Children's Privacy at WiFi Hotspots: COPPA and Under-13 Consent

This is general information, not legal advice. We checked each legal statement against the COPPA Rule on eCFR, the FTC's COPPA FAQ, the GDPR text and national regulators' pages on 9 October 2026. If children are a large part of your audience, get advice from a privacy lawyer in your country.

Why Children's Privacy Is a WiFi Marketing Risk

Family restaurants, soft play centres, leisure parks and family hotels all have children and teenagers on the guest WiFi. A standard portal asks for an email address and a marketing choice from whoever fills in the form, with no age question.

When a child fills it in, two sets of rules can apply. In the US, COPPA governs personal information collected online from children under 13. In the EU and UK, GDPR Article 8 decides when a child can give their own consent to an online service, and below that age a parent has to give or authorise it.

The US exposure is real money. The FTC's COPPA FAQ says a court can hold operators liable for "civil penalties of up to $53,088 per violation" (FTC, Complying with COPPA: FAQ).

COPPA: US Requirements for Under-13

COPPA applies to an operator of a website or online service directed to children, or an operator with actual knowledge that it is collecting personal information from a child under 13 (16 CFR 312.3, eCFR). The FTC says "online service" broadly covers any service available over the internet (FAQ A.7). Foreign based services must comply if they are directed to children in the United States (FAQ B.7).

Personal information under the Rule includes a first and last name, an email address, a telephone number, and a persistent identifier such as an IP address or a unique device identifier (16 CFR 312.2).

Where COPPA applies, an operator must (16 CFR 312.3):

• Give notice of what it collects from children and how it uses and discloses it
• Get verifiable parental consent before collecting, using or disclosing a child's personal information
• Let parents review the information, refuse further use and have it deleted
• Keep the information secure
• Keep it only as long as reasonably necessary, under a written data retention policy that sets a deletion timeframe (16 CFR 312.10)

The FTC amended the Rule in 2025. The amended Rule took effect on June 23, 2025, and most regulated entities had until April 22, 2026 to comply (Federal Register, April 22, 2025).

One exception matters for WiFi. Verifiable parental consent is not needed where an operator collects a persistent identifier and no other personal information, used only to support the internal operations of the service (16 CFR 312.5(c)(7)). The Rule's definition of internal operations includes performing network communications and authenticating users. It does not cover an email address collected for marketing.

What this means for a portal:

• General audience venue, such as a family restaurant. The FTC says "the Rule does not require operators to ask the age of visitors" (FAQ A.12). But once you know a user is under 13, for example because your age question told you, you have actual knowledge. Do not take that child's email for marketing without parental consent. The FTC also says you may block children from participating if you choose (FAQ H.3).
• Venue aimed at children, such as a soft play centre. The FTC weighs things like subject matter, visual content, animated characters and the audience you actually attract when deciding whether a service is directed to children (16 CFR 312.2). A portal branded for kids may be treated as directed to children. If children are not your primary audience, the Rule's mixed audience category lets you ask for age before collecting anything, but the FTC says a mixed audience service "may not block children from participating altogether" (FAQ D.6). For a portal, that points to letting children connect without filling in any form.

GDPR Article 8: EU Requirements for Under-16

Article 8 applies when you rely on consent for an information society service offered directly to a child. The processing "shall be lawful where the child is at least 16 years old". Below that age it is lawful only if consent "is given or authorised by the holder of parental responsibility over the child". Member States may set a lower age, but "not below 13 years" (GDPR Article 8, EUR-Lex). Article 8(2) adds that you must make reasonable efforts to verify the parent's consent, taking into account available technology.

Ages set nationally, from primary sources:

• UK: 13 (ICO, how the lawful bases apply to children's information)
• France: 15. Below 15, consent is given jointly by the child and a parent (CNIL)
• Spain: 14 (Organic Law 3/2018, article 7, BOE)
• Where a country has not set its own age, 16 applies. Check your national data protection authority for the age where you operate.

So a family venue in France should not add a 14 year old to its marketing list on the child's own consent, while a UK venue could accept a 14 year old's own consent. Both still need the consent to be freely given and separate from getting online.

The ICO's current guidance ties these extra rules to consent: they apply if you "offer an ISS directly to children and want to rely on the consent lawful basis", and you then "must take reasonable steps to confirm that users are at least 13 years old" (ICO, how the lawful bases apply to children's information).

Implementing an Age Gate on Your WiFi Portal

An age gate is a step before the sign up form that asks for age and decides which form the guest sees.

Ask neutrally. The COPPA Rule says any collection of age information on a mixed audience service "must be done in a neutral manner that does not default to a set age or encourage visitors to falsify age information" (16 CFR 312.2). The FTC's FAQ makes the same point for general audience sites (FAQ H.3). In practice: a blank date or year of birth field with no pre-filled value, and no wording before it that tells the child which answer gets them in. A single "I am 13 or over" button does tell them.

Branch on the answer. If the guest is below your threshold, show "Connect without signing up" with no form, no marketing box and no email field. Otherwise show the normal form, with marketing consent as a separate, unticked box.

Keep the age answer minimal. The ICO's guidance asks you to minimise data collected for age checks and not keep it longer than needed. You need the decision, not the birth date.

Limitation: a self declared age is not verification, and a determined child can lie. The neutral age screen is the method the COPPA Rule itself describes for mixed audience services. Under GDPR Article 8(2), what counts as reasonable effort depends on the risk and the technology available, so a venue whose audience is mostly children should expect to do more.

Defaults for guests under the threshold:

• Connect without marketing only (no opt-in checkbox)
• Do not add them to any marketing list
• Do not send them any marketing

Documentation: record the age gate in your record of processing and in your privacy notice. Note the age threshold you apply and the law it comes from. If COPPA applies to you, add the written retention policy that 16 CFR 312.10 requires.

Venue Types Most at Risk

Prioritise children's privacy at:

• Family restaurants and casual dining chains with children's menus
• Soft play centres and family entertainment venues
• Theme parks and leisure parks
• Family hotels and resorts
• After school clubs, sports venues and youth centres
• Libraries and other public WiFi that children use

For these venues an age question before the form is the sensible default. If you run a separate network for a children's area, consider a click through portal there with no data collection at all.

Next step: open your portal on a phone, fill it in as a 12 year old would, and check what gets stored and who gets emailed.