Contract trap · Privacy policy
Weak child age gate
The service disclaims collecting data from children ('we do not knowingly collect from under 13') while relying on self-declared age, no parental consent and retention of children's voice or location data; profiles, posts, contact details, activity or location are visible to everyone and indexed by search engines by default, or consent to «распространение» is bundled with registration.
- Severity
- Serious
- How often it turns up
- Regular
- Holds up?
- Often void
- Clause phrases
- 22
What it looks like in a contract
Redline matches these phrases against your document verbatim. Drafters rarely invent new wording — they copy it, which is why the same sentences turn up across unrelated contracts.
In English-language contracts
- we do not knowingly collect personal information from children under 13
- by using the Service you represent that you are at least 18
- users under 18 may use the Service only with parental consent
- parents may contact us to review or delete
- we may collect voice recordings
- accounts of users under 16 are public
- your profile is public by default
- visible to everyone, including people who do not have an account
- may be indexed by search engines
- discoverable by phone number or email
- other users can see your location
In Russian-language contracts
- Оператор не осуществляет обработку персональных данных несовершеннолетних
- Пользователь подтверждает, что достиг 18 лет
- с согласия законного представителя
- лица, не достигшие 14 лет
- Сервис не предназначен для лиц младше
- профиль является общедоступным по умолчанию
- персональные данные, разрешённые субъектом для распространения
- доступны неограниченному кругу лиц
- могут индексироваться поисковыми системами
- Пользователь разрешает распространение персональных данных
- поиск по номеру телефона
Check your own contract
Paste a clause, a page or the whole document. Nothing leaves your browser: the matching runs here, on this page, against the phrases above.
Why it bites
Children's data is collected and monetised anyway and parents cannot get it deleted; children's and adults' data is exposed to strangers, scrapers and facial-recognition firms while 'you could have changed the setting' is used as a defence; regulators impose the largest fixed penalties here, but only after harm.
Is it enforceable where you are
The same clause can be routine in one country and void in another. What follows is what the law says where you are — not advice on your particular contract.
In the EU and the UK, the GDPR governs the legal basis, the retention period and your right to erasure; in the US, state privacy laws (CCPA/CPRA and its successors) give an opt-out of sale and sharing.
United States
COPPA: verifiable parental consent for under-13 data; 2025 Rule amendments (FTC, 16 Jan 2025) require separate parental consent for third-party disclosure/targeted ads and written retention limits; penalties: Epic $275M (2022, plus default-on chat exposing children), YouTube $170M (2019), Amazon Alexa $25M (2023), Musical.ly $5.7M (2019); FTC uses unfairness for dangerous defaults involving minors.
- Cited
- COPPA
- FTC
European Union
GDPR Art 8 (parental consent under 16, Member States 13-16) and Art 25(2) data protection by default; DPC fined TikTok €345M (2023) and Meta €405M (2022) for public-by-default child and teen accounts.
- Cited
- GDPR Art 8
United Kingdom
UK GDPR Art 8 (age 13) and Art 25; ICO Age Appropriate Design Code (high-privacy defaults, geolocation off); ICO fined TikTok £12.7M (Apr 2023) for under-13 processing without parental consent; Online Safety Act 2023.
- Cited
- GDPR Art 8
- ICO
- Online Safety Act 2023
Russia
152-ФЗ has no separate child regime; under ГК ст. 28 consent for children under 14 is given by legal representatives, 14-18 with nuances; ст. 10.1 152-ФЗ (с 1 марта 2021): согласие на распространение оформляется отдельно, молчание не считается согласием, субъект может устанавливать запреты и требовать прекращения распространения; Roskomnadzor treats processing of minors' data without the representative's consent as a ст. 13.11 violation.
- Cited
- 152-ФЗ
- ГК ст. 28
- ст. 10.1
- ст. 13.11
Where this has actually happened
Regulator actions, court rulings and the contracts they were fought over.
- FTC v. Epic Games (Dec 2022) — $275M COPPA penalty; default-on chat exposing children to strangers
- FTC v. Google/YouTube (Sept 2019) — $170M COPPA; FTC/DOJ v. Amazon Alexa (May 2023) — $25M, children's voice and geolocation data retained indefinitely
- DPC v. TikTok (Sept 2023) — €345M, child accounts public by default; DPC v. Meta/Instagram (Sept 2022) — €405M over teen business accounts publishing contact details
- ICO v. TikTok (Apr 2023) — £12.7M for under-13 users
- Strava Global Heatmap (Jan 2018) — public-by-default activity data exposed military bases
- FTC COPPA Rule amendments finalized 16 Jan 2025
What to do
In order, from the thing that takes a minute to the thing that takes a letter.
- Use family/child accounts and set profiles private immediately
- Check 'searchable by phone/email' and 'discoverable' toggles
- Request deletion under COPPA/GDPR/152-ФЗ and keep the response
- RU: only a separate consent under ст. 10.1 152-ФЗ allows public distribution — demand removal if none was given
- Report to the FTC/ICO/DPC/РКН
- Businesses: obtain verifiable parental consent and set private defaults.
Traps that travel with it
Drafters who use one of these usually use several.