{{item.videoDuration}}
{{item.title}}
{{item.text}}
{{item.videoDuration}}
{{item.text}}
Key takeaways:
- Younger consumers create new risks. Kids increasingly interact online with brands and make purchases at younger ages, even as regulations create new responsibilities for consumer companies to safeguard youth data and privacy.
Some organizations are winging it. Many consumer companies don’t have the processes and governance in place to handle youth data in a secure and compliant way, which can expose them to regulatory, financial, and reputational risks.
Companies need to be proactive. Consumer companies can get ahead of this challenge by analyzing the business implications of evolving youth privacy rules, revamping internal processes, and creating age-appropriate experiences for their consumers.
Consider some common scenes happening in households across America: A teen orders dinner on a delivery app. An adolescent puts school supplies into a digital shopping cart. A tween clicks on a link in an influencer’s video to buy a co-branded hoodie. For consumer companies, these transactions could be the beginning of an ongoing and profitable customer relationship, or they could be a regulatory liability.
As PwC's Generation Alpha Survey 2026 showed, the moments that anchor brand loyalty—a first purchase and a first repeat order—are arriving earlier in childhood, and that loyalty is increasingly won through digital availability and personalization, rather than product quality or physical proximity. At the same time, scrutiny is growing over how digital interactions are shaping kids. (Witness the recent state-level actions targeting social media.) Youth privacy and safety concerns are expanding beyond content moderation on social and gaming platforms. Those concerns can increasingly affect the commercial operations of consumer companies. Regulatory expectations are growing, and so is accountability.
Currently, many consumer companies don’t have the governance in place to identify, segregate, or apply distinct rules to their teen customers. Age signals, usage patterns, and purchase behavior are often already moving through marketing and analytics systems with no enterprise-wide visibility into where that data goes or how it’s used. That could leave companies exposed to new regulatory, financial, and reputational risks.
The good news? Because relatively few businesses have taken action in this area, consumer companies have a window of opportunity to differentiate themselves.
Becoming more proactive about identifying young consumers—and creating compliant, age-appropriate customer experiences for them—can help companies win business, stay on the right side of emerging laws, and forge stronger relationships with kids and parents alike.
More data means growing complexity
Several recent regulatory changes make youth data complex to manage. One such change is that companies don’t have to market explicitly to kids to cross the line. Retailers, travel and hospitality companies, consumer packaged goods (CPG) businesses, and direct-to-consumer brands may not pitch their products and services directly to kids and teens. But these organizations operate apps, loyalty programs, delivery platforms, connected products, agentic commerce, and digital storefronts that minors already use. That makes the companies liable for handling the data from those interactions responsibly, especially when they involve youth data.
Many states now have regulations stipulating that if a company’s products are “reasonably likely” to be used by minors (or if its digital marketing is likely to be seen by minors), the company has a responsibility to manage that relationship, regardless of whether the company built the products with that audience in mind. (See “The regulator’s view on marketing to kids,” below.)
Another complicating factor is that different age groups require different levels of data sensitivity. Many laws, including the Federal Trade Commission’s Children’s Online Privacy Protection Act (COPPA), specifically define “children” as younger than 13, and they treat teens as a separate bucket of “minors” up to age 17, with different rules for the two groups. Privacy and safety concerns for young people span the whole range, and getting things right means building age-appropriate safeguards that differ for a 9-year-old, a 12-year-old, and a 16-year-old, not applying a single approach across all of them.
Collectively, these changes can create three types of risk for consumer companies:
- Regulatory risk. Companies that don’t update their processes regarding youth data privacy and safety risk running afoul of new federal and state rules and enforcement actions.
- Financial risk. Complying with new rules could mean companies have to make immediate changes in how they market to a significant share of their customer base. For example, once a company knows definitively that certain customers are below 18, those customers become off-limits for future marketing efforts, which has a direct impact on sales.
- Reputational risk. As concerns grow about the impact of digital technology, some parents are quicker to write off brands that they feel are interacting with kids in aggressive or unethical ways. A single negative story on social media or in the press could have a disproportionate impact on a company’s public standing.
The regulator’s view on marketing to kids
Even if a company doesn’t directly sell or market to kids, regulators can look at other factors and determine that its products and messages are “reasonably likely” to be seen by minors.
| Indicator | What regulators consider | How regulators view the indicator |
|---|---|---|
| Internal data |
|
Evidence that minors are already using the product (this is the most difficult signal for companies to claim they don’t know about) |
| Product and user experience |
|
Design choices that appeal to younger users, regardless of who the product was originally built for |
| Marketing and commercial content |
|
Go-to-market choices that put the brand in front of a younger audience, even unintentionally |
| External factors |
|
Evidence from outside the company’s own data that a product category skews toward minors |
Small design and policy decisions can accumulate into significant exposure if left unexamined.
Companies choose trust or risk at each step
At each juncture of a young consumer’s brand interaction, organizations make choices that can increase privacy and safety risks (and regulatory scrutiny) or build trust and sustain the relationship. These decisions play out across five familiar stages of the customer journey—awareness, engagement, consideration, conversion, and retention—each of which carries its own risks and opportunities when the customer is a minor.
- Awareness. Behavioral ad targeting minors is already restricted under COPPA, but for Gen Alpha, initial awareness happens largely on social platforms, where 61% already say social media makes them want to buy something. That creates risks for companies about what minors may encounter, how they may be influenced, and whether interactions or recommendations introduce avoidable harm.
- Engagement. Privacy-focused defaults for minors, like automatically limiting profiling and location, are already required in several jurisdictions, and regulators are increasingly scrutinizing engagement mechanics that nudge young people toward extended use. Companies can design a youth-specific user experience with simpler language and age-range-specific graphics to keep kids engaged. (According to PwC’s survey on Gen Alpha, roughly half of children cite too many ads, and a similar share cite plain boredom, as the reasons they abandon an app.)
- Consideration. Many existing and proposed laws require parental consent for data collection to enable certain features or data sharing with the app or website. One leading practice is proportionate age assurance: for example, collecting age information only where a product actually needs it, not as a default data grab.
- Conversion. Design elements like spending limits, purchase confirmations, and parent notices keep young consumers moving toward purchases while staying inside app-store and youth-monetization approval requirements.
- Retention. Retention is the stage that can significantly test a brand’s youth data practices because it entails retaining and using consumer data over time. Both re-marketing and profiling of young consumers are increasingly constrained, and youth data can be retained only if it serves the purpose it was collected for.
Companies should build permission-based loyalty with parent-visible benefits.
Five moves consumer markets leaders can make
Consumer companies have both commercial and ethical reasons to act. Commercially, children are highly brand aware and have a direct influence on purchases for themselves and their households. They spend their parents’ money today, but they are expected to spend their own money soon, making them a future base of consumers. Ethically, companies have an inherent obligation to treat young customers responsibly, in a non-predatory way, by cultivating a relationship based on trust.
To better manage youth data, companies should determine which rules apply and which of their products, data flows, interactions, and business units are affected before investing in controls. From there, consumer markets companies can build a risk-based operating program focused on the areas of greatest exposure.
1. Determine where minors are already in your ecosystem. Do not assume that because your products are not designed for children, your business is outside the issue. Conduct a business-impact study to quantify the number of minors in your addressable base, and understand the implications of evolving regulations for future growth.
Assess where minors are reasonably likely to access your products, services, and digital touchpoints, and which signals suggest that they already do. Consider geography, product and service features, audience models, and youth-specific harms. Accurately documenting that assessment helps create a defensible foundation for later decisions.
2. Strengthen data governance broadly, and then govern children’s data as a distinct risk within it. Map where children’s data, age signals, inferred attributes, purchase information, and youth-relevant interactions exist within the company and across third parties. Improve areas where the enterprise’s data governance isn’t mature enough to create that level of visibility. Define how that information may be collected, used, shared, retained, and deleted, and assign clear ownership for those definitions. Reduce the data collected, limit it to an explicit purpose, and avoid exploiting sensitive attributes. For example, 81% of kids report having influence over a household’s skincare and beauty purchases, but companies should not use that insight to develop behavioral or biometric profiles.
3. Design marketing experiences and purchasing processes for both the child and the parent. Parental tools remain important, but the company’s privacy and safety measures should not depend entirely on the parent knowing every transaction or interaction that is taking place. Most companies already have parental controls in place, but they’re often too easy to get around or too cumbersome for parents to bother with. Design parental controls to be more intuitive and user-friendly, balancing accessibility with youth safety and privacy. Create privacy-focused defaults, age-appropriate design and notices, nudges that inform rather than manipulate, and purchase experiences that are supervised or shared. Limit the use of profiling and behavioral advertising. Provide clear, age-appropriate notices, genuine choice over profiling, and clear understanding of how data is used.
4. Address content and interaction risks where they exist. Identify where the business uses social features, product reviews, creator content, messaging, recommendations, gamification, or AI-enabled experiences—all of which can make products more likely to attract Gen Alpha consumers. Assess what experiences minors may encounter, how content and commercial prompts may influence them, and which monitoring, escalation, and remediation processes are necessary. Look at loyalty programs to help determine where you might need to make changes to back-end processes. For example, an airline that knows teens are using a parent’s miles account can adjust the offers made to that account, in areas such as the choice of in-flight beverages and entertainment.
5. Build flexible governance and create a paper trail. Move beyond written policies to documented practices. Establish clear ownership; product and data risk assessments; and formal processes for approval, monitoring, issue escalation, third-party oversight, and evidence management. The goal is a program that can adapt as laws and expectations change, rather than a collection of one-off fixes.
The digital interactions of young consumers can create both new risks and new opportunities for brands. Handle that early data relationship carelessly, and it can become a liability with regulators and with the parent on whose trust the brand already depends. Handle that relationship with care, and a brand earns something rare and durable: trust that compounds as these children grow into adult buyers with their own wallets, leading to brand relationships that can last for decades.
For a brand, acting early on these issues can earn trust that compounds as young consumers grow into adult buyers with their own wallets.
Stay ahead of what’s next
At PwC, we help organizations secure critical data and manage technology risks in a way that helps keep pace with the business.
{{filterContent.facetedTitle}}
{{contentList.loadingText}}
{{contentList.loadingText}}
Follow us
