Nintendo updated its privacy policy on April 8, 2026, making several notable changes including switching its child privacy certification from ESRB to CARU (Children's Advertising Review Unit), clarifying how long personal information is retained before being deleted or de-identified, and expanding details on location data use and what data is collected from child users. Parents can now also see a named list of third-party apps authorized to access their child's Nintendo Account. These changes generally improve transparency around children's data handling and data retention practices.
Parents now have named visibility into which third-party apps can access their child's Nintendo Account data, and Nintendo has added specific disclosures about what data is collected from children and for what purposes. The switch from ESRB to CARU as the children's privacy certifier changes which body audits Nintendo's compliance, which matters for ongoing child data protection assurances.
Nintendo has strengthened transparency around children's data by explicitly listing what persistent identifiers (like IP addresses and device IDs) are collected from child users and why, and switched its children's privacy certification program from ESRB to CARU. Parents now have greater visibility into which named third-party apps have been authorized to access their child's Nintendo Account, not just the ability to manage them. You can log into your Nintendo Account profile settings to review and manage which third-party games and applications are authorized to access your child's account information.
Nintendo has updated its privacy policy effective April 8, 2026, with three compliance-relevant changes: (1) it switched its children's privacy certification body from ESRB Privacy Certified to CARU Privacy Certified, which may affect how audits and accountability mechanisms are evaluated; (2) it added explicit disclosures about persistent identifier collection from child users for internal operational purposes, directly implicating COPPA compliance; and (3) it revised its data retention clause to specify deletion or de-identification after retention periods. Compliance officers with Nintendo in their vendor stack should confirm the CARU certification status is active and verify whether child-directed integrations need updated disclosures.
1. COPPA (15 U.S.C. §§ 6501–6506; 16 C.F.R. Part 312): The newly added language about collecting persistent identifiers (IP addresses, device identifiers, unique identifiers) from child users for internal operational purposes maps directly to the COPPA 'support for internal operations' exception under 16 C.F.R. § 31
Compliance intelligence locked
Obligation analysis, escalation trigger, board language, and recommended action.
Watcher: regulatory citations + obligations. Professional: full compliance memo.
ConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-000262.
ConductAtlas Policy Archive Entity: Nintendo | Document: Nintendo Privacy Policy | Record: CA-C-000262 Captured: 2026-04-08 06:05:53 UTC URL: https://conductatlas.com/change/2026-04-08-nintendo-nintendo-privacy-policy-262/ Accessed: April 19, 2026
Subscribe to Watcher for $9.99/mo to get email alerts the moment Nintendo updates their policies. Or try Professional free for 14 days.