Kidtech is the category of advertising and engagement technology built for audiences below the age of digital consent, where the identifiers, profiles and behavioural signals the rest of the industry runs on are unlawful. It covers ad serving that carries no persistent identifier, verifiable parental consent systems, contextual classification of child-directed content, and creative review against age-appropriate standards.

The category exists because of a legal asymmetry rather than a technical one. Under the United States Children's Online Privacy Protection Act, known as COPPA, an operator of a child-directed service cannot collect personal information from a user under 13 without verifiable parental consent. Since 2013 persistent identifiers have counted as personal information. That reclassification removed cookies, mobile advertising IDs and device fingerprints from the toolkit for a large audience, and everything sold to it has had to be rebuilt on different foundations.

How the stack works

The signal comes first. In real-time bidding the relevant field is coppa, a flag inside the Regs object of the OpenRTB bid request, set to 1 by the publisher or the supply-side platform when the inventory is child-directed or the user is known to be under 13. A COPPA signalling proposal entered the specification with release candidate 1 of version 2.2, dated October 25, 2013; the version was finalised in April 2014. The flag is a declaration, not a detection: nothing verifies it.

Setting the flag is the start of the work rather than the end. Guidance published by the fraud detection firm Pixalate sets out what an exchange should strip once regs.coppa equals 1: suppress the hashed device identifiers didmd5 and didsha1, truncate the ip field by its lowest 8 bits and the ipv6 field by its lowest 32, suppress the lat and lon coordinates, drop metro, city and zip, and remove the user object's id, buyeruid, yob and gender attributes. What reaches the bidder is roughly an app bundle, a content category, a format and coarse location.

Publisher-side tagging follows a parallel logic. Google's ad request parameters carried two flags for years, tag for child-directed treatment and tag for users under the age of consent, abbreviated TFCD and TFUA. Both were replaced on May 18, 2026 by a single TFAT parameter adding a distinct teen tier, closing a gap in which publishers could choose only between child-directed treatment and no signal. On YouTube the equivalent control is the made for kids designation applied by the uploader, which switches off personalised advertising on the video.

With identifiers gone, targeting rests on content. A kidtech platform classifies inventory by what is on the screen rather than who is watching, then matches creative to that classification. Frequency management, sequencing and retargeting either disappear or move to session-level approximations. Attribution collapses to aggregate, because the join key between exposure and outcome was the identifier that has just been removed.

The second pillar is consent infrastructure. Where a service does want to collect data from a child, COPPA requires verifiable parental consent through methods the Federal Trade Commission recognises. Kids Web Services, launched by SuperAwesome in June 2015, packaged that process as a developer toolkit rather than a legal project. Epic Games retained it when the rest of SuperAwesome was sold back to management.

A third pillar is creative governance. Advertisements shown to children are reviewed before serving against category exclusions that go beyond ordinary brand safety, covering gambling, alcohol, dating, weight loss and cosmetic procedures. Google applies comparable restrictions to teenagers through its ad-serving protections for teens policy, consolidated in January 2025.

Where the category came from

COPPA was enacted in 1998 and the FTC's implementing rule took effect on April 21, 2000. For a decade it was read mainly as a restriction on names, addresses and email. The amended rule published on January 17, 2013, effective that July, changed the commercial meaning by treating persistent identifiers as personal information in their own right.

SuperAwesome was founded in 2013 by the Irish entrepreneur Dylan Collins, and is generally credited with naming the sector. Speaking to PocketGamer.biz in April 2018, Collins said the firm had "essentially invented the kidtech category". The claim to authorship is stronger than the claim to novelty: children's advertising networks existed before, but framing compliance as an infrastructure product rather than a legal constraint was new.

Europe supplied the second driver. Article 8 of the General Data Protection Regulation, applicable from May 2018, set an age of digital consent that member states may fix anywhere between 13 and 16, creating a moving threshold that no single technical configuration satisfies. The industry shorthand for the resulting requirements, GDPR-K, came from the same company.

Consolidation followed the regulation. Epic Games acquired SuperAwesome in 2020; the company had raised more than $37 million and was valued above $100 million after a 2018 round backed by Microsoft's M12. Management bought most of the business back in a deal announced in September 2023 and closed on January 17, 2024, with Epic retaining Kids Web Services and remaining an investor. The independent company then acquired the children's audio network Starglow Media in January 2026 and added the podcast Wow in the World to its network on May 2, 2026.

Why it matters commercially

The audience is large and the addressable share of it is small, which is the whole commercial proposition. The amended COPPA rule that took effect on June 23, 2025 added a separate consent requirement for disclosing children's data to third parties, a change aimed squarely at the seamless data passing that ordinary programmatic depends on. Full compliance was required by April 22, 2026, the same date YouTube published its audience-setting guidance.

Roblox illustrates the scale involved. Through January 31, 2026, 45% of the platform's 144 million daily active users had completed age verification; of those, 35% were under 13, 38% were aged 13 to 17 and 27% were over 18. The under-13 tier had been withheld from advertisers entirely. On June 4, 2026 Roblox named SuperAwesome its sole third-party partner for contextual advertising to that group worldwide, covering video billboards, branded portals, homepage ads and sponsored tiles. There is no programmatic route: the arrangements with Magnite, PubMatic and Google remain restricted to users aged 13 and above.

The measurement penalty is quantifiable. A study from the Coalition for Innovative Media Measurement found that poor children's audience data wastes $590,000 of every $1 million spent, with presence-of-children data proving correct only 42% of the time, and noted that YouTube supplies demographic reporting only for users aged 13 and over.

Limitations and disputes

The most persistent criticism is that kidtech legitimises what should not exist. Advocacy organisations including Fairplay argue that advertising to children is objectionable regardless of the data used, and the FTC's own staff perspective on stealth advertising, published in 2023, catalogued research finding that children frequently fail to recognise disclosures at all. Compliant delivery does not resolve comprehension.

A second dispute concerns the age assurance paradox. Determining that a user is a child usually requires processing data about that user, which is the activity the law restricts. The FTC addressed the tension on February 25, 2026 with a policy statement granting conditional enforcement forbearance where collection serves age determination alone. A New Mexico court reached a different conclusion in August 2026, holding that COPPA prevented it from ordering Meta to request or passively gather age data from children, and noting that a policy statement creates no substantive rights.

Third, the flag is only as good as the declaration behind it. Disney paid $10 million in September 2025 over child-directed videos that were not labelled as such, and the FTC's case against the robot toy maker Apitor turned on a third-party software development kit collecting location data inside a children's app, which no amount of correct flagging upstream would have prevented.

Finally, compliance complexity favours single vendors over open marketplaces, and the Roblox appointment produced exactly that outcome. Whether the resulting infrastructure functions as a protection or a competitive moat is unresolved.

Not the same as

Age assurance is the broader discipline of establishing how old a user is, covering document checks, facial estimation and self-declaration. Age assurance determines who the user is; kidtech determines what may be shown once that answer is known.

Made for kids is a single binary designation inside one platform, applied per video and per channel on YouTube. It is one input to kidtech, not a synonym for it.

Edtech serves classroom instruction and school procurement. The overlap is regulatory, since both touch children's data, but the buyer and the revenue source differ entirely.

Parental controls restrict what a child can reach. Kidtech governs what a commercial system may collect and serve. A device with strict controls can still transmit an unflagged bid request.

Recent developments

Enforcement has escalated faster than the technology. The Department of Justice disclosed a $400 million settlement with TikTok on August 21, 2026 and simultaneously moved to vacate the 2019 consent decree covering Musical.ly, with a hearing set for September 21, 2026. The Commission had already named children's privacy an institutional priority through 2030.

Europe is moving on a separate track. Article 28(2) of the Digital Services Act prohibits profiling-based advertising where a provider knows with reasonable certainty that the recipient is a minor, and the European Data Protection Board's Guidelines 3/2025, adopted on September 11, 2025, advised providers not to store an estimated age at all but to record only qualification status. The Commission has recommended member state deployment of age verification apps by 31 December 2026 without making them mandatory, and opened preliminary findings against Meta over under-13 age assurance on April 29, 2026.

Timeline

  • 1998: The United States Congress enacts the Children's Online Privacy Protection Act
  • April 21, 2000: The FTC's original COPPA Rule takes effect
  • January 17, 2013: The FTC publishes an amended COPPA Rule treating persistent identifiers as personal information, effective July 1, 2013
  • October 25, 2013: A COPPA signalling proposal enters OpenRTB release candidate 1 of version 2.2
  • 2013: SuperAwesome is founded in London by Dylan Collins
  • April 2014: OpenRTB 2.2 is finalised with the coppa flag in the Regs object
  • June 2015: Kids Web Services launches as a parental consent toolkit
  • May 25, 2018: GDPR becomes applicable, with Article 8 setting an age of digital consent between 13 and 16
  • September 2020: Epic Games acquires SuperAwesome
  • January 17, 2024: SuperAwesome management completes its buyout, with Epic retaining Kids Web Services
  • June 23, 2025: The amended COPPA rule takes effect, adding separate consent for third-party disclosure
  • July 14, 2025: The European Commission issues Article 28 guidelines on the protection of minors
  • September 2, 2025: Disney agrees to a $10 million COPPA settlement over YouTube labelling
  • September 11, 2025: The EDPB adopts Guidelines 3/2025 on the DSA and GDPR interplay
  • January 2026: SuperAwesome acquires Starglow Media
  • February 25, 2026: The FTC issues its COPPA policy statement on age verification technology
  • April 22, 2026: The compliance deadline for the amended COPPA rule falls
  • May 18, 2026: Google replaces TFCD and TFUA with the TFAT parameter
  • June 4, 2026: Roblox names SuperAwesome its sole under-13 contextual advertising partner
  • August 21, 2026: The Department of Justice discloses a $400 million TikTok settlement

Summary

Who. Specialist vendors such as SuperAwesome, Kids Web Services and their competitors build the tooling; publishers of children's content and platforms including Roblox and YouTube deploy it; toy, entertainment, food and games advertisers buy against it; the FTC, the European Commission and national data protection authorities set the constraints.

What. Kidtech is the stack of ad serving, consent, contextual classification and creative review that allows commercial activity around under-13 audiences without collecting persistent identifiers or building behavioural profiles.

When. The category took shape after the 2013 COPPA amendment reclassified persistent identifiers as personal information, was named by SuperAwesome from around 2015, and expanded again after the amended COPPA rule of 2025 and the Digital Services Act's advertising restrictions.

Where. It operates wherever child-directed inventory exists: mobile games and apps, gaming platforms, children's video, connected television, and increasingly children's audio, with the strictest requirements in the United States and the European Union.

Why. Children are a large audience that ordinary programmatic infrastructure cannot lawfully address, so a parallel set of systems carries the transaction. The economics are shaped less by targeting precision than by the cost of proving compliance.