If I have a F2P game on mobile, do I then have to force ask the users age at the start to track things like DAU without getting potentially sued because I was unintentionally without knowing tracking < 13 years?

IANAL. However, my answer to that question would be “it’s a good idea.”

COPPA specifically calls out collecting device identifiers and cookies as personal information. Here’s the money line:

“It shall be unlawful for any operator of a Web site or online service directed to children, or any operator that has actual knowledge that it is collecting or maintaining personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed under this part.”

Note “directed to children.” If your game isn’t directed to children, you’re fine, but that’s a terribly fuzzy definition. In practice I would recommend taking the safe road and age gating for games. Again, I am not a lawyer.

Edit: I read the complaint and Epic was explicitly marketing to ages 10+, so this wasn’t at all fuzzy for them.

Thank you, that makes sense.

Yeah, I don’t know what the big deal is with people in this thread saying, “bah, this is impossible” but I work on a COPPA compliant game and “chat off for kids by default” is absolutely a must.

It’s because a lot of engineers get hung up in the “oh there’s so many ways to defeat this” mindset, and forget that perfect is the enemy of good.

Sensible defaults are a good enough start and many regulations like this are based around best efforts , not absolute perfection.

Yup. It’s both true that the age gate is easy to defeat and that it helps in practice.

It seems so pointless though.

I was signing up for all sorts of things when I was a kid. Nothing bad by any stretch of the imagination but I knew when they asked "are you 13" you just click "yes" and you're good to go.

Seems like a "feel good" solution that will collectively waste thousands of hours. I don't see why this is required, quite honestly.

It is somewhat performative but it does save some percentage of children who are honest about it, and at the very least it lets you pass the buck to the user.

Yeah it’s easily defeated but so is wearing seatbelts when you drive.

There's also the fact that the kid who is enough of a dope(/trusting/rule and authority abiding) to not know he can lie on the form is also the most likely to be victimized by adults online.

This is a similar selection effect to misspelled Nigerian prince emails, so I'd say it's a pretty good mechanism actually.