The scale of the U18 audience explains why regulation has moved so fast: 1 in 3 internet users worldwide is under 18, more than 175,000 children go online for the first time every day, and more than 85% of children and teens in Latin America already have access to a smartphone. Today, more than 800 million minors are covered by specific online privacy laws.
Can you advertise to audiences under 18?
Yes, none of the regulations currently in force in the United States, Europe, or Brazil prohibit directing advertising at children or teens. What they restrict is the handling of the minor's personal data: profiling them, tracking them across sites, or collecting information without verified parental consent. The right question for a brand isn't "can we advertise to this audience?" but "how do we segment it without their personal data?"
What is COPPA and what does it mean for a campaign in the United States?
The Children's Online Privacy Protection Act regulates the collection of data from children up to age 13 on sites, apps, and connected devices in the United States, with extraterritorial reach: any company headquartered in the U.S. must comply with it in any country where it operates.
- Restricted: user profiles, behavioral targeting, retargeting, social media plugins, any DMP, profile-based programmatic buying.
- Allowed: contextual advertising, content personalization (not user personalization), domain-level frequency capping, site analytics, and profile-free programmatic buying.
For a sense of the scale of the risk: historic COPPA fines have reached US$170 million. The industry's most recognized compliance backing is the kidSAFE Seal certification under the FTC Safe Harbor program.
What is GDPR-K and what does it mean for a campaign in Europe?
Europe's GDPR includes specific provisions for minors known as GDPR-K (Article 8). The default consent age cutoff is 16, although each member state can lower it to a minimum of 13, which is why the real range varies between countries and doesn't reach 18 as in other frameworks.
A key difference from COPPA: GDPR-K doesn't recognize the concept of a "mixed audience." Any digital property accessible to minors can be considered a service directed at minors, which requires clearly segmenting that audience instead of assuming it's enough not to be designed "for children."
That these rules apply in practice is confirmed by enforcement already carried out: Ireland's regulator (DPC) fined Instagram €405 million in 2022 for exposing minors' data, and TikTok €345 million in 2023 over the default settings on minors' accounts, both under GDPR.
What is LGPD and what does it mean for a campaign in Brazil?
The Lei Geral de Proteção de Dados (in force since 2020) requires, under Article 14, specific and highlighted consent from at least one parent or legal guardian to process data belonging to children or teens (up to age 18, by reference to the ECA). The controller must make reasonable efforts to verify that this consent was given by a responsible adult, not self-declared by the minor.
A point that often causes confusion: LGPD doesn't prohibit contextual segmentation without personal data; the problem is specifically collecting or processing personal data without that verified consent. Penalties can reach 2% of the company's annual revenue in Brazil, capped at R$50 million per infraction.
What is ECA Digital and how is it different from LGPD?
ECA Digital (Law No. 15,211/25) was signed into law in September 2025 and has been in force since March 17, 2026, regulated by Decree No. 12,880. It's the newest and most specific law in the region. It's the first law in the Americas to set financial penalties directly enforceable against digital platforms for the protection of minors. It doesn't replace LGPD, but rather extends those protections to the digital environment and applies to any digital product or service accessible to minors, whether or not it was designed for them (the "probable access principle").
- Prohibits: behavioral tracking and individual profiling of minors for advertising purposes, monetizing content that sexualizes minors, and self-declared age as the sole verification mechanism.
- Requires: reliable age verification, maximum privacy settings by default for U18 users, removing design mechanics that encourage compulsive use (infinite scroll, autoplay, loot boxes), parental supervision tools, prior judicial authorization to use a minor's image in sponsored content, and biannual reports to the ANPD for platforms with more than 1 million U18 users in Brazil.
- Liability: a brand that runs U18 advertising through a non-compliant provider isn't shielded by that provider's non-compliance.
Learn more about ECA Digital and download an exclusive guide at: kidscorp.digital/eca-digital
Does U18 data protection exist only in the United States, Europe, and Brazil?
No. It's a global regulatory trend, although these three frameworks are the most relevant for business today. China protects children under 14 and requires "zero-data" ecosystems; India, with its data protection law (the DPDP Act), protects up to age 18 and prohibits targeted advertising and profiling; South Korea also sets the threshold at 14. In Europe, beyond GDPR, the UK added the Age Appropriate Design Code, focused on design for minors. In the Americas, Puerto Rico passed a law in 2024 that protects up to age 18 and expands what COPPA covers. The details change from country to country, but the conclusion doesn't: protecting U18 audiences is a global direction, not a regional exception.
What's the difference between a brand-safe environment and a brand-suitable one?
They're two different layers, and both matter. Brand-safe means the environment is safe for a U18 audience: no violent, sexual, or inappropriate content, with real age verification. Brand-suitable goes a step further: that environment, in addition to being safe, is aligned with the brand's specific values. An environment can be perfectly safe for a minor and still not be the right place for a particular brand. Choosing environments that meet both conditions, not just the first, is what separates a campaign that's merely compliant from one that also builds the brand.
In summary, COPPA, GDPR-K, LGPD, and ECA Digital share the same principle: it isn't prohibited to advertise to a minor, it's prohibited to profile them or collect their personal data without verified parental consent. A platform designed from the ground up around contextual segmentation and consented, declarative data. Instead of adding compliance as an afterthought layer, it solves these four regulations at once, without needing a different architecture for each market.
To learn more about Kidscorp's compliance architecture, you can visit kidscorp.digital/compliance