Privacy Compliance for Kids' AI Devices: COPPA, GDPR and the EU AI Act Explained for Brands

AI drawing printers, talking companions and smart learning clocks are some of the fastest-growing kids' tech categories. Parents like them because they are creative and screen-light. Regulators watch them closely for a different reason: they listen to children, send data to the cloud and generate content with AI.

This guide gives brand owners, importers and retailers a practical overview of the main privacy rules that apply to kids' AI devices in the US, EU and UK, and turns them into product and documentation decisions. It is general information, not legal advice. Privacy law changes often, so work with a qualified privacy lawyer for your specific product and markets.

1. What data a kids' AI device actually processes

Data	Example	Why it matters
Voice recordings	"Draw a dinosaur on the moon"	A child's voice is personal information under COPPA and can be personal data under GDPR
Transcripts and prompts	Text produced by speech recognition	May contain names, places or other personal details
Photos and camera input	Camera modes that turn photos into coloring pages	Images of children are especially sensitive
Generated content	AI images, stories, chat replies	Linked to the child's account and history
Device and account data	Device ID, parent's email, Wi-Fi details, usage logs	Persistent identifiers count as personal information
Biometric-type data	Voiceprints if used for recognition	Treated as highly sensitive in many laws

Start every project by drawing a simple data map: what is collected, where it goes (device, app, cloud, AI model provider), how long it stays, and who can access it. Most compliance decisions follow from that map. For the technical background of the voice-to-image pipeline, see how AI drawing printers work.

2. United States: the amended COPPA Rule

The Children's Online Privacy Protection Act (COPPA) applies to online services, including connected toys and apps, that are directed to children under 13 or that knowingly collect their personal information. The FTC finalized amendments to the COPPA Rule in 2025, and companies have had to comply since 22 April 2026.

Core requirements include:

• Clear notice to parents describing what is collected and how it is used.
• Verifiable parental consent before collecting children's personal information, with limited exceptions.
• Separate consent for disclosures to third parties, for example for targeted advertising, under the amended rule.
• Data retention limits: keep children's data only as long as reasonably necessary, under a written retention policy.
• Security: reasonable procedures, including a written information security program, to protect children's data.
• Parental rights: parents can review and delete their child's information and withdraw consent.

Violations can bring significant civil penalties per violation, and the FTC has pursued connected-toy and voice-assistant cases in the past. For brands, the practical message is clear: design the parent account, consent flow and deletion features before launch, not after a complaint.

3. EU and UK: GDPR and the Children's Code

In the EU, the General Data Protection Regulation (GDPR) applies whenever personal data of people in the EU is processed. Key points for kids' AI devices:

• Lawful basis and consent: where consent is used for online services offered directly to children, parental consent is needed below the national age threshold, which member states set between 13 and 16.
• Data minimization and purpose limitation: collect only what the feature needs, and do not reuse it for unrelated purposes such as model training without a proper basis.
• Privacy by design and default: the most protective settings should be the default.
• Data protection impact assessment (DPIA): processing children's data with new technology often calls for one.
• International transfers: if cloud or AI services process data outside the EU, a valid transfer mechanism is needed.

The UK applies its own version of GDPR plus the Age Appropriate Design Code (Children's Code), whose standards cover default settings, data minimization, geolocation, parental controls and "nudge" techniques for services likely to be used by children.

4. The EU AI Act and other EU digital rules

The EU AI Act is being phased in. The parts most relevant to kids' AI consumer devices:

• Prohibited practices (since February 2025): AI that exploits vulnerabilities due to age to materially distort behavior in harmful ways is banned. Design companion and chat features carefully: no manipulative engagement tactics aimed at children.
• Transparency (from August 2026): people must be told when they interact with an AI system such as a chatbot, and AI-generated content must be identifiable. For kids' products, explain this to parents in the app and manual, and in age-appropriate language on the device.
• High-risk rules: AI used as a safety component of products such as toys can fall under the high-risk regime. A 2026 amendment package (the "Digital Omnibus") agreed to postpone high-risk deadlines. Check the final published dates with your advisers.

Two further EU rules affect connected kids' products: the Radio Equipment Directive cybersecurity requirements, which have applied to internet-connected radio equipment since August 2025, and the Cyber Resilience Act, which phases in security and vulnerability-handling obligations for connected products over the coming years. See our certification guide for the radio side.

5. Privacy by design: product decisions that matter

Decision	Privacy-friendly choice
Voice processing	Use audio only to create the request, then delete it quickly; do not keep raw recordings by default
Accounts	Parent-owned account; no child email or real name required
Advertising	No behavioral advertising in kids' products
Third parties	Share data only with essential processors under contract; no sale or sharing for ads
Model training	Do not use children's data to train AI models unless you have a clear legal basis and parental agreement
Retention	Short default retention for history; parents can delete everything in the app
Data location	Choose cloud regions that match your markets and transfer rules
Security	Encryption in transit and at rest, secure pairing, signed OTA firmware updates
Content safety	Input and output filters, blocked topics, parental controls and usage limits

6. Questions to ask your device and cloud suppliers

1. Which cloud platform and AI model providers process children's data, and in which regions?
2. Are voice recordings stored? For how long? Can storage be switched off?
3. Is any data used to train models? Can that be contractually excluded?
4. What parental controls exist: history view, deletion, time limits, content levels?
5. How is the device paired and authenticated? How are firmware updates signed and delivered?
6. How are security vulnerabilities reported and fixed, and for how long will updates be provided?
7. Can you sign a data processing agreement and support our DPIA with technical documentation?
8. Can the app, privacy screens and consent flow carry our brand and language?

Our Q9 global AI printer connects through an international cloud platform, and in OEM and ODM projects we discuss cloud region, retention settings and parental-control features with each brand. Ask for the technical documentation when you request a quote.

7. Documents a brand should have before launch

• Privacy notice written for parents, specific to the device and app.
• Parental consent flow designed to meet COPPA and GDPR requirements in your markets.
• Data map and retention schedule.
• DPIA for EU/UK launches.
• Processor contracts (data processing agreements) with cloud, AI and analytics providers.
• Written security program and incident-response plan.
• AI transparency text for the app, packaging and manual.

8. Marketing claims: be careful

Claims such as "100% safe", "no data collected" or "fully private" are easy to write and hard to defend. Regulators and marketplaces compare claims with how the product actually works. Describe concrete features instead: "voice requests are deleted after processing", "parents can delete history anytime", "no ads". Make sure every claim matches the data map and the supplier's documentation.

9. A practical compliance timeline

Stage	Privacy tasks
Concept	Choose features, data map, target markets, legal review
Development	Consent flow, parental dashboard, retention settings, security design
Pre-launch	Privacy notice, DPIA, processor contracts, penetration testing, AI transparency texts
Launch	Customer-service scripts for privacy questions; deletion requests process
After launch	Security updates, periodic review when laws or suppliers change

Privacy work runs in parallel with product safety testing. For toy safety, batteries and thermal paper, see our kids' electronics compliance guide. Browse our AI smart device range for products available for OEM projects.

Frequently asked questions

Does COPPA apply to AI toys and kids' AI printers?

Yes, if the device or its app is an online service directed to children under 13, or if the company knows it collects personal information from such children. Voice recordings, photos and persistent identifiers all count as personal information.

When did the amended COPPA Rule take effect?

The FTC finalized the amendments in 2025, and companies have had to comply since 22 April 2026. The changes include separate parental consent for certain third-party disclosures, stricter data retention rules and security program requirements.

What age needs parental consent under GDPR?

For online services offered directly to children that rely on consent, the default threshold is 16, but EU member states may lower it to as low as 13. Check the rule in each country where you sell.

Does the EU AI Act affect kids' AI devices?

Yes. Practices that exploit children's vulnerabilities are banned, and from August 2026 users must be informed when they interact with AI and AI-generated content must be identifiable. Some AI used in toys may also fall under high-risk rules, whose deadlines were postponed by a 2026 amendment package.

Can we use children's voice data to improve our AI?

Only with great care. Under COPPA and GDPR you need a clear legal basis, proper notice and parental consent, and you must respect data minimization and retention limits. Many brands choose not to use children's data for training at all.

Sources and further reading

Rules and dates change. These are the references we checked when updating this guide; confirm the current version before you act.

• Federal Register: Children's Online Privacy Protection Rule (final rule, 22 April 2025)
• White & Case: Unpacking the FTC's COPPA amendments
• Gibson Dunn: EU AI Act Omnibus agreement, postponed high-risk deadlines and other key changes