Children's Privacy and Age Restriction

What it is

Runway's service is not intended for children under 13, and Runway states it does not knowingly collect personal data from this age group. Parents who believe a child under 13 has submitted data can contact Runway to request deletion.

Why it matters (compliance & governance perspective)

This provision establishes Runway's COPPA compliance posture, relying on a 'not directed to children' standard. The policy does not describe any age verification mechanism, which is a common limitation in online service COPPA compliance. The collection of biometric data from users raises heightened considerations if any underage users access the service.

Consumer impact (what this means for users)

The service is not intended for children under 13, and parents or guardians who believe a child has submitted data can contact privacy@runwayml.com to request deletion. The policy does not describe an age gate or verification mechanism.

What you can do

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: This provision implicates the Children's Online Privacy Protection Act (COPPA), enforced by the FTC, which prohibits collection of personal information from children under 13 without verifiable parental consent. The FTC has brought enforcement actions against platforms that failed to implement adequate age screening. The 2024 FTC COPPA Rule amendments have expanded the scope of covered personal information and operator obligations. State-level children's privacy laws in California (AADC), Connecticut, and others impose additional requirements for services likely to be accessed by minors. 2) GOVERNANCE EXPOSURE: Medium. The policy relies on a 'not directed to children' standard without describing any technical age verification or screening mechanism. Given that Runway provides AI creative tools that may be accessed by minors, the absence of a described age gate creates potential COPPA exposure if the FTC or state authorities determine the service is likely to be accessed by children under 13. 3) JURISDICTION FLAGS: California's Age-Appropriate Design Code (AADC) and similar laws in Connecticut and other states may impose design and data minimization requirements even for services not explicitly directed at minors, if those services are reasonably likely to be accessed by children. The UK Children's Code (Age Appropriate Design Code) applies to online services in the UK likely to be accessed by under-18s. 4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers deploying Runway in educational or youth-facing contexts should ensure contractual protections are in place to prevent access by users under 13. Any enterprise deployment that may involve minors should be evaluated against COPPA and applicable state children's privacy law requirements. 5) COMPLIANCE CONSIDERATIONS: Legal teams should assess whether Runway's current approach to age screening is sufficient under COPPA and applicable state children's privacy laws given the nature of the service. The biometric data collection provision raises particular concern in the context of minor users, as collection of biometric identifiers from children may trigger additional statutory protections under BIPA and other state laws.

Applicable agencies

Provision details

Other risks in this policy

• Biometric Data Collection high
• Advertising Partner Disclosure as Potential CCPA Sale high
• User Content Collection Including Prompts and Generated Outputs medium
• Enterprise Account Administrator Access medium
• Business Transferee Data Disclosure medium
• GDPR Legitimate Interests Legal Basis medium