A Plain-Language Guide to Data Privacy in Children's Apps

Privacy policies are written by lawyers for other lawyers, which means most parents skip them entirely — understandably. Here's what actually matters, without the legal boilerplate.

What data is actually being collected

Beyond the obvious (name, age, what the child types), a lot of AI-powered apps also log timing data — how long a child pauses before answering, how many attempts a problem takes, what time of day they're most active. This behavioral data is often more sensitive than the content itself, and it's the part most policies mention only in passing.

Where the data goes

The single most useful thing to check is whether a company shares data with third parties for purposes unrelated to the app's core function — advertising networks in particular. Look for a plain statement like "we do not sell personal information," and be skeptical of vague language like "trusted partners" without specifics.

How long it's kept

Retention periods vary wildly, from "deleted after the session ends" to "indefinitely, unless you request deletion." A growing number of apps default to indefinite retention simply because it's easier to build, not because they need the data that long.

A five-minute checklist

Before letting a child use a new AI tool, it's worth searching the privacy policy for four things: whether data is sold or shared with advertisers, how long it's retained, whether there's a clear deletion process, and whether the policy has a specific section for users under 18. If any of these are missing or vague, that's a reasonable signal to look elsewhere.

None of this requires becoming a privacy expert — just knowing what to search for saves most of the reading.