Under-18 age verification users have a Teen Privacy Policy
Users under 18 who verify their age through KWS are directed to an additional Teen Privacy Policy. Employees, contractors and authorised users of Partner companies are directed to a separate Partner Privacy Policy. Those linked documents are not supplied here.
Details not recorded for this card
Supporting quotations
If you are under 18 and using KWS to verify your age, you can also view our
If you are an employee, contractor, or authorised user of one of our Partner companies
Legal Rights & Agreement Rules · Context
Kids Web Services Ltd is responsible for information collected through KWS
Kids Web Services Ltd is the responsible legal entity and belongs to the Epic Games family of companies. The policy directs questions to its Contact Us section.
Details not recorded for this card
Supporting quotations
The legal entity responsible for the information that we collect through KWS is Kids Web Services Ltd (we / us). Kids Web Services Ltd belongs to the
If you have any questions about this Privacy Policy, please see the Contact Us section at the bottom.
Legal Rights & Agreement Rules · Company practice
Partners are controllers for Kid Account Management where GDPR applies
KWS sometimes provides account management for Partners’ child users. Where GDPR applies, Partners control personal information processed in Kid Account Management; their privacy policies explain their use. KWS disclaims responsibility for Partners’ privacy practices.
Details not recorded for this card
Supporting quotations
On occasion, we also provide account management services for our Partner’s end-users who are children, which we call Kid Account Management services. Where the GDPR applies, our Partners act as a controller for personal information processed as part of the Kid Account Management services.
you should read the Partner’s privacy policy to understand how the Partner uses your personal information for these services. We are not responsible for the privacy practices of the Partner.
Legal Rights & Agreement Rules · Company practice
ESRB certification has method and implementation conditions
KWS says it participates in ESRB Privacy Certified, an FTC-approved COPPA Safe Harbor program with independent audits, enforcement and accountability mechanisms. Its consolidated Parent Consent Management and Parent Verification technology is reviewed and certified, including AgeGraph when a parent verifies adult status using a COPPA-compliant method. The policy says these technologies facilitate COPPA compliance when Partners implement them correctly; it does not promise every implementation is compliant.
Details not recorded for this card
Supporting quotations
a Federal Trade Commission (FTC)-approved COPPA Safe Harbor Program.
As a licensee in this privacy certification program, we are subject to audits of our services and other enforcement and accountability mechanisms administered independently by
The technology behind our consolidated Parent Consent Management and Parent Verification solution has been reviewed and certified by ESRB Privacy Certified. This includes AgeGraph, when the parent has verified their adult status using a COPPA-compliant verification method.
When implemented correctly by our Partners, these technologies facilitate compliance with the US Children’s Online Privacy Protection Act (COPPA).
Qualifications & exceptions
AgeGraph inclusion requires a COPPA-compliant adult-verification method.
Facilitating COPPA compliance depends on correct Partner implementation.
Not stated here
The linked ESRB program and certification documents are not supplied; this card reports KWS’s statements, not independent certification terms or verification.
Legal Rights & Agreement Rules · Context
kidSAFE certification applies when KWS uses its default templates
KWS states it is certified by the kidSAFE Seal Program when implemented with KWS’s default templates.
Details not recorded for this card
Supporting quotations
Kids Web Services (KWS) is certified by the kidSAFE Seal Program when implemented with KWS’ default templates.
Legal Rights & Agreement Rules · Company commitment
KWS ties processing to purpose-specific legal bases
KWS says it uses information only with a valid reason and legal basis determined by the purpose. Bases may include requested contractual services or pre-contract steps, legitimate interests not overridden by your interests or fundamental rights and freedoms, legal or regulatory duties, vital interests, and consent for specified purposes. Consent can be withdrawn at any time where relied on, without affecting prior processing’s lawfulness. For legitimate-interest processing you may object on rights grounds; KWS says it will stop unless it has compelling legitimate grounds or legal reasons.
Details not recorded for this card
Supporting quotations
We use the information we collect only when we have a valid reason and legal basis to do so. We determine the legal bases based on the purposes for which we collect your information.
to provide a service you’ve asked for under a contract we have entered into, or which we are about to enter;
where it is necessary for our legitimate interests provided that your interests and fundamental rights and freedoms do not override those interests;
where we need to comply with a legal or regulatory obligation or to protect your vital interests;
where we ask for your consent to process your information for specific purposes and you have the right to withdraw your consent at any time.
Right to withdraw consent: Where you have previously provided your consent, you have the right to withdraw consent at any time where we are relying on consent as the legal basis upon which to process your personal information. However, this will not affect the lawfulness of the processing based on consent before its withdrawal.
Right to object (legitimate interest): Where we process your personal information based on legitimate interests, you can object to this processing where you feel it impacts on your fundamental rights and freedoms. Unless we have compelling legitimate grounds or where it is needed for legal reasons, we will cease processing your information when you object.
Qualifications & exceptions
Legitimate interests are subject to your overriding interests and fundamental rights and freedoms.
Withdrawal applies where consent is the processing basis and does not retrospectively undo lawful processing.
Objection may be overridden by compelling legitimate grounds or legal reasons.
For ID Scan & Selfie, KWS lists explicit consent for biometric processing and says this use also serves the substantial public interest in safeguarding children. Face scan relies on consent in certain jurisdictions; ConnectID relies on consent when selected. These statements concern the chosen method, not every age check.
Details not recorded for this card
Supporting quotations
Explicit consent for biometric processing where you select ID Scan & Selfie as your verification method to verify your age. Use of your biometric data for these purposes is also in the substantial public interest to safeguard children.
Consent in certain jurisdictions if you select face scan as your verification method to verify your age.
Consent if you select ConnectID as your verification method to verify your age.
Qualifications & exceptions
The face-scan consent basis is stated only for certain jurisdictions.
Legal Rights & Agreement Rules · Company practice
AgeGraph relies on interests in reducing repeat collection and easing parental consent
KWS identifies legitimate interests for AgeGraph: avoiding repeated collection and processing of verification information, reducing collection and making verification safer, and making parental consent easier to obtain as part of its internet-safety mission. It says easier consent makes children more likely to be honest about age. The policy’s general condition still applies: legitimate interests must not be overridden by your interests and fundamental rights and freedoms.
Details not recorded for this card
Supporting quotations
For AgeGraph our legitimate interest in: (i) eliminating the need to collect and process Verification information more than once, minimising personal information collection and providing a safer service to you and our Partners; and (ii) pursuing our mission to make the internet safer by making it easier for you to provide, and children and our Partners to obtain, verifiable parental/guardian consent. The easier it is for you to provide—and children and our Partners to obtain—verifiable parental consent, the more likely that children will be honest about their age.
where it is necessary for our legitimate interests provided that your interests and fundamental rights and freedoms do not override those interests;
Qualifications & exceptions
Subject to the general limit for overriding interests and fundamental rights and freedoms.
Safety processing may rest on legal duties, vital interests or legitimate interests
The safety row’s legal-basis cell lists alternatives depending on circumstances: compliance with legal obligations, protection of vital interests, or legitimate interests in safe services, preventing fraud, unauthorised use, breaches and harmful or illegal activity, and protecting rights, property and interests. It also specifies privacy safeguards. This is the safety row’s basis, not the communications row’s basis that follows.
Details not recorded for this card
Supporting quotations
Depending on the circumstances, we rely on the following legal bases: (i) to comply with legal obligations; (ii) to protect vital interests; or (iii) our legitimate interest in providing a secure and safe service and preventing fraud and unauthorised use of our products and services, violations of our terms and policies or other harmful or illegal activity, and in protecting our and others' rights, property and interests, while applying appropriate safeguards that protect your privacy.
Qualifications & exceptions
The applicable basis depends on circumstances and the legitimate-interest basis includes privacy safeguards.
Legal Rights & Agreement Rules · Restriction or exception
KWS disclaims responsibility for linked third-party services
KWS correspondence may link to unaffiliated or independently operated websites, services or mobile apps, including Partners’ offerings. KWS accepts no responsibility or liability for those operators’ content, security or privacy practices.
Details not recorded for this card
Supporting quotations
Some of the correspondence you receive from us may contain links to third-party websites, online services or mobile applications that are not affiliated to or operated by us, including those of our Partners. We are not responsible and accept no liability for the content, security or privacy practices of those other operators.
Legal Rights & Agreement Rules · User right or choice
You may complain to KWS or a data-protection regulator
For concerns about data handling or legal rights, KWS directs complaints to privacy@kidswebservices.com. The policy also identifies rights to complain to the UK Information Commissioner or your local data-protection supervisory authority.
Details not recorded for this card
Supporting quotations
If you have a complaint about the handling of your personal data, or feel that we have not complied with your legal rights, please contact us by emailing
You also have the right to lodge a complaint with our supervisory authority, the UK Information Commissioner
You can also lodge a complaint with your local supervisory authority for data protection.
Legal Rights & Agreement Rules · Procedure
Australian residents can escalate unresolved inquiries to the OAIC
Location-specific rules depend on residence. An Australian resident dissatisfied with KWS’s response or resolution may complain to the Office of the Australian Information Commissioner at enquiries@oaic.gov.au or +61 1300 363 992.
Details not recorded for this card
Supporting quotations
Depending on where you are resident, specific rules apply.
If you are a resident of Australia and you are not happy with how we responded to your inquiry or it has not been satisfactorily addressed, you may lodge a complaint with the Office of the Australian Information Commissioner at enquiries@oaic.gov.au or +61 1300 363 992.
Qualifications & exceptions
For Australian residents dissatisfied with the response or handling of their inquiry.
Legal Rights & Agreement Rules · Procedure
US residents can contact ESRB Privacy Certified about unresolved inquiries
A US resident who believes KWS has not answered or satisfactorily handled an inquiry is directed to ESRB Privacy Certified at privacy@esrb.org or its linked online contact form.
Details not recorded for this card
Supporting quotations
If you are a resident of the United States and believe that we have not responded to your inquiry or it has not been satisfactorily addressed, please contact ESRB Privacy Certified at privacy@esrb.org or by using their online contact form
Qualifications & exceptions
Applies to US residents with an unanswered or unsatisfactorily handled inquiry.
Not stated here
The linked ESRB contact form is not supplied; its fields and handling process are not analyzed.
Legal Rights & Agreement Rules · Context
The California supplement uses CCPA definitions and covers KWS as a Business
For California residents, the supplement describes additional rights and details under the amended CCPA and regulations. Its capitalised terms, including Personal Information, Sensitive Personal Information, Sell, Share and Business, take their CCPA meanings. KWS says it acts as a Business in direct interactions, including age verification and AgeGraph. This is a California-specific role and does not substitute GDPR terminology.
Details not recorded for this card
Supporting quotations
This additional section applies to California residents because of the specific privacy laws in that state. It explains the additional rights and details required by the California Consumer Privacy Act of 2018, as amended, and its implementing regulations (CCPA). For the purposes of this section, Personal Information, Sensitive Personal Information, Third Parties, Business Purposes, Commercial Purposes, Sell, Share and Business have the meanings given to them under the CCPA.
We act as a Business when we interact with you directly, including when you verify your age and participate in AgeGraph.
Qualifications & exceptions
Applies to California residents and uses CCPA-defined terms.
California source, purpose and recipient disclosures refer to the main policy
The California supplement directs readers to the main collection section for source categories, the purposes-and-bases section for business or commercial collection purposes including sensitive information, and the sharing section for third-party recipient categories. It does not replace those sections with a different recipient or purpose list.
Details not recorded for this card
Supporting quotations
the categories of sources from which your Personal Information is collected, see Personal information we collect;
the Business Purposes or Commercial Purposes for collecting your Personal Information, including Sensitive Personal Information, see Why we collect your personal information and our legal basis for processing; and
the categories of Third Parties to whom we disclose your Personal Information, see Reasons we share your personal information.
Qualifications & exceptions
These cross-references are part of the California supplement.
Legal Rights & Agreement Rules · Context
Other-state disclosures refer to the main collection, purpose and sharing sections
The other-state subsection refers readers to the main policy for processed data categories, purposes, recipients and shared-data categories. For sensitive data from a known child under 13, it points to the child-information discussion. These references do not supply a new or unlimited processing permission.
Details not recorded for this card
Supporting quotations
the categories of personal data processed by us, see Personal information we collect;
our purposes for processing personal data, see Why we collect your personal information and our legal basis for processing;
the categories of third parties with whom we share personal data and the categories of personal data we shared, see Reasons we share your personal information; and
our processing of sensitive data from a known child under 13, see information relating to your child as set out here.
Legal Rights & Agreement Rules · Company practice
KWS may change the policy and gives additional notice in some cases
KWS may modify the policy at any time and will update its Last updated date. In some cases, such as material or substantive changes to policies and practices, it will also notify users by email or within KWS as appropriate. Users who object may seek deletion through the stated rights procedures; this reference does not remove the policy’s deletion conditions and retention exceptions.
Details not recorded for this card
Supporting quotations
We may modify this Privacy Policy at any time. When we do, we will update the ‘Last updated’ date on this Privacy Policy. In some cases, such as when we make material or substantive changes to our policies and practices, we will also notify you of the relevant changes by email or within KWS as appropriate.
If you object to any changes, you may delete your personal information as described in How to exercise your rights.
Qualifications & exceptions
Additional email or in-service notice applies in some cases, such as material or substantive changes.
Deletion follows the existing rights procedures and their limits.
KWS controls direct Parent Verification and Age Verification interactions under GDPR
Parent Verification checks that a child user’s parent or guardian is an adult; Age Verification checks an end-user’s age. Where GDPR applies, KWS is the controller responsible for personal information processed in direct interactions during those services, including verifying age or participating in AgeGraph.
Details not recorded for this card
Supporting quotations
service enables our Partners to verify that the parents or guardians of their child end-users are adults (Parent Verification).
Where the General Data Protection Regulation (GDPR) applies, we act as a controller of any personal information processed when you interact with us directly.
service enables our Partners to verify the age of their end-users (Age Verification).
Where the GDPR applies, we act as a controller of any personal information processed when you interact with us directly. For example, when you use our services to verify your age or participate in our AgeGraph.
Partners control information handled before referral and in their own interactions
For both Parent Verification and Age Verification, the Partner is the controller for processing before you reach KWS and when you deal with the Partner directly. KWS tells you to read that Partner’s privacy policy and disclaims responsibility for its privacy practices. This separates the Partner’s handling from KWS’s direct verification interactions.
Details not recorded for this card
Supporting quotations
The Partner is the controller of any personal information processed before you are directed to the KWS website and when you interact with the Partner directly.
We are not responsible for the privacy practices of the Partner.
The Partner is the controller of any personal information processed before you are directed to the KWS website and when you interact with the Partner directly.
you should read the Partner’s privacy policy to understand how the Partner uses your personal information.