Child marketing laws, advertising regulations, and data protection rules are tightening in every major market. We reviewed the legal and governance documents from 8 key markets - the UK, USA, Germany, France, Spain, Italy, China, and Brazil - so you don't have to.
The rules and regulations for how you engage with kids and teens are being tightened all around the world at the moment - rightfully so. We have reviewed the legal and governance documents from 8 key markets, and this debrief is a summary of those. The first half looks at each country specifically; the second half gives a global overview for five industry sectors. Use the navigation above to jump anywhere at any time.
HFSS restrictions live, OSA duties phasing in
Updated COPPA plus a wave of state laws
Strictest data consent age in the EU
Europe's first influencer marketing law
Mid-transition - a major new minors law is pending
Fast mover on influencer rules and AI transparency
The world's most comprehensive - and enforced
Digital ECA in force March 2026 - urgent
Loot boxes, playtime limits & ad targeting
Gambling, alcohol & athlete endorsements
Creator disclosure & algorithmic accountability
HFSS rules and the end of voluntary codes
Age checks, safe defaults & proactive duties
This is by no means a comprehensive look at every law and ruling, but a good overview of what we feel are the key things to know. We are an incredible research and marketing agency - but not great lawyers - so please don't treat this document as legal advice or recommendations. For follow-up questions, there's a glossary of terms at the end, and an accompanying chat bot fully loaded with every country's legal rulings and guidelines.
Eight markets, three lenses each: the regulatory overview, the legal framework, and what it means for your industry.
The UK has one of the most comprehensive and actively enforced regulatory frameworks for child protection in the world - and it is tightening further. Brands operating here face obligations that go well beyond advertising content, extending into how digital products are built, how data is used, and how platforms are designed.
Three layers, working together. UK GDPR and the Data Protection Act 2018 set the data rules, with the ICO's Children's Code adding 15 binding standards on top - covering everything from algorithmic defaults to nudge techniques for any service children are likely to use.
The Online Safety Act 2023, now being implemented through Ofcom's Protection of Children Codes of Practice, goes further: platforms must actively assess and mitigate child harm, not just respond to it. Ofcom's enforcement powers are significant and already in motion.
On advertising, the CAP Code (non-broadcast) and BCAP Code (broadcast), both enforced by the ASA, govern what can be targeted at children, how, and where. The 9pm watershed remains the baseline for broadcast.
GamingChildren's Code compliance is mandatory for any game likely played by under-18s: default high-privacy settings, no behavioural profiling for ads, no manipulative design patterns. HFSS restrictions now apply to in-game advertising. Loot boxes remain under scrutiny - legislation looks increasingly likely.
SportSponsorship rules are tightening beyond gambling. Alcohol faces strict limits where under-18 audiences are significant. Athletes with mainly young followers are treated as child-facing media under ASA rules. Energy drink marketing in sport is under growing scrutiny, and youth team sponsorship is judged more strictly than adult sport.
Media & Entertainment#ad disclosure is mandatory for all paid influencer content, regardless of creator age or platform. Streaming platforms with significant child audiences must now proactively configure recommendation algorithms under OSA duties - reactive moderation is no longer sufficient. BBFC certifications are increasingly applied to streaming content.
Food & HospitalityThe HFSS restrictions (in force January 2026) are the biggest change in UK advertising regulation in a generation. Any HFSS product cannot run paid online advertising at any time, or on broadcast/VOD pre-9pm. The rule applies at product level, not brand level - a QSR can advertise a salad but not a burger.
Tech & PlatformsIf children are likely to access your platform, the Children's Code applies - whether or not it is child-facing by design. The ICO has already taken action against major platforms. Age verification, privacy-by-default, and data minimisation are now baseline requirements.
The US is no longer a light-touch market for child marketing. A wave of state laws since 2022 has changed the compliance picture fundamentally - and federal reform is advancing.
Federally, the updated COPPA Rule (2025) governs data collection for under-13s - now prohibiting third-party targeted advertising to children and restricting dark patterns (manipulative design choices that push kids into actions they didn't intend). CARU (self-regulatory), CFBAI (food sector pledges), and the FTC Endorsement Guides (2023) cover advertising standards.
State law is now the real driver of change. California, New York, Florida, Texas, Connecticut, Maryland, and Tennessee all have child-specific laws enacted since 2022, requiring age verification, default privacy settings, and platform design changes that effectively set de facto national standards for any large platform.
GamingCOPPA, state privacy laws, and FTC enforcement all intersect in gaming. Behavioural advertising restrictions and dark pattern rules hit in-game advertising systems and purchase flows hard. California imposes additional obligations on minors' data beyond COPPA's 13-year threshold. FTC enforcement actions against gaming companies are increasing.
SportSports betting is legal in much of the US, but advertising rules vary by state and nearly always restrict content aimed at under-18s. Alcohol in sport contexts with large minor audiences also faces scrutiny. Athlete endorsements are a major watchout - especially where young followers are involved - and fantasy sports remains a regulatory grey area.
Media & EntertainmentFTC Endorsement Guides require disclosure of any material connection - free products included - for all creators regardless of age. COPPA Rule data minimisation and default settings obligations for platforms with child users are now broadly comparable to the UK's Children's Code in scope.
Food & HospitalityNo federal HFSS advertising restrictions yet, but the FTC is studying the area and state-level bills are advancing. CFBAI voluntary commitments apply to major QSR and food brands. FDA menu labelling applies nationally. A nationally consistent child-directed food campaign is increasingly difficult to run.
Tech & PlatformsCalifornia, New York, Connecticut, and other state laws create de facto national obligations for large platforms through platform-wide architectural requirements. Age verification, default privacy settings for minors, and algorithmic controls are now legally required in major US states. FTC COPPA enforcement is producing record fines.
Germany's framework is one of the most detailed in the world - federal, state-level, and self-regulatory layers all apply. The compliance bar is high, actively enforced, and consistently moving in one direction.
Two pillars: the JuSchG (Youth Protection Act) covering physical media, and the JMStV (Youth Media Protection State Treaty) covering broadcast and online - both significantly reformed in 2021. The JMStV now applies to any online service accessible from Germany, wherever it is based. The BZKJ was created specifically to handle online platforms and can require technical changes or issue access blocks.
Germany chose 16 as its GDPR data consent age - the maximum allowed - meaning virtually all commercial data collection from teenagers requires parental consent. The Deutscher Werberat handles advertising self-regulation, including restrictions on exploiting children's credulity and HFSS food advertising near child-facing content.
GamingThe USK rating system applies to all games; platforms must enforce ratings. JMStV compliance requires default high-protection settings and age verification for 12+ content. Loot boxes are under regulatory scrutiny on transparency and minor protection grounds.
SportGambling and alcohol advertising are allowed in Germany but tightly restricted around under-18s. Athlete endorsements with young audiences also face rules on content suitable for minors. Energy drinks and sports nutrition linked to youth performance are an emerging area of scrutiny.
Media & EntertainmentJMStV time restrictions apply online: 16-rated content cannot be freely accessible between 6am and 10pm; 18-rated content until midnight. Influencer content must carry #Werbung labelling. The LMAs have pursued enforcement action against creators who failed to label adequately.
Food & HospitalityHFSS advertising restrictions are currently voluntary under the Deutscher Werberat code. EU frameworks are pushing towards statutory harmonisation - treat self-regulation as a precursor to legislation. Advertising near schools for HFSS products carries significant reputational risk.
Tech & PlatformsThe BZKJ has direct enforcement powers against non-compliant platforms, including access blocks. International platforms are not exempt - Germany has pursued action against US-based services. Age verification for adult content, parental control tools, and youth harm reporting are all mandatory.
France sits within EU regulation but has added its own national layer on top - and led Europe on influencer marketing law. Compliance is layered and actively enforced.
GDPR and the CNIL govern data - France chose 15 as its consent age (one of the stricter EU choices) and the CNIL has investigated major platforms for children's data failures. The SREN Law (2024) introduced age verification requirements, new ARCOM powers over platforms accessible to minors, and a civil liability framework for harmful platform design.
Advertising is self-regulated by the ARPP, with ARCOM covering broadcast. The Loi Influence (2023), Europe's first influencer marketing law, requires #Publicité labelling and prohibits promotion of cosmetic surgery, gambling, and financial products in content accessible to minors.
GamingLoot box mechanics that mimic gambling are under active regulatory scrutiny. Data of under-15s cannot be used for behavioural advertising. CNIL has investigated gaming platforms for non-compliant data practices and will continue to do so.
SportGambling and alcohol advertising are tightly controlled in France, but athlete and sports personality endorsements are often the bigger blind spot. Sports figures with young audiences are subject to full influencer disclosure and minor-protection rules - even when promoting non-sport products like food, tech, or lifestyle brands.
Media & EntertainmentAll commercial creators must use #Publicité or #Collaboration labelling. Streaming platforms must meet ARCOM content rating and parental control requirements. The SREN Law has expanded ARCOM's enforcement tools significantly - it can require platform changes without a court order.
Food & HospitalityARPP self-regulation applies to HFSS advertising standards. Tighter statutory rules are likely as EU frameworks evolve. Advertising near school premises for unhealthy products is an emerging regulatory and reputational risk.
Tech & PlatformsThe SREN Law requires age verification, parental controls, and child safety risk assessments from any platform likely accessed by minors. The CNIL mandates privacy-by-default for services used by under-15s. Platforms that fail to act face both regulatory fines and civil liability.
Spain is mid-transition. The existing framework is active and enforced - but a new Organic Law for Minors in Digital Environments, if passed, will significantly tighten obligations across digital, social, and gaming.
The LOPDGDD (2018) implements GDPR with a data consent age of 14. The AEPD enforces actively, including against major platforms for failures to protect minor users. The pending Organic Law for Minors in Digital Environments would add mandatory social media age verification, prohibit accounts for under-16s, and require default high-protection platform settings. Its passage looks likely - brands should be planning for it now.
Advertising is self-regulated by AUTOCONTROL via the Código de Conducta Publicitaria, with the PAOS Code specifically governing food advertising to under-12s. The CNMC oversees broadcast and has powers over advertising content.
GamingAEPD has issued children's data guidance for gaming contexts. The pending Organic Law would significantly tighten platform accountability. Targeting systems must exclude identifiable minors, and ad creative must not exploit game mechanics to drive purchases.
SportGambling and alcohol advertising face tight restrictions in Spain, especially around under-18s. Athlete endorsements aimed at younger audiences must meet disclosure rules, and sponsorship in youth sport settings faces extra scrutiny over whether the brand is appropriate.
Media & EntertainmentInfluencer marketing requires AUTOCONTROL-compliant commercial disclosure. The Organic Law's proposed 16+ social media threshold is generating significant public and political debate. RTVE applies stricter internal standards than the regulatory minimum for child-facing content.
Food & HospitalityThe PAOS Code governs HFSS advertising to under-12s across TV, print, and digital for AUTOCONTROL members. Spain is engaged in EU discussions on statutory extensions. Advertising near school premises for unhealthy products is a reputational red line.
Tech & PlatformsAEPD has taken enforcement action against platforms for inadequate age verification and unlawful minor profiling. The Organic Law's Digital Childhood Code would require child-specific impact assessments, mirroring the UK's ICO Children's Code. Any platform with a material Spanish user base should treat this as imminent.
Italy has strong EU foundations, a mature self-regulatory tradition, and has moved fast on both influencer regulation and AI transparency. The compliance bar is rising, with self-regulation increasingly backed by statutory enforcement powers.
GDPR (data consent age 14), DSA (platforms), and AVMSD (broadcast and VOD) all apply, enforced by an unusually active Garante - one of Europe's most prolific GDPR enforcers. The IAP's Codice di Autodisciplina covers advertising to children in detail, prohibiting exploitation of credulity and setting food and toy advertising rules - IAP adjudications carry weight in courts.
AGCOM's 2024 influencer guidelines require significant creators to meet the same disclosure and content standards as traditional broadcasters. Italy's AI Law (132/2025) adds transparency requirements for AI-generated content accessible to minors - this is expected to roll out across the EU as a whole soon.
GamingGDPR, AGCOM content oversight, and IAP advertising standards all apply. The ADM (gambling regulator) has issued guidance on loot boxes - treat gambling-adjacent mechanics accessible to minors as subject to gambling ad restrictions.
SportItaly has a blanket ban on gambling advertising and sponsorship across sport, with only state lottery exceptions. Alcohol is also restricted where minors are likely to be reached, and athlete endorsements with large youth followings must follow influencer rules.
Media & EntertainmentAGCOM's 2024 guidelines require creators with 500,000 followers or 1M monthly views to register commercial content and comply with broadcast-equivalent standards. Minor-facing content faces additional restrictions. The Garante is increasing enforcement against streaming platforms with inadequate parental controls.
Food & HospitalityIAP standards prohibit nutritional dishonesty and techniques encouraging overconsumption in child-directed food advertising. RAI applies stricter internal standards than the statutory minimum. EU HFSS statutory restrictions will apply here when harmonised rules arrive.
Tech & PlatformsGarante, AGCOM (with new DSA powers), and the AI Law create a complex, fast-moving compliance environment. AGCOM influencer guidelines extend obligations to brand-funded creator content. Italy's AI Law requires transparency disclosures for AI-assisted content accessible to children.
China's framework is among the world's most comprehensive - and most enforced. The direction of travel is always stricter. Foreign brands cannot assume their domestic compliance is sufficient.
Four instruments apply. PIPL (2021) classifies under-14 data as sensitive personal information, requiring explicit parental consent. The Minor Protection Law (2021) imposes platform-level child welfare duties including anti-addiction measures and parental controls. The Advertising Law prohibits using under-18s as spokespersons, bans advertising for drugs, alcohol, online games, and cosmetics in minor-facing media, and prohibits content encouraging children to pressure parents into purchases.
The 2024 Regulations on Protection of Minors in Cyberspace are the most operationally significant development - applying to all platforms accessible in China, requiring Minor Mode, usage time limits, content filtering, advertising restrictions, and mandatory age verification. Online education platforms cannot carry any advertising at all.
GamingThe most restrictive gaming rules in the world. Under-18s can only play online games for three hours per week, during defined evening windows on weekends and public holidays. Real-name verification against national ID is mandatory. Advertising for any online games in minor-accessible media is prohibited.
SportGambling, alcohol, and tobacco sponsorship is banned in youth-facing sports in China. Broadcast feeds can also create problems - ads that work elsewhere may be non-compliant for China. Athlete endorsements are subject to the same child protection and under-18 spokesperson rules as any other advertising.
Media & EntertainmentDouyin, WeChat, Bilibili, and Weibo must all implement Minor Mode for under-18 users - restricting usage time, blocking purchases, and filtering content. CAC enforcement is active and public. Influencer marketing and live-streaming commerce are prohibited in minor-directed content.
Food & HospitalityAdvertising for unhealthy foods near schools is prohibited. SAMR enforces the Advertising Law's child-directed provisions actively. QSR brands with significant China operations should audit local advertising against the Advertising Law's minor-specific restrictions.
Tech & PlatformsThe 2024 Regulations define the compliance baseline: verified Minor Mode, usage time limits, parental supervision tools, and restricted push notifications are all mandatory. CAC enforcement is public and consistent - fines and forced apologies have been issued to major platforms.
Brazil's Digital ECA (effective March 2026) makes it the most advanced child marketing law in Latin America. It bans profiling-based advertising to under-18s outright and restricts emotional manipulation, AR, and VR in advertising directed at minors. Compliance readiness is urgent.
Three layers apply. The ECA (1990) is the foundational children's rights statute, interpreted to cover advertising, commerce, and media. The LGPD (2020) - Brazil's GDPR equivalent - requires parental consent for processing personal data of under-12s. The Digital ECA (Law 15,211/2025), in force from March 2026, is the landmark addition: it applies to any tech product or service accessed by or targeted at under-18s, regardless of where it is developed or marketed.
The Digital ECA categorically prohibits profiling-based advertising to minors and bans the use of emotional analysis, AR, XR, and VR in advertising directed at them. These are restrictions on advertising methodology - not just product categories - with significant implications for programmatic and data-driven campaign infrastructure. CONAR's CBAP Article 37 and Annex H cover self-regulation; the Digital ECA elevates key prohibitions to statute with ANPD as enforcement authority.
GamingThe Digital ECA's profiling-based advertising ban directly affects in-game advertising systems and monetisation. Brazil is a major gaming market - publishers must review advertising SDKs, in-app purchase flows, and any data collection used to inform commercial messaging. ANPD is building enforcement capacity for platform investigations.
SportGambling advertising in Brazil is now regulated, with strict limits around under-18s. Sports sponsors must ensure ads do not target minors, and athletes with large youth followings are treated much like child-directed media - bringing the same compliance obligations.
Media & EntertainmentBrazil has one of the world's largest influencer marketing ecosystems. CONAR disclosure rules apply to creator content (#publi). The Digital ECA's prohibitions on emotional manipulation and emotional analysis tools directly affect how brands brief creators. Streaming platforms must implement Digital ECA platform duties including default safety settings and algorithmic restrictions.
Food & HospitalityCONAR Annex H governs food advertising to children: nutritional honesty, restrictions on exploiting vulnerability, limits on unhealthy product promotion. ANVISA has additional powers over food labelling claims. The Digital ECA's emotional manipulation ban applies directly to QSR advertising techniques commonly used in child-directed marketing.
Tech & PlatformsThe Digital ECA is a paradigm shift for platforms with Brazilian users. The profiling-based advertising ban means standard programmatic infrastructure requires fundamental review for child-user segments. ANPD will prioritise Digital ECA enforcement from 2026. March 2026 is a hard deadline, not an aspirational target.
The global picture for five sectors - what's universal everywhere, and the country-specific watch-outs you can't afford to miss.
Across every market in this debrief, gaming regulation is moving in one direction - tighter controls on how minors are identified, what data can be collected from them, how they are advertised to, and how much they can spend. No market is loosening up. Five themes now show up almost everywhere:
Whether required by law or needed to comply with data and advertising rules, platforms are increasingly expected to know when a user is a minor.
The legal route differs by market, but the outcome is broadly the same: you cannot use a child's behavioural data to target them with commercial content.
Most markets have not formally classified them as gambling, but regulators increasingly treat paid randomised mechanics as gambling-adjacent when minors are involved.
Games and platforms accessible to children are increasingly expected to default to high privacy and low commercial exposure, rather than making children opt into safer settings.
Some markets already impose caps or restrictions, while others are clearly moving towards stronger controls on in-game spending by under-18s.
Not all countries are included here - just the ones where you need to be specifically aware of local variations.
China has the strictest rules in this group. Under-18s face severe playtime limits, real-name ID checks are mandatory, and advertising for online games in media accessible to minors is banned. Foreign publishers also need separate approval before release. Global compliance frameworks do not neatly carry over here.
Brazil's Digital ECA, effective March 2026, bans profiling-based advertising to under-18s. This affects not just creative but the ad tech and monetisation systems behind it. Any publisher with Brazilian users should already be reviewing how ads are served to minors.
The UK is unusual in explicitly applying HFSS food and drink advertising restrictions to in-game advertising. Existing ad partnerships need to be checked at product level, not just brand level.
Germany's age ratings are enforceable, not advisory. Platforms must apply them properly, and regulators can require technical changes or restrict access. The risk is not just fines - it is losing market access.
Beyond COPPA, the US is fragmented. California is the main benchmark because its protections extend up to age 18 and often set the highest compliance standard for national publishers.
Italy treats loot boxes and similar mechanics as close to gambling where minors are concerned. In practice, games using these systems should assume gambling-style advertising restrictions may apply.
Gambling advertising is the loudest regulatory issue in sport, but it is far from the only one. Alcohol sponsorship, athlete and sports personality endorsements, energy drink marketing, and the advertising environment around youth sport are all under increasing scrutiny across every market in this debrief. Brands and rights holders that focus only on gambling compliance are missing a significantly wider picture. Three things are now common across all markets:
There is no market in this debrief where it is acceptable to deliberately target either category at minors in a sports context. This applies to broadcast, digital, sponsorship, and any creator or influencer activity connected to sports properties.
Athletes with large under-18 followings can be treated as high-risk endorsers under advertising rules. Depending on the market and product category, their promotions may need clear disclosures and may be restricted if they are likely to have strong appeal to children or young people.
Responsibility does not sit only with advertisers and broadcasters. Leagues, federations, and event owners are increasingly expected to control the advertising environment within their own properties - including digital and social distribution, not just broadcast.
Not all countries are included here - just the ones where you need to be specifically aware of local variations.
Decreto Dignità (2018) imposes a blanket ban on gambling advertising across broadcast, digital, print, and sports sponsorship - not just child-targeted content. Only state lottery products are exempt. Any sports property distributed in Italy, or brand sponsoring Italian sport, needs Italy-specific terms.
The 2026/27 Premier League shirt-front ban is only one part of wider reform. Gambling rules around live sport are tightening, HFSS restrictions now affect youth-audience sport, and athletes with young followings fall fully under ASA rules.
Royal Decree 958/2020 restricts gambling ads on broadcast TV to 1am–5am, effectively removing them from live sport. Alcohol ads aimed at under-18s are also banned, and athletes with young followings must meet AUTOCONTROL disclosure rules.
Gambling, alcohol, and tobacco sponsorship is banned in youth-facing sports contexts. International feeds often include ads that are not compliant for China, so rights holders need China-specific ad clearance. Athlete endorsements also face strict rules.
Sports betting ads are legal in most states, but rules vary and almost all ban content directed at under-18s. League rules add further limits, and FTC endorsement rules apply fully to athletes with young followings.
ANJ rules limit gambling advertising near minors, while ARCOM is increasing scrutiny of sports content reaching children through streaming and social media. Under the Loi Influence, athletes and sports creators must use #Publicité disclosure.
Influencer and creator disclosure is now a global norm. Every market in this debrief expects paid creator content to be clearly labelled, whether through law, industry codes, or both. The days of treating creator content as a disclosure-free space are over. The next big shift is algorithmic accountability: platforms are increasingly expected to protect children proactively through recommendation systems, default settings, and parental controls, rather than simply reacting once harm has happened. Four themes now appear across almost every market:
The wording varies by country, but the principle is universal: if a creator is being paid, that relationship must be disclosed.
That applies across influencer, creator, streaming, and social content.
Services with significant child audiences are increasingly expected to build in protections at platform level, not just moderate content after complaints.
That applies in creator and influencer environments just as much as in other forms of digital advertising.
Not all countries are included here - just the ones where you need to be specifically aware of local variations.
Major platforms must operate Minor Mode for under-18s, restricting usage, purchases, commercial features, and content. Influencer marketing and live commerce aimed at minors are heavily constrained, and enforcement is active.
Italy requires some large creators to register formally with AGCOM and comply with broadcaster-style standards. This is not just a creator issue - brands and agencies working with those creators need to check that compliance is in place.
France's Loi Influence made influencer regulation a legal matter, not just a self-regulatory one. Disclosure is mandatory, and some categories are prohibited in content accessible to minors.
Under the Online Safety Act, platforms with child audiences must take proactive steps to reduce children's exposure to harmful content. This goes beyond takedowns and complaints handling.
Brazil's Digital ECA bans emotional analysis tools in advertising directed at under-18s from March 2026. Agencies and platforms using sentiment or emotional response tools in youth-facing work should review this urgently.
Germany applies watershed-style restrictions online as well as on TV. Streaming services must enforce these technically, not just through editorial policy.
The UK's HFSS rules, introduced in January 2026, are the biggest change in food marketing regulation in years - and a strong sign of where other markets are heading. The overall trend is clear: away from voluntary codes and towards statutory restrictions on advertising unhealthy food and drink to children, especially in digital media. Three themes now appear across almost every market:
Whether through law or self-regulation, no major market in this debrief leaves child-directed HFSS advertising broadly unrestricted.
Advertising cannot take advantage of children's trust, inexperience, or vulnerability through misleading health claims, pressure tactics, or manipulative character use.
Advertising unhealthy food and drink in or around schools, educational content, or child learning environments is consistently restricted.
Not all countries are included here - just the ones where you need to be specifically aware of local variations.
The UK is the only market here with statutory HFSS restrictions already in force. Products that meet the HFSS definition cannot be advertised in paid online media at any time, or on TV and video-on-demand before 9pm. The rule applies to individual products, not whole brands.
China prohibits unhealthy food advertising in or near schools and actively enforces child-specific advertising rules. Global compliance approaches often miss the detail of local enforcement.
Brazil's Digital ECA, effective March 2026, restricts emotional manipulation in advertising to minors. That creates a direct challenge for many child-focused fast food and QSR creative approaches.
Germany, France, Spain & Italy: still self-regulated, but likely not for longThese markets still rely mainly on self-regulatory frameworks, but the political and regulatory direction points towards stronger EU-wide statutory restrictions, especially in digital media.
Spain's PAOS Code applies specifically to under-12s, which means campaigns aimed at older children may still need separate review if younger audiences are likely to be reached.
There is no federal HFSS advertising law in the US, but CFBAI voluntary pledges from major QSR and food brands create real compliance obligations for members. The FTC is actively studying whether to legislate, and state-level bills are advancing. Treat current voluntary standards as temporary.
The UK's Children's Code has become the model for child platform regulation worldwide. Its core principles are now either in force or emerging across most major markets: stronger age checks, high-protection defaults, limits on data use, and a tougher stance on harmful or manipulative design. Five themes now appear across almost every market:
Age verification or robust age estimation is increasingly becoming a baseline requirement.
Privacy, communications, content exposure, and ad settings are increasingly expected to default to the most protective option.
Age thresholds vary, but the principle is consistent - children's data should not be used to target commercial content.
Supervision, time limits, and usage controls are no longer just nice features. In many markets, they are becoming required.
The global direction is towards proactive risk reduction through system design, not just takedowns after complaints.
Not all countries are included here - just the ones where you need to be specifically aware of local variations.
China requires verified Minor Mode, with limits on time, purchases, notifications, and accessible content. These rules are enforced actively and need a China-specific compliance approach.
The Children's Code is already live, and the Online Safety Act adds further obligations around proactive child safety. Together they make the UK one of the most developed enforcement environments.
From March 2026, Brazil's Digital ECA bans profiling-based advertising to under-18s and restricts technologies such as emotional analysis in child-directed advertising. For platforms, that means changes to ad systems, not just policy wording.
Federal law is limited, but state laws - especially California's - are creating de facto national obligations. Large platforms often need to build to the toughest state standard.
German regulators can require technical changes or block access entirely. That makes non-compliance more than a fines issue.
Spain is moving towards a Children's Code-style framework, which would require child-specific impact assessments and stronger platform protections.
As with all summaries, we are sure you will have loads of follow-up questions. Accompanying this debrief we have created a chat bot that is fully loaded with every country's legal rulings and guidelines - so you can ask it anything, from "Can we run this campaign in Germany?" to "What counts as HFSS in the UK?"
Ask the Rules & Regs Chat Bot →The rules and regulations in this debrief exist for good reason. Children process commercial messages differently, they are more susceptible to influence, and they deserve protection from advertising that exploits that vulnerability. The regulatory frameworks covered here - however complex, however fragmented, however fast-moving - are all working towards the same end.
At We Are Family, that goal is not in tension with our work. It is the foundation of it. Every campaign we develop, in every market, is built to meet not just the letter of the rules but the intent behind them. We do not treat compliance as a constraint. We treat it as a baseline, and we hold ourselves to a higher standard than the minimum.
If any of the regulations in this debrief raise questions about campaigns you are currently running or planning, we would rather have that conversation early than late.
Every regulator, law, and piece of jargon used in this debrief - decoded. Search or tap any term to expand it.
Agenzia delle Dogane e dei Monopoli. Italy's gambling regulator.
Advertising technology. The systems used to target, serve, optimise and measure digital advertising.
Agencia Española de Protección de Datos. Spain's data protection authority.
Autorità Garante della Concorrenza e del Mercato. Italy's competition and consumer protection authority.
Autorità per le Garanzie nelle Comunicazioni. Italy's communications and audiovisual regulator.
Artificial intelligence. In this context, usually refers to AI-generated or AI-assisted content and systems.
Autorité Nationale des Jeux. France's gambling regulator.
Autoridade Nacional de Proteção de Dados. Brazil's data protection authority.
Agência Nacional de Vigilância Sanitária. Brazil's health regulator, including food labelling and claims.
Augmented reality. Digital content layered onto the real world through a screen or device.
Autorité de régulation de la communication audiovisuelle et numérique. France's audiovisual and digital communications regulator.
Autorité de Régulation Professionnelle de la Publicité. France's advertising self-regulatory body.
Advertising Standards Authority. The UK regulator for advertising standards.
Spain's advertising self-regulatory body.
Audiovisual Media Services Directive. EU rules covering broadcast and on-demand audiovisual media.
The UK advertising code for broadcast media.
Advertising based on a person's behaviour, interests or online activity, rather than just the content they are viewing.
Bundeszentrale für Kinder- und Jugendmedienschutz. Germany's Federal Centre for the Protection of Children and Young People in the Media.
Cyberspace Administration of China. China's main internet regulator.
The UK advertising code for non-broadcast media.
Children's Advertising Review Unit. A US self-regulatory body focused on advertising to children.
Código Brasileiro de Autorregulamentação Publicitária. Brazil's advertising self-regulatory code.
Children's Food and Beverage Advertising Initiative. A US industry pledge programme covering food and drink advertising to children.
Media, content or services aimed at children.
Competition and Markets Authority. The UK's competition and consumer protection regulator.
Commission nationale de l'informatique et des libertés. France's data protection authority.
Comisión Nacional de los Mercados y la Competencia. Spain's competition and markets regulator.
Using personal data to analyse or classify users for advertising or marketing purposes.
Conselho Nacional de Autorregulamentação Publicitária. Brazil's advertising self-regulatory body.
Advertising based on the content being viewed, rather than on personal data or behavioural tracking.
Children's Online Privacy Protection Act. The main US federal law governing the collection and use of personal data from children under 13 online.
Design choices that push users into actions they did not intend, such as sharing more data or making purchases.
Direction générale de la concurrence, de la consommation et de la répression des fraudes. France's consumer protection and anti-fraud authority.
Brazil's child-focused digital law, introducing stronger protections for under-18s online, including restrictions on profiling-based advertising.
Digital Markets, Competition and Consumers Act. A UK law strengthening consumer and competition enforcement powers.
Data Protection Authority. A general term for a country's privacy regulator.
Digital Services Act. EU rules covering the responsibilities of online platforms and digital services.
Estatuto da Criança e do Adolescente. Brazil's Child and Adolescent Statute.
The use of tools or systems to infer, track or respond to a child's emotional state for advertising or commercial purposes.
Federal Communications Commission. A US communications regulator.
Food and Drug Administration. A US regulator covering food, medicines and certain advertising claims.
Federal Trade Commission. The main US regulator for consumer protection, advertising practices and privacy enforcement.
Garante per la protezione dei dati personali. Italy's data protection authority.
General Data Protection Regulation. The EU's main data protection law.
High in fat, salt or sugar. A category used in advertising regulation for foods and drinks considered less healthy.
Istituto dell'Autodisciplina Pubblicitaria. Italy's advertising self-regulatory body.
Information Commissioner's Office. The UK's data protection authority.
A clear label showing that content is paid-for or part of a commercial relationship, such as #ad or equivalent local wording.
Jugendmedienschutz-Staatsvertrag. Germany's Youth Media Protection State Treaty, covering broadcast and online services.
Jugendschutzgesetz. Germany's Youth Protection Act.
Kommission für Jugendmedienschutz. Germany's Commission for the Protection of Minors in the Media.
Kids Online Safety Act. A proposed US law focused on online child safety.
Lei Geral de Proteção de Dados. Brazil's general data protection law.
Landesmedienanstalten. Germany's state media authorities.
France's law governing influencer marketing and commercial creator content.
Paid or monetised random-reward game mechanics that are increasingly treated by regulators as gambling-adjacent where minors are involved.
Ley Orgánica de Protección de Datos Personales y garantía de los derechos digitales. Spain's national data protection law.
Ministry of Civil Affairs. A Chinese government body involved in child welfare and protection.
Ministry of Social Development. A Brazilian government body involved in children's rights and protection.
A child-protection setting or operating mode that limits content, features, spending, time spent and other platform functions for younger users.
Likely to be accessed by children or teenagers, even if not specifically designed for them.
Ministry of Public Security. A Chinese government body involved in enforcement.
The UK communications regulator, including oversight of broadcasting and online safety duties.
Online Safety Act. The UK law imposing safety duties on platforms, including specific protections for children.
Spain's code governing food and drink advertising to children, especially younger audiences.
Settings or tools that allow adults to supervise or limit a child's access, spending, communications or screen time.
Personal Information Protection Law. China's main personal data protection law.
Designing services so the most protective privacy and safety settings are switched on automatically.
The inclusion of a branded product or brand reference within entertainment or editorial content.
Using personal data to assess or predict behaviour, interests or characteristics, often for advertising or targeting.
Quick-service restaurant. A fast food or limited-service restaurant brand.
Italy's national public broadcaster.
A requirement for users to verify their real identity, often using official ID.
Spain's public broadcaster.
State Administration for Market Regulation. China's advertising and market regulator.
Software development kit. A package of software tools used by developers, including in-app advertising or analytics tools.
Rules created and enforced by industry bodies rather than directly by government.
Secretaria Nacional do Consumidor. Brazil's national consumer protection authority.
A person used to represent, endorse or promote a brand in advertising.
A French law strengthening the regulation of the digital environment, including age verification and platform responsibilities.
Advertising delivered to a user based on their personal data, profile or behaviour.
Unterhaltungssoftware Selbstkontrolle. Germany's age rating system for video games.
Video on demand. Streaming or on-demand video services.
Virtual reality. Fully immersive digital environments.
A time-based broadcasting threshold after which more adult content may be shown.
Extended reality. An umbrella term covering immersive technologies such as AR and VR.
