Tools / COPPA and GDPR checklistCOPPA and GDPR checklist for indie games
A practical privacy checklist for small teams releasing a game on Steam, itch.io, or the web. Answer three questions to see what applies, tick items off as you go, then download your checklist.
Not legal advice. This is general guidance for small teams, not legal advice, and it may be out of date or not fit your situation. Laws and platform rules change. Have a qualified lawyer review your policies before you launch. Last reviewed Oct 31, 2026.
Download checklist (.md)
Print or save as PDF
Reset
Know your audience
Most of the rules depend on who your game is for. Decide this first and write it down.
Decide whether your game is directed to children under 13, aimed at a general audience, or mixed.
Regulators look at the subject matter, art style, characters, music, ads, and any evidence of who actually plays. A cartoon art style or kid-friendly theme can make a game "child-directed" even if you did not intend that.
Write down your audience decision and the reasons for it, and keep it with your compliance records.
If a regulator or a platform asks, a short dated note showing how you decided is far better than none.
If your game is for a general or mixed audience, use a neutral age screen (ask for a birth date without hinting at a required age) before collecting personal information.
Telling people which age gets them in invites false answers. Once you know a user is under 13, COPPA obligations apply to that user.
Children
Map the data you collect
You cannot protect, disclose, or delete data you have not listed.
List every kind of personal data your game or site collects: accounts, email, IP address, device or advertising IDs, cookies, analytics events, crash reports, chat, voice, user-generated content, and location.
Under both COPPA and GDPR, even an IP address or a persistent device identifier can count as personal information.
List every third-party SDK, plugin, and service in your build (analytics, ads, crash reporting, engine telemetry, social login) and what each one collects and shares.
You are generally responsible for what the tools you embed do. Check each vendor's documentation for a child-directed or privacy-safe mode.
Remove any data you do not need to run the game, and avoid making players hand over more information than a feature requires.
Data you never collect is data you never have to secure, disclose, or delete. COPPA specifically limits collecting more than is reasonably necessary for an activity.
Set how long you keep each kind of data, and delete it when you no longer need it.
GDPR requires storage limitation, and the FTC's updated COPPA Rule expects a written data retention policy for children's data. Check the current rule text for exact requirements.
United States: COPPA
The Children's Online Privacy Protection Rule applies to online services directed to children under 13, and to services that knowingly collect personal information from them.
Get verifiable parental consent before collecting personal information from a child under 13, unless a specific exception applies.
The FTC lists acceptable consent methods. The right one depends on how you use the data, so check the current list rather than inventing your own.
Children
Give parents direct notice of what you collect, how you use it, and whether you share it, in addition to a privacy policy that is easy to find.
COPPA requires both an online notice and a direct notice to the parent when consent is needed.
Children
Turn off behavioral or personalized advertising for child users, and configure every ad network in child-directed mode.
Persistent identifiers used for tracking and ad targeting are personal information under COPPA. Ad SDKs commonly default to the wrong setting.
Children
Let parents review the data you hold about their child, ask you to delete it, and stop further collection, and describe how in your privacy policy.
You need a working process, such as a monitored email address, before you need it.
Children
Keep children's data secure: limit who can access it, use HTTPS, and hash passwords. Share it only with providers that can protect it.
The updated COPPA Rule expects a written information security program. Check the current requirements.
Children
Check whether US state privacy and children's online safety laws (for example California's CCPA/CPRA and age-appropriate design rules) apply to you.
Several states add duties on top of COPPA, and some depend on your size or revenue.
EU and UK: GDPR and ePrivacy
These apply when you offer your game to people in the EU or UK, wherever you are based.
Choose and record a lawful basis (such as contract, legitimate interests, or consent) for each way you use personal data.
You must be able to say why you are allowed to process each kind of data.
Publish a plain-language privacy notice: who you are, what you collect, why, who receives it, how long you keep it, the players' rights, and how to contact you.
Transparency is a core GDPR duty, and the notice should be written so the age group you serve can understand it.
Ask for opt-in consent before setting non-essential cookies or running analytics or advertising trackers. Make declining as easy as accepting, and let people change their mind.
ePrivacy rules require consent for non-essential cookies and similar technologies, and GDPR sets the standard for valid consent.
If you rely on consent for children, check the age of digital consent: it is 16 by default under GDPR, but EU countries may set it as low as 13, and the UK uses 13. Get parental consent below that age.
The age differs by country, so list the countries you target and check each.
Children
If UK children are likely to play, review the UK Age Appropriate Design Code (the "Children's code") and its defaults for privacy, profiling, and geolocation.
It sets higher privacy defaults for services likely to be accessed by children.
Children
Set up a way to handle requests to access, correct, delete, or export a person's data, and respond within one month.
A monitored email address and a simple internal process are usually enough for a small team.
Sign data processing agreements with vendors that handle personal data for you, and check how data transferred outside the EU or UK is protected.
Most big vendors provide a standard agreement. Look for it in their legal or privacy pages.
Write down what you will do if there is a data breach, including notifying the relevant authority within 72 hours when required, and telling affected people when the risk is high.
The clock starts when you become aware of the breach, so decide in advance who does what.
If you are outside the EU or UK and target players there, check whether you must appoint a local representative, and whether you need a data protection officer or a data protection impact assessment.
Small studios are often exempt from some of these, but large-scale processing of children's data can change that. A lawyer can confirm quickly.
Where you publish
Each place has its own forms and rules on top of the law. Always check the platform's current requirements.
Fill in Steamworks questionnaires (content survey, age and mature-content settings) accurately, and keep them in sync with your game.
Inaccurate answers can cause your page to be pulled or restricted. Check Steamworks documentation for the current requirements, including privacy policy links.
Check what any Steamworks features or third-party SDKs in your build send, and make sure your privacy policy reflects it.
Platform features such as online services, leaderboards, and crash reporting may involve extra data.
Set your itch.io page's content and age-related settings accurately, link your privacy policy on the page, and tell players if the game collects data or connects to online services.
itch.io lets creators describe their games freely, so players rely on what you write. Check itch.io's current creator terms and guidelines.
For web and HTML5 games, make sure no analytics, ad, or social scripts run before consent, and review what the third-party iframes and embeds on your page do.
A game page can quietly load many trackers. Check the browser's network tab with cookies cleared to see what actually loads.
Add a cookie consent banner that works for your audience, with a clear decline option and a way to reopen your choice later.
Needed for EU and UK visitors and good practice everywhere. Honor browser signals like Global Privacy Control where you can.
Serve your site and game over HTTPS only, and keep game files on a separate origin from any logged-in pages.
Protects players' data and keeps uploaded game code away from account sessions.
Inside your game
Practical features that make compliance real instead of just paperwork.
Link your privacy policy inside the game (settings or main menu) and on every store or download page.
Policies are only useful if people can find them where they play.
Give players and parents a real contact address for privacy questions, and read it.
Both laws expect you to be reachable for data requests.
Offer a way to delete an account and its data.
It makes deletion requests simple for you, too.
Review chat, voice, friends, and user-generated content. For child players, turn them off by default or limit them to filtered options, and have a way to report and remove harmful content.
Open communication with strangers is the highest-risk feature for children and for your moderation workload.
Children
For child players, avoid manipulative monetization, such as pressure tactics around in-app purchases and loot boxes.
Regulators in several regions treat these as unfair practices when aimed at children, and our content policy forbids content targeting children with manipulative monetization.
Children
Before you launch
Finish with a check by someone qualified.
Nothing matches those answers. Try changing a filter.
Get new tools in your inbox
One short email when we ship a new free tool for indie developers. No spam, unsubscribe any time.
Your ticks are saved only in this browser. Nothing is sent to us. This checklist is a starting point and is not legal advice. For more on how we handle your own data, see our privacy policy .
