IANAL. However, my answer to that question would be “it’s a good idea.” COPPA specifically calls out collecting device identifiers and cookies as personal info

IANAL. However, my answer to that question would be “it’s a good idea.” COPPA specifically calls out collecting device identifiers and cookies as personal information. Here’s the money line: “It shall be unlawful for any operator of a Web site or online service directed to children, or any operator that has actual knowledge that it is collecting or maintaining personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed under this part.” Note “directed to children.” If your game isn’t directed to children, you’re fine, but that’s a terribly fuzzy definition. In practice I would recommend taking the safe road and age gating for games. Again, I am not a lawyer. Edit: I read the complaint and Epic was explicitly marketing to ages 10+, so this wasn’t at all fuzzy for them.