Children's Privacy and Age Restrictions

What it is

Target states its online services are not aimed at children under 13 and claims it does not knowingly collect data from this age group. Parents can contact Target if they believe their child's data was collected.

Why it matters (compliance & governance perspective)

COPPA requires verifiable parental consent before collecting personal information from children under 13; a retailer's general audience claim does not eliminate compliance obligations if children are actually using the service and providing personal data.

Consumer impact (what this means for users)

Parents should be aware that while Target states its platforms are not directed at children under 13, the general retail nature of the site means minors may access it; if a child under 13 has a Target account or has provided personal information, parents can request deletion by contacting Target's privacy team.

Institutional analysis (Compliance & governance intelligence)

1. REGULATORY LANDSCAPE: The Children's Online Privacy Protection Act (COPPA) and FTC Rule 16 CFR Part 312 impose consent and disclosure requirements for websites that collect personal information from children under 13 or that have actual knowledge of collecting such information. The FTC is the primary enforcement authority. State laws in California (COPPA-plus provisions under AB 1138) and other states may impose additional obligations beyond federal COPPA. 2. GOVERNANCE EXPOSURE: Low to Medium. The general audience disclaimer is standard industry practice and is recognized as a threshold compliance step under COPPA. However, if Target has actual knowledge that users under 13 are creating accounts or if the platform includes features likely to attract minors, the general audience defense may not be sufficient. The policy's remediation pathway for parents is appropriately disclosed. 3. JURISDICTION FLAGS: California's Age-Appropriate Design Code (AB 2273), if in effect, may impose additional obligations related to the design of digital services that are likely to be accessed by minors regardless of whether the service is directed at children. The UK Age Appropriate Design Code similarly applies to services likely accessed by children. 4. CONTRACT AND VENDOR IMPLICATIONS: Third-party advertising vendors receiving data from Target's platforms should be contractually restricted from using data in ways that would violate COPPA or analogous state laws if a user is later determined to be under 13. 5. COMPLIANCE CONSIDERATIONS: The compliance team should assess whether any Target digital features, particularly those related to loyalty programs, toy categories, or family-oriented services, create a heightened risk of actual knowledge of child users. A documented process for responding to parental deletion requests should be maintained and tested periodically.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Biometric Data Collection high
• Roundel Retail Media Advertising Network high
• Precise Geolocation Collection medium
• Third-Party Data Sources and Data Brokers medium
• California and State-Specific Opt-Out Rights medium
• Data Retention Practices medium