99% of Kids' Apps Fail Consent: Child Privacy 2026

99% of child-directed apps on the U.S. Apple App Store and Google Play failed to obtain verifiable parental consent, according to Pixalate's Q2 2025 Verifiable Parental Consent Failures report, published in September 2025. Pixalate's legal and data science teams manually reviewed 1,149 likely child-directed apps out of nearly 134,000 apps carrying ads, and found 1,136 of them out of compliance with the Children's Online Privacy Protection Act. That failure rate sits against a backdrop of new FTC rule amendments and a record-setting run of enforcement penalties, both covered below.

What percentage of children's apps violate COPPA?

99% of the 1,149 likely child-directed apps Pixalate reviewed lacked verifiable parental consent (VPC), the mechanism COPPA requires before an app can collect personal information from a child under 13. Of the noncompliant apps, a meaningful share also shared identifying data in the real-time advertising bidstream, the automated auction that decides which ad a user sees.

Figure 1: Nearly half of reviewed child-directed apps exposed identifying signals in the ad auction. Source: Pixalate, Q2 2025 Verifiable Parental Consent Failures in Mobile Apps Report.

Pixalate's methodology combines automated classification with manual review by its Trust & Safety Advisory Board, and the firm has run this VPC audit as a recurring quarterly series since 2022, which makes the 99% figure a consistent trend rather than a one-off snapshot. A companion Q2 2025 report from the same firm found 253 EU- and UK-registered apps likely violating GDPR-K and the UK Children's Code, showing the compliance gap is not limited to the U.S. market. Any site or app collecting information from users under 13 should treat consent as the first thing regulators check, and a privacy policy generator built around COPPA disclosures is the fastest way to confirm the required notices are in place before an audit finds the gap first.

How much has the FTC fined companies for violating children's privacy?

The FTC's largest COPPA-specific civil penalty is $275 million, issued against Epic Games in December 2022 for collecting personal data from Fortnite players under 13 without parental notice or consent. That penalty was part of a larger $520 million total settlement, with the remaining $245 million covering separate dark-patterns allegations unrelated to COPPA.

Figure 2: COPPA-specific civil penalties have grown roughly fiftyfold since the first landmark case. Source: FTC press releases and consent decrees, 2019 to 2026.

Before Epic Games, the record was Google and YouTube's $170 million settlement in September 2019 over allegations that YouTube collected persistent identifiers from viewers of child-directed channels without parental consent, then used that data to serve targeted ads. TikTok's predecessor, Musical.ly, paid $5.7 million in February 2019, the first COPPA penalty to break the million-dollar mark. Most recently, NGL Labs agreed to pay $500,000 in civil penalties plus $4.5 million in consumer redress after the FTC found the anonymous messaging app marketed to minors without age verification or parental consent, and the FTC's order banned NGL from hosting users under 18 entirely, the agency's first outright ban of its kind.

Figure 3: Six years of escalating penalties and a new compliance deadline. Source: FTC press releases and Federal Register, 2019 to 2026.

Penalty size is not the whole story. Enforcement has also grown broader, covering AI chatbot apps, anonymous messaging platforms, and ad-tech data sharing, not just the largest social platforms.

What changed under the 2025 COPPA Rule amendments?

The FTC published final amendments to the COPPA Rule in the Federal Register on April 22, 2025, with the amendments taking effect June 23, 2025 and a full compliance deadline of April 22, 2026. The changes expand what counts as regulated "personal information" from children, require separate parental consent before sharing a child's data with third parties, and add more specific data security requirements for any operator covered by the rule.

Figure 4: The added consent-for-sharing step under the 2025 COPPA Rule amendments. Source: Federal Register, "Children's Online Privacy Protection Rule," published April 22, 2025.

Operators that rely on FTC-approved COPPA safe harbor programs, rather than direct FTC oversight, may face different internal deadlines set by their safe harbor provider, but the April 22, 2026 date is the outer compliance boundary the FTC itself will enforce against.

How many children already have their own devices and accounts?

51% of children age 8 and younger already have their own tablet or cellphone, according to Common Sense Media's 2025 Census of Media Use by Kids Zero to Eight, published in February 2025 from a nationally representative survey. Device ownership starts remarkably early: 40% of 2-year-olds already have their own tablet, rising to 58% by age 4.

Figure 5: Personal device ownership climbs sharply before children reach COPPA's age-13 threshold. Source: Common Sense Media, 2025 Census: Media Use by Kids Zero to Eight.

Older children move even faster toward independent device use. Common Sense Media's broader tracking shows 42% of kids have their own phone by age 10, 71% by age 12, and 91% by age 14, meaning the vast majority of children carry a personal, internet-connected device well before most COPPA-relevant consent flows would apply based on stated age alone. Pew Research Center's December 2025 report, "Teens, Social Media and AI Chatbots 2025," surveyed 1,458 U.S. teens ages 13 to 17 and found more than 90% use at least one social media platform, with YouTube reaching roughly nine in ten teens and TikTok and Instagram each used by six in ten or more.

Data point	Figure	Source and year
Child-directed apps failing verifiable parental consent	99% of 1,149 apps reviewed	Pixalate, Q2 2025
Children age 8 and under who own a personal device	51%	Common Sense Media, 2025
Teens ages 13 to 17 using at least one social platform	Over 90%	Pew Research Center, Dec 2025
Largest COPPA-specific FTC civil penalty	$275 million (Epic Games)	FTC, 2022

The Bottom Line

The compliance gap in children's online privacy is not a niche problem confined to a handful of bad actors. Pixalate's 99% verifiable-parental-consent failure rate, drawn from a broad, methodologically consistent quarterly review, shows that near-universal noncompliance is the norm among apps likely directed at children, not the exception. At the same time, device ownership keeps arriving earlier, with half of children age 8 and under already carrying a personal tablet or phone, and FTC penalties keep climbing, from $5.7 million in 2019 to $275 million in 2022. With the amended COPPA Rule's compliance deadline landing April 22, 2026 and adding a separate consent requirement before sharing a child's data with third parties, any site or app that might reach an under-13 audience should treat its consent flow and privacy disclosures as due for a review now rather than after an audit finds the gap.

Frequently Asked Questions

What percentage of children's apps violate COPPA? 99% of likely child-directed apps on the U.S. Apple App Store and Google Play failed to obtain verifiable parental consent, according to Pixalate's Q2 2025 Verifiable Parental Consent Failures report, which manually reviewed 1,149 apps and found 1,136 out of compliance.

What is the largest COPPA fine ever issued? The FTC's $275 million civil penalty against Epic Games in December 2022 is the largest COPPA-specific penalty on record, part of a $520 million total settlement that also covered dark-patterns charges unrelated to COPPA.

At what age can children legally use most social media platforms? Most major platforms set their minimum account age at 13, matching the age threshold set by COPPA in 1998, though Pew Research Center's December 2025 report found that over 90% of U.S. teens ages 13 to 17 already use at least one social media app by the time they are legally permitted to.

By what age do most children have their own mobile device? 51% of children age 8 and younger already have their own tablet or cellphone, according to Common Sense Media's 2025 Census, rising from 40% owning a tablet by age 2 to 58% by age 4.

Where the Numbers Come From

1. Pixalate. (2025). "Verifiable Parental Consent (VPC) Failures in Mobile Apps Report, Q2 2025." 1,136 of 1,149 manually reviewed likely child-directed apps lacked VPC, published September 30, 2025.
2. Federal Trade Commission. (2022). "Fortnite Video Game Maker Epic Games to Pay $520 Million to Resolve FTC Allegations It Violated Children's Privacy Law and Duped Users into Making Unwanted Charges." $275 million COPPA-specific civil penalty, announced December 19, 2022.
3. Federal Trade Commission. (2019). "Google and YouTube Will Pay $170 Million for Alleged Violations of Children's Privacy Law." Announced September 4, 2019.
4. Federal Trade Commission. (2019). "Largest FTC COPPA Settlement Requires Musical.ly to Change Its Tune." $5.7 million penalty, announced February 27, 2019.
5. Federal Trade Commission. (2024). "FTC Order Will Ban NGL Labs and Its Founders from Offering Anonymous Messaging Apps to Kids Under 18." $500,000 civil penalty plus $4.5 million in consumer redress, announced July 9, 2024; refund claims process announced January 2026.
6. Federal Register. (2025). "Children's Online Privacy Protection Rule." Final amendments published April 22, 2025, effective June 23, 2025, compliance deadline April 22, 2026.
7. Common Sense Media. (2025). "The 2025 Common Sense Census: Media Use by Kids Zero to Eight." Nationally representative survey published February 2025.
8. Pew Research Center. (2025). "Teens, Social Media and AI Chatbots 2025." Survey of 1,458 U.S. teens ages 13 to 17, conducted September 25 to October 9, 2025, published December 9, 2025.

Note: All figures verified as of July 2026. The NGL Labs settlement's consumer refund claims process was still active as of January 2026 and figures may be updated once final distribution amounts are confirmed. Children's privacy statistics are refreshed at least twice a year to track new Pixalate quarterly reports and FTC enforcement actions.