Children's Data and Age Restriction

What it is

Zoom prohibits account registration by users under 16 and maintains a separate Children's Educational Privacy Statement for educational organizations providing services to users under 18 through Zoom.

Why it matters (compliance & governance perspective)

This provision establishes a minimum age of 16 for Zoom account registration, which is above COPPA's 13-year threshold but consistent with GDPR Article 8's default digital consent age. The separate educational privacy statement for users under 18 in educational contexts is operationally significant for schools and educational institutions deploying Zoom.

Clause Stability Stable

Change history

Consumer impact (what this means for users)

This provision establishes that users under 16 may not register for a Zoom account, and that educational organizations using Zoom to serve users under 18 are subject to a separate Children's Educational Privacy Statement. Educational institutions should consult the dedicated educational privacy statement for applicable terms.

Institutional analysis (regulatory & governance intelligence)

1. REGULATORY LANDSCAPE: This provision engages COPPA (Children's Online Privacy Protection Act), which applies to online services directed to children under 13 or that have actual knowledge they are collecting personal information from children under 13, enforced by the FTC. GDPR Article 8 sets a default age of 16 for digital consent in the EU, with member states permitted to lower the threshold to 13. The Family Educational Rights and Privacy Act (FERPA) may apply to educational institutions using Zoom to provide educational services to students. The separate Children's Educational Privacy Statement referenced in this provision is not reproduced in this document. 2. GOVERNANCE EXPOSURE: Medium. The 16-year minimum age for account registration is consistent with GDPR's default digital consent age, but the adequacy of Zoom's age verification mechanisms is not described in this provision. Educational institutions relying on the separate Children's Educational Privacy Statement should review that document to assess COPPA, FERPA, and applicable state student privacy law compliance. 3. JURISDICTION FLAGS: COPPA applies to services with actual knowledge of users under 13 in the U.S. GDPR Article 8 applies to users under 16 in the EEA (with member state variations). States including California (SOPIPA), New York, and others have enacted student data privacy laws that may impose additional requirements on educational deployments. Illinois BIPA may interact with any biometric features used in educational contexts involving minors. 4. CONTRACT AND VENDOR IMPLICATIONS: Educational institutions deploying Zoom should ensure they have reviewed the separate Children's Educational Privacy Statement and have appropriate data processing agreements in place. FERPA requires that educational agencies and institutions that disclose personally identifiable information from student education records to service providers ensure those providers use the data only for authorized purposes. 5. COMPLIANCE CONSIDERATIONS: Educational institutions should audit their Zoom deployment against requirements under FERPA, COPPA (if serving users under 13), and applicable state student privacy laws. The reference to a separate Children's Educational Privacy Statement requires that document to be reviewed independently. Organizations should confirm that their Zoom data processing agreements address student data protections required under applicable law.

Applicable agencies

Provision details

Other risks in this policy

• Account owner access to in-meeting messages in specific circumstances high
• Account owner access to participant usage and product data high
• Account owner access to recordings, transcripts, and intelligent feature content high
• Account owner access to Zoom Chat message content high
• Account owner access to Zoom Email and Calendar content high
• Advertising services may constitute sale or sharing of data high