Children age faster than databases do.
A ten-year-old becomes a teenager.
A teenager becomes an adult.
The row in a database may simply remain a row.
That creates a basic privacy problem: information collected in childhood can survive beyond the context that made its collection seem reasonable.
Retention turns childhood activity into history
A child’s online activity may be recorded by educational tools, games, video services, connected toys, apps, websites, advertising systems, or family accounts.
A single event may be harmless.
Years of events can become a profile of interests, habits, devices, locations, purchases, learning activity, and inferred preferences.
The risk is not that every company necessarily keeps all of that forever.
The risk is that persistent systems need an explicit rule for when childhood data stops being useful enough to retain.
In January 2025, the Federal Trade Commission finalized changes to the U.S. Children’s Online Privacy Protection Rule. Among other changes, the updated rule says covered operators may retain children’s personal information only as long as reasonably necessary for the specific purpose for which it was collected and explicitly says it cannot be retained indefinitely. See the FTC’s 2025 COPPA rule announcement.
That requirement applies to covered services and children under the rule’s scope.
The broader design lesson is about expiration.
Age transitions are not automatic deletion events
A service may know a birth date.
That does not necessarily mean every connected analytics system, advertising partner, or historical dataset automatically receives an instruction saying:
This person is now older. Reconsider the old record.
A profile assembled when somebody was eleven can therefore remain technically linkable after the person becomes thirteen, sixteen, or eighteen unless the system deliberately changes how the data is treated.
Old labels can also become misleading.
Children change quickly. Interests, family circumstances, schools, devices, and identities evolve. A classification produced years earlier may persist long after its predictive value collapses.
The key questions are about lifecycle
A useful audit asks:
- What childhood data is retained?
- What purpose still requires it?
- Is there a maximum retention period?
- What happens when the user crosses an age threshold?
- Are old advertising or inference labels deleted, reset, or merely carried forward?
- Do downstream recipients receive the same deletion or age-transition signal?
The FTC’s revised COPPA rule also requires separate parental consent for certain disclosures related to targeted advertising, reinforcing the difference between providing a child-facing service and monetizing the resulting profile.
The Surveillance Economy usually talks about collection as a moment.
Allow or Don’t Allow.
Children’s data exposes the missing second half of the problem.
A collection decision lasts seconds.
A profile can last years.
If a system has no answer for when childhood ends inside the database, the database may keep remembering a person who no longer exists.