Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy discloses that Nintendo and its service providers collect persistent identifiers (including IP addresses and device identifiers) from child users without parental consent, relying on the COPPA exception for internal operations support, which includes serving contextual advertising.
This analysis describes what Nintendo's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision relies on COPPA's internal operations exception to collect persistent identifiers from child users without parental consent; the inclusion of 'serving contextual advertising' within the listed permitted purposes is an area of active regulatory scrutiny under FTC COPPA guidance and warrants careful review.
Interpretive note: The permissibility of 'serving contextual advertising' as an internal operations purpose under COPPA's exception is subject to FTC interpretive guidance and enforcement discretion, which may limit or qualify the scope of this provision in practice.
Nintendo now explicitly discloses that it collects persistent identifiers (IP addresses, device IDs) from child users for operational, security, fraud prevention, and service improvement purposes, and states that contractual restrictions limit how service providers can use this data. Parents gain enhanced transparency by being able to view a named list of third-party games and applications authorized to access their child's account, rather than just managing access through settings. The policy also clarifies that location information may be used for check-ins at Nintendo locations and events in addition to location-based games. You can review and manage which third-party apps have access to your child's account through your Nintendo Account profile settings.
View change record →Nintendo now discloses that it uses location data not only for location-based games and friend connections, but also to enable check-ins at specific events and Nintendo locations, which is a new explicit use case. The policy now details how child user data including persistent identifiers like IP addresses and device IDs are collected and retained, with commitments to delete or de-identify data based on sensitivity and account activity. Parents can now see which third-party apps have been authorized to access their child's account before deciding whether to allow continued access, giving more visibility into connected applications.
View change record →The revised policy simplifies how Nintendo describes data retention, now stating information is retained only as long as reasonably necessary in accordance with applicable law, without prior detail about sensitivity-based retention practices. For child users, the policy no longer explicitly lists persistent identifiers (IP addresses, device identifiers) that Nintendo and service providers collect, removing specific disclosure language that previously detailed collection purposes for child accounts. The policy now indicates it collects error information from both users and devices, broadening the prior language focused on device errors only. The privacy certification body changed from CARU to ESRB, meaning independent audits and enforcement are now administered by the Entertainment Software Rating Board rather than the Children's Advertising Review Unit.
View change record →Under this clause, children under the applicable age threshold may have IP addresses, device identifiers, and other persistent identifiers collected by Nintendo and its service providers without parental consent, for purposes that include contextual advertising. Parents can withdraw consent or request deletion of child data by contacting Nintendo using the contact information in Section 9.
Cross-platform context
See how other platforms handle Children's Persistent Identifier Collection and similar clauses.
Compare across platforms →Monitoring
Nintendo has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"We do not knowingly collect, use or share information from children under a certain age without parental consent or as permitted by law (e.g., a 'child' is under the age of 13 in the United States, under the age of 14 in Quebec, etc.). However, please note that we collect, and we permit our service providers to collect, persistent identifiers, such as IP addresses, device identifiers and other unique identifiers from such child users, solely for purposes necessary to support the internal operations of our services, including maintaining or analyzing the functionality of the Nintendo services, protecting the security or integrity of the user or the Nintendo services, fraud prevention, service improvements and debugging, authenticating users of the website or online service, serving contextual advertising on the website or online service, fulfilling a request of a child, and ensuring legal or regulatory compliance.Excerpt from Nintendo's Privacy Policy
REGULATORY LANDSCAPE: This provision directly engages COPPA, enforced by the FTC, and equivalent provincial regulations in Canada (including Quebec's Act respecting the protection of personal information in the private sector). COPPA's internal operations exception permits collection of persistent identifiers from child users without verifiable parental consent for specified purposes; the FTC has provided guidance on the scope of this exception, and the inclusion of contextual advertising within permitted internal operations purposes has been subject to regulatory scrutiny. The CARU Privacy Certified Program also audits compliance with child-directed data practices. GOVERNANCE EXPOSURE: High. The inclusion of 'serving contextual advertising on the website or online service' within the list of permitted internal operations purposes for collecting child user persistent identifiers is an area where the boundary between permissible COPPA exceptions and advertising purposes has been actively examined by regulators. Compliance teams should confirm that contextual advertising practices for child users conform to current FTC COPPA guidance. JURISDICTION FLAGS: US-based child users are the primary affected population under COPPA. Quebec-specific age thresholds (under 14) are referenced. EU child users may have additional protections under GDPR and national implementing legislation, which are not addressed in this document. UK-specific child data protections under the UK GDPR and the Age Appropriate Design Code may also be relevant. CONTRACT AND VENDOR IMPLICATIONS: The policy states that 'contractual restrictions' are in place to ensure service providers use child user persistent identifiers only for the listed purposes. Procurement teams should confirm that vendor data processing agreements include explicit restrictions on child data use, prohibitions on secondary use, and audit rights consistent with COPPA requirements and FTC guidance. COMPLIANCE CONSIDERATIONS: Legal teams should review whether current contextual advertising practices for child users fall within the COPPA internal operations exception as interpreted by current FTC guidance, particularly given the FTC's 2022 policy statement on COPPA and EdTech. The list of permitted purposes in this provision should be mapped against actual data flows to confirm no expansion beyond stated internal operations uses. Parental consent withdrawal and data deletion procedures should be operationally tested for responsiveness.
Regulatory citations, enforcement risk, and due diligence action items.
Provision-level monitoring, governance timelines, and regulatory mapping built from archived source documents and historical version tracking.
This provision relies on COPPA's internal operations exception to collect persistent identifiers from child users without parental consent; the inclusion of 'serving contextual advertising' within the listed permitted purposes is an area of active regulatory scrutiny under FTC COPPA guidance and warrants careful review.
Under this clause, children under the applicable age threshold may have IP addresses, device identifiers, and other persistent identifiers collected by Nintendo and its service providers without parental consent, for purposes that include contextual advertising. Parents can withdraw consent or request deletion of child data by contacting Nintendo using the contact information in Section 9.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Nintendo.