The policy discloses that Nintendo and its service providers collect persistent identifiers (including IP addresses and device identifiers) from child users without parental consent, relying on the COPPA exception for internal operations support, which includes serving contextual advertising.
This analysis describes what Nintendo's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision relies on COPPA's internal operations exception to collect persistent identifiers from child users without parental consent; the inclusion of 'serving contextual advertising' within the listed permitted purposes is an area of active regulatory scrutiny under FTC COPPA guidance and warrants careful review.
Interpretive note: The permissibility of 'serving contextual advertising' as an internal operations purpose under COPPA's exception is subject to FTC interpretive guidance and enforcement discretion, which may limit or qualify the scope of this provision in practice.
Nintendo now explicitly discloses that it collects persistent identifiers (IP addresses, device IDs) from child users for operational, security, fraud prevention, and service improvement purposes, and states that contractual restrictions limit how service providers can use this data. Parents gain enhanced transparency by being able to view a named list of third-party games and applications authorized to access their child's account, rather than just managing access through settings. The policy also clarifies that location information may be used for check-ins at Nintendo locations and events in addition to location-based games. You can review and manage which third-party apps have access to your child's account through your Nintendo Account profile settings.
View change record →Nintendo now discloses that it uses location data not only for location-based games and friend connections, but also to enable check-ins at specific events and Nintendo locations, which is a new explicit use case. The policy now details how child user data including persistent identifiers like IP addresses and device IDs are collected and retained, with commitments to delete or de-identify data based on sensitivity and account activity. Parents can now see which third-party apps have been authorized to access their child's account before deciding whether to allow continued access, giving more visibility into connected applications.
View change record →The revised policy simplifies how Nintendo describes data retention, now stating information is retained only as long as reasonably necessary in accordance with applicable law, without prior detail about sensitivity-based retention practices. For child users, the policy no longer explicitly lists persistent identifiers (IP addresses, device identifiers) that Nintendo and service providers collect, removing specific disclosure language that previously detailed collection purposes for child accounts. The policy now indicates it collects error information from both users and devices, broadening the prior language focused on device errors only. The privacy certification body changed from CARU to ESRB, meaning independent audits and enforcement are now administered by the Entertainment Software Rating Board rather than the Children's Advertising Review Unit.
View change record →Under this clause, children under the applicable age threshold may have IP addresses, device identifiers, and other persistent identifiers collected by Nintendo and its service providers without parental consent, for purposes that include contextual advertising. Parents can withdraw consent or request deletion of child data by contacting Nintendo using the contact information in Section 9.
Cross-platform context
See how other platforms handle Children's Persistent Identifier Collection and similar clauses.
Compare across platforms →"We do not knowingly collect, use or share information from children under a certain age without parental consent or as permitted by law (e.g., a 'child' is under the age of 13 in the United States, under the age of 14 in Quebec, etc.). However, please note that we collect, and we permit our service providers to collect, persistent identifiers, such as IP addresses, device identifiers and other unique identifiers from such child users, solely for purposes necessary to support the internal operations of our services, including maintaining or analyzing the functionality of the Nintendo services, protecting the security or integrity of the user or the Nintendo services, fraud prevention, service improvements and debugging, authenticating users of the website or online service, serving contextual advertising on the website or online service, fulfilling a request of a child, and ensuring legal or regulatory compliance.Excerpt from Nintendo's Privacy Policy
REGULATORY LANDSCAPE: This provision directly engages COPPA, enforced by the FTC, and equivalent provincial regulations in Canada (including Quebec's Act respecting the protection of personal information in the private sector).
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision relies on COPPA's internal operations exception to collect persistent identifiers from child users without parental consent; the inclusion of 'serving contextual advertising' within the listed permitted purposes is an area of active regulatory scrutiny under FTC COPPA guidance and warrants careful review.
Under this clause, children under the applicable age threshold may have IP addresses, device identifiers, and other persistent identifiers collected by Nintendo and its service providers without parental consent, for purposes that include contextual advertising. Parents can withdraw consent or request deletion of child data by contacting Nintendo using the contact information in Section 9.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Nintendo.