Why it matters
In the US, COPPA requires verifiable parental consent before collecting personal information from children under 13 on sites directed to them, and the FTC enforces it. The UK Children's code applies to online services likely to be used by under-18s. Under GDPR, consent from a child for online services needs a parent's authorisation below 16, or a lower age set by each country (not below 13). Ad trackers on a children's site are a particular problem.
How Patch checks
We use your onboarding answer, or what your homepage suggests, to decide whether children are part of your audience. Then we look at the forms and trackers on your site and whether your privacy policy says anything about children.
How to fix it
- Decide who the site is for. If it's for adults (for example, parents), say so in your privacy policy and terms.
- If children use it, remove ad and tracking services and collect as little as possible.
- In the US, get verifiable parental consent before collecting personal information from under-13s.
- In the UK, work through the ICO's Children's code, starting with high-privacy default settings.
Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.
Where this applies
COPPA applies to sites directed at under-13s in the US or with actual knowledge of them. The UK code covers under-18s.