Nintendo requires a parent or guardian's consent before collecting personal data from children under 13, managed through the Nintendo Account family system, and parents can request review or deletion of their child's data.
This analysis describes what Nintendo's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
COPPA imposes strict requirements on collecting data from children under 13, and the adequacy of Nintendo's consent mechanism within its family account system directly determines whether children's data is legally protected; parents should actively configure and monitor family account settings.
Interpretive note: Whether Nintendo's family account system constitutes verifiable parental consent meeting the FTC's COPPA Rule standard depends on technical implementation details not fully disclosed in the policy text.
Nintendo now explicitly discloses that it collects persistent identifiers (IP addresses, device IDs) from child users for operational, security, fraud prevention, and service improvement purposes, and states that contractual restrictions limit how service providers can use this data. Parents gain enhanced transparency by being able to view a named list of third-party games and applications authorized to access their child's account, rather than just managing access through settings. The policy also clarifies that location information may be used for check-ins at Nintendo locations and events in addition to location-based games. You can review and manage which third-party apps have access to your child's account through your Nintendo Account profile settings.
View change record →Nintendo now discloses that it uses location data not only for location-based games and friend connections, but also to enable check-ins at specific events and Nintendo locations, which is a new explicit use case. The policy now details how child user data including persistent identifiers like IP addresses and device IDs are collected and retained, with commitments to delete or de-identify data based on sensitivity and account activity. Parents can now see which third-party apps have been authorized to access their child's account before deciding whether to allow continued access, giving more visibility into connected applications.
View change record →The revised policy simplifies how Nintendo describes data retention, now stating information is retained only as long as reasonably necessary in accordance with applicable law, without prior detail about sensitivity-based retention practices. For child users, the policy no longer explicitly lists persistent identifiers (IP addresses, device identifiers) that Nintendo and service providers collect, removing specific disclosure language that previously detailed collection purposes for child accounts. The policy now indicates it collects error information from both users and devices, broadening the prior language focused on device errors only. The privacy certification body changed from CARU to ESRB, meaning independent audits and enforcement are now administered by the Entertainment Software Rating Board rather than the Children's Advertising Review Unit.
View change record →If you set up a Nintendo Account for a child under 13, the level of data protection for that child depends significantly on how parental controls are configured; without active parental oversight of account settings, the child's gameplay, communications, and behavioral data may be collected.
How other platforms handle this
The Service is intended for general audiences and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe that your child under the age of 13 has provided us with personal information without your cons...
enableGpcSdk: true, gpcSetting: { privacyPolicyLink: '/Privacy-Security-Policy-a-282.html' }
We process Global Privacy Control signals as opt-out requests for the sale or sharing of personal information.
Monitoring
Nintendo has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We do not knowingly collect personal information from children under 13 without parental consent. Child accounts are managed through the Nintendo Account family management system, which requires a parent or guardian to provide consent before the child can use certain features. Parents may review, modify, or delete their child's personal information by contacting us.— Excerpt from Nintendo's Nintendo Privacy Policy
REGULATORY LANDSCAPE: This provision directly engages COPPA (15 U.S.C. 6501 et seq.), enforced by the FTC, which requires verifiable parental consent before collecting, using, or disclosing personal information from children under 13 in the United States. The FTC's COPPA Rule specifies acceptable consent mechanisms and imposes obligations on operators of child-directed services. Nintendo's use of a family account system as the consent mechanism must meet the FTC's standard for verifiable parental consent, which has been the subject of FTC enforcement actions against major gaming platforms. GOVERNANCE EXPOSURE: High. Gaming platforms with large populations of child users have been priority FTC enforcement targets under COPPA. The adequacy of the family account consent flow, particularly whether it constitutes 'verifiable parental consent' under the FTC's COPPA Rule, is a material compliance question. If the consent mechanism relies primarily on a parent creating a linked account without additional verification, this may not satisfy the FTC's requirements. JURISDICTION FLAGS: COPPA applies to all US-based operators collecting data from children under 13, regardless of state. California's Age-Appropriate Design Code (AB 2273), if enforceable, would impose additional requirements for services likely to be accessed by minors, including data minimization and default privacy protections. EU child data protections under GDPR Article 8 (which sets the age of consent at 16, or lower if member states permit, with a floor of 13) would apply to European child users and are addressed in Nintendo's separate EU privacy notice. CONTRACT AND VENDOR IMPLICATIONS: Any third-party service providers or advertising partners who may receive data from child accounts must be contractually prohibited from using that data for behavioral advertising or secondary purposes; data processing agreements should explicitly address child account data restrictions. Vendor due diligence should confirm that child account data is segregated and not included in advertising data flows. COMPLIANCE CONSIDERATIONS: Legal teams should conduct a technical audit of the family account consent flow to verify it meets FTC COPPA verifiable parental consent standards, including whether additional verification steps beyond account creation are required. Data mapping should confirm that child account data is excluded from advertising and analytics data shares. The process for parents to access, modify, and delete child data should be tested for functionality and timeliness. Nintendo should also assess exposure under California's Age-Appropriate Design Code.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
COPPA imposes strict requirements on collecting data from children under 13, and the adequacy of Nintendo's consent mechanism within its family account system directly determines whether children's data is legally protected; parents should actively configure and monitor family account settings.
If you set up a Nintendo Account for a child under 13, the level of data protection for that child depends significantly on how parental controls are configured; without active parental oversight of account settings, the child's gameplay, communications, and behavioral data may be collected.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Nintendo.