Children and Minors Data Restriction

What it is

NVIDIA states its services are not intended for children under 13 and that it does not knowingly collect data from children under 13; parents can request deletion of any such data.

Why it matters (compliance & governance perspective)

The policy establishes an age-based restriction on data collection consistent with COPPA in the US; the restriction applies to services not directed at children, but does not address the full range of minors' privacy protections under GDPR Article 8 or state laws that apply to users under 16 or 18.

Consumer impact (what this means for users)

Parents of children under 13 should be aware that NVIDIA states it does not knowingly collect data from this age group and that deletion of inadvertently collected data can be requested; users in the EU/EEA should note that GDPR Article 8 may set the age of digital consent at up to 16 depending on member state, potentially creating a gap between the policy's stated age threshold and applicable law.

What you can do

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: This provision implicates COPPA, which requires verifiable parental consent before collecting personal information from children under 13 in the US; the FTC is the primary enforcement authority. GDPR Article 8 sets the age of consent for information society services at 16 years by default with member states permitted to lower it to no less than 13; where NVIDIA's services are accessible to minors aged 13 to 15 in EU member states that have not lowered the age threshold, a potential gap exists between NVIDIA's stated policy and GDPR requirements. The UK Age Appropriate Design Code (Children's Code) may apply to services accessible to users under 18 in the UK. 2) GOVERNANCE EXPOSURE: Medium. The policy's under-13 threshold aligns with US COPPA requirements but may not satisfy GDPR Article 8 in all EU member states. The UK Children's Code creates broader obligations for services likely to be accessed by users under 18. If NVIDIA AI products are accessible to minors and involve profiling or behavioral advertising, additional restrictions apply. 3) JURISDICTION FLAGS: US federal COPPA applies to under-13 users; California's Age-Appropriate Design Code Act (AB 2273, subject to ongoing litigation) would impose broader protections for users under 18 if upheld; EU member states vary in their GDPR Article 8 age of consent setting; UK Children's Code applies to services likely accessed by under-18 users. 4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers deploying NVIDIA products in educational or consumer contexts where minors may be users should assess whether their own data processing agreements with NVIDIA restrict collection and use of minors' data and whether NVIDIA's stated policy satisfies the enterprise customer's own COPPA or FERPA obligations. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should assess whether any NVIDIA services marketed or accessible to users under 16 or 18 trigger obligations beyond the stated under-13 threshold; evaluate UK Children's Code applicability; confirm that parental consent mechanisms and data deletion workflows for under-13 users are operationally implemented; and consider whether AI product features involving profiling or behavioral targeting require additional age verification.

Applicable agencies

Provision details

Other risks in this policy

• AI Training Data Use high
• Third-Party Data Sharing Including Advertising and Data Brokers medium
• Consumer Data Subject Rights (Access, Deletion, Portability, Objection) medium
• Cross-Border Data Transfers medium
• Data Retention low