information Commissioner's Office). The Code requires "high privacy by default" settings for any service likely to be accessed by under-18s, not just child-specific apps.
EU Digital Services Act (DSA): bans targeted advertising to minors based on profiling, full stop, for platforms operating in the EU. This is stricter than COPPA and applies regardless of the platform's stated audience.
UK Gambling Act and CAP Code (Committee of Advertising Practice, which writes the UK Advertising Codes enforced by the ASA, Advertising Standards Authority): governs gambling-adjacent marketing, directly relevant to loot boxes (see below).
A loot box is a paid in-game item that grants randomized rewards, common in mobile and console games. Regulators have spent nearly a decade arguing about whether this is gambling.
Belgium and the Netherlands moved earliest, with Belgium's Gaming Commission ruling in 2018 that paid loot boxes with tradeable or resellable value constitute gambling under national law, forcing publishers like EA and Activision Blizzard to strip real-money loot box mechanics from Belgian versions of FIFA and Overwatch.
The UK stopped short of reclassifying loot boxes as gambling but in 2024 secured voluntary industry commitments (via DCMS, the Department for Culture, Media and Sport) requiring spending controls, price transparency before purchase, and age-appropriate design in games with loot boxes.
The US has no federal loot-box law, but the FTC has warned publishers that marketing loot boxes to children without disclosing odds may violate Section 5 of the FTC Act (unfair or deceptive practices). Several states have introduced (not yet passed) loot-box disclosure bills.
The marketing lesson: even where loot boxes are technically legal, promoting them to an audience skewing under-18, through influencer unboxing videos, in-app pop-ups timed to app opens, or ad placements on channels rated for children, creates regulatory exposure even without a gambling reclassification. The FTC and ASA both apply "unfair to vulnerable consumers" tests independent of gambling law.
Age-gating is the mechanism (a birthdate field, a "confirm you are 18" click) meant to stop underage users from reaching age-restricted content or ads. It fails constantly because it is usually cosmetic.
YouTube's 2019 FTC settlement happened because content classification (channel marked "made for kids") was disconnected from ad-serving logic (behavioral targeting ran anyway). The fix was not a better pop-up, it was making the content flag control the ad pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.Voir la définition complète → directly.
A parallel failure pattern shows up in alcohol and gambling marketing: a self-declared birthdate gate on a website is trivially bypassed (users just lie), yet regulators (ASA in the UK, EASA, the European Advertising Standards Alliance across the EU) still require it as a baseline, and treat its absence as an aggravating factor in enforcement, even though everyone knows it is imperfect. The standard is "reasonable steps," not "perfect prevention," but reasonable keeps rising: platforms are increasingly expected to pair the self-declared gate with behavioral signals (account age, declared interests) to catch obvious mismatches.
Before any campaign touching kids' content, gaming, or gambling-adjacent products goes live, check:
1. Content classification match: does the platform's or title's age rating (PEGI in Europe, ESRB in the US for games; TV Parental Guidelines or BBFC for video) match who your media buy actually targets?
2. Data flow audit: does your ad tech stack collect persistent identifiers (cookies, device IDs) from pages or apps flagged as child-directed? If yes, verifiable parental consent must exist first.
3. Influencer and UGC review: are creators disclosing sponsorship (required under FTC endorsement guides and ASA rules) and avoiding direct appeals to children ("pester power" advertising is restricted in the UK CAP Code)?
4. Odds and mechanics disclosure: for any loot box, gacha, or randomized-reward promotion, are odds disclosed pre-purchase, matching UK and emerging US state requirements?
5. Geofencing accuracy: does the campaign apply the strictest applicable rule by market (Belgium's loot-box stance, GDPR consent age by member state) rather than a single global default?
Vérification des acquis
1. The Google/YouTube enforcement action illustrates a compliance gap that companies should close before launch. What was the core failure?
2. Why do regulators apply different legal standards to marketing aimed at children versus the general 'reasonable consumer' standard?
3. A mobile game is rated for general audiences but a marketing team discovers, through engagement data, that a large share of active users are under 13. Under the logic described in the lesson, what does this trigger?
4. Select ALL correct answers about how marketing obligations change when the audience includes children or other vulnerable groups.
Sélectionnez toutes les réponses correctes.
5. Select ALL correct answers about who counts as a 'vulnerable audience' requiring special marketing protections, per the lesson's framing.
Sélectionnez toutes les réponses correctes.
Roblox and other kid-heavy platforms now run separate, non-behavioral ad systems for under-13 accounts, serving contextual ads (based on content, not user profiling) instead of targeted ones, precisely to stay inside COPPA and DSA limits. That is the operating model regulators are pushing the whole sector toward: classify first, then let classification gate the ad tech, not the reverse.
🎬 [VIDEO: "How COPPA Works and Why It Matters" - youtube.com - FTC-adjacent explainer on children's online privacy law and advertising restrictions, useful as a primer before auditing your own ad stack]