Children's Privacy Laws Are Reshaping Programmatic Targeting

The ad industry has spent years treating children’s privacy like a smoke alarm with a low battery — annoying, technically a problem, easy to ignore until something catches fire. That fire is now very much lit.

AdExchanger’s Allison Schiff reported last week that regulators are systematically dismantling the “actual knowledge” standard under COPPA — the legal fiction that allowed operators to collect data from under-13 users as long as they could claim ignorance. The FTC’s posture has shifted: proximity to likely-minor audiences now constitutes constructive knowledge, regardless of what your intake forms say. For programmatic teams running broad demo targeting across entertainment, gaming, or education verticals, this is not a future risk to be risk-registered. It’s a present operational problem.

The ‘Actual Knowledge’ Loophole Is Closed

For most of the past decade, “actual knowledge” functioned as a compliance get-out-of-jail card. If your platform didn’t explicitly ask a user’s age — or conveniently made that field optional — you technically lacked confirmed knowledge that you were serving a minor. Ingeniously cynical. Increasingly indefensible.

The regulatory direction is now toward probabilistic inference: if your inventory skews toward content that minors demonstrably consume, you are expected to treat that audience accordingly. YouTube faced exactly this in 2019 with a $170 million FTC settlement — the largest in COPPA history at the time — for serving behavioural ads against content clearly directed at children. The precedent was set then. What’s changed in 2026 is the enforcement appetite and the sophistication of regulators’ technical arguments.

For programmatic buyers, this means that any DSP segment built on broad interest categories — anime, mobile gaming, K-pop, certain sports — now carries compliance surface area that your legal team probably hasn’t fully mapped.

What This Means for Your Targeting Stack

The practical implication isn’t just legal exposure — it’s a structural audit of how your audience segments are constructed and validated. Most DMP and DSP configurations in Southeast Asia were built for reach optimisation, not age-signal verification. That’s a meaningful gap.

Three immediate pressure points for programmatic teams:

Segment provenance. Do you know where your third-party audience data originates? Many data providers operating in Southeast Asia licence segments from global brokers who built those pools under pre-2024 consent frameworks. If those segments include inferred interests common among minors, you have inherited liability.

Contextual adjacency. Running display on a news aggregator that also hosts gaming content? Your brand safety filters may be blocking violent content but doing nothing to flag minor-adjacent inventory. Contextual targeting needs a dedicated age-suitability layer, not just brand safety keywords.

Frequency and behavioural signals. Regulators have started scrutinising whether bidding patterns — particularly aggressive retargeting on mobile app inventory — suggest a platform is knowingly engaging younger users through behavioural signals, even without explicit age data.

In Southeast Asia specifically, the challenge is compounded by platform ecosystems where age-gating is functionally unenforced. Shopee, TikTok, and mobile gaming platforms have massive under-18 user bases that are largely invisible in the data because no one is asking the question cleanly.

---

Apple’s Ad Network Ambitions Add Another Variable

Separately, AdExchanger flagged that Apple Ads is getting a meaningful capability upgrade — expanding its inventory and targeting reach in ways that will make it a more serious consideration in media plans. This matters in the privacy context because Apple’s SKAdNetwork and App Tracking Transparency framework are precisely the architecture that’s been hardest to reconcile with legacy programmatic workflows.

For Southeast Asian markets with high iOS penetration — Singapore sits above 50% iPhone market share — Apple’s ad network becoming more capable is both an opportunity and a complexity. On one hand, Apple’s privacy-by-design framework actually gives you a cleaner compliance posture for age-sensitive campaigns: the data minimisation is structural, not discretionary. On the other hand, measurement is materially limited compared to open-web programmatic. You’re trading signal richness for compliance confidence, which is a trade-off media planners need to be making consciously, not by default.

The brands that will navigate this well aren’t the ones with the most sophisticated targeting. They’re the ones who’ve done the unglamorous work of mapping their audience data supply chain — knowing exactly where every segment came from, what consent mechanism underpins it, and which inventory channels carry what regulatory surface area.

Building a Compliance-Ready Programmatic Operation

This isn’t an argument for pulling back on programmatic. It’s an argument for building it properly. Three concrete steps:

1. Run a segment audit against age-signal proxies. Pull your active audience segments from your DSP and cross-reference interest categories against content consumption patterns associated with under-18 audiences. Flag anything in gaming, entertainment, or education for additional scrutiny.

2. Establish contextual guardrails at the placement level. Work with your supply partners to build exclusion lists not just for brand safety but for age-suitability. This is distinct from content category blocking — it requires mapping inventory to audience demographic likelihood.

3. Document your inference logic. If you’re using lookalike modelling or interest expansion, document what seed audiences those models are built from and what safeguards prevent them from modelling into minor-adjacent pools. Regulators are increasingly asking for this paper trail.

The holding company landscape is already under strain — Digiday’s coverage of GroupM’s challenges in China is a useful reminder that external market pressures don’t wait for internal compliance timelines to resolve. You cannot run a credible regional operation if your programmatic foundation is one regulator’s letter away from a media freeze.

The real question isn’t whether children’s privacy enforcement will affect your campaigns — it already does. The question is whether you’re the team that discovered the problem through an audit, or through a news cycle.

---

grzzly works with digital and growth teams across Southeast Asia to audit and rebuild programmatic operations that are both performance-driven and structurally sound — because compliance and efficiency aren’t actually opposites, they just require different thinking to align. If your targeting stack was built for scale and you’re not sure it was built for 2026, that’s worth a conversation. Let’s talk