A shield-shaped badge in a footer can look like a simple promise: this product is safe for children. In practice, the badge may prove only one narrow claim. It might cover U.S. privacy for children under 13, a Korean website’s privacy controls, the age suitability of one game, or an app store’s editorial review. Those are different tests.
For a child-facing AI game service, the distinction is especially important. An account can involve a birth date, parental consent, chat, uploaded media, generated content, analytics, subscriptions, and public sharing. A privacy seal does not automatically test whether generated dialogue is age-appropriate. An age rating does not show that an analytics SDK handles children’s identifiers lawfully.
This guide reviews the meaningful certification and badge routes available to a service operating in the United States or Korea as of July 20, 2026. It focuses on programs with a defined review process. General parenting awards and pay-to-enter marketing prizes are not treated as safety certifications.
There is no universal child-safety seal
The United States has a recognizable child-specific route: the Federal Trade Commission’s COPPA Safe Harbor system. The FTC currently lists six approved private programs. The program operator, not the FTC, audits a product and licenses the seal.
That still is not a federal certification that a service is completely safe. COPPA primarily governs how covered online services collect, use, disclose, secure, retain, and delete personal information from children under 13. The amended rule now requires separate verifiable parental consent for targeted advertising and other non-integral third-party disclosures, limits indefinite retention, and expands personal information to include biometric and government-issued identifiers.
Korea does not offer a direct all-in-one equivalent for a general child-facing app. Korean operators instead assemble evidence from privacy certification, security management, content age ratings, app-store programs, and, where relevant, certification of a specific youth activity program.
The six U.S. COPPA Safe Harbor choices
Every provider below is on the FTC’s approved list. A Korean company can apply when its product reaches U.S. children; the operator does not have to be incorporated in the United States. The key is to submit the same product scope to each candidate before comparing price.
| Program | Who can qualify | What the review is best at | Public cost information |
|---|---|---|---|
| kidSAFE+ COPPA Certified | Websites, apps, online services, AI products, social or UGC products, connected devices, edtech, and vendors covered by COPPA | COPPA plus a baseline of online-safety practices, including age screens, parental controls, chat or community procedures, complaints, data retention, and new-feature review | Annual paid membership; current fee is not published and requires a quote |
| ESRB Privacy Certified Kids Seal | Toy, game, cloud-game, app, website, connected-device, and interactive-entertainment services | Strong game-industry fit, product testing, SDK and traffic review, third-party vendor review, and continuing monitoring | Annual membership; base fee depends on corporate revenue. Standard covers up to 20 base products, while Premium generally covers 20-40 or complex platforms. Exact fee requires a quote |
| CARU COPPA Safe Harbor | Content creators, publishers, and their vendors with websites, apps, platforms, connected devices, toys, or services directed to children under 13 | Privacy, trackers, child-directed advertising, policy documents, product testing, and ongoing monitoring | Program fee is not published; quote required |
| iKeepSafe COPPA Safe Harbor | Technology used by children or in educational settings | Manual document review plus proxy and network-traffic analysis; can be paired with FERPA, California Student Privacy, or ATLIS certification | Subscription price is not published; quote required. The initial assessment usually takes about one month after documents and access are supplied |
| PRIVO COPPA Safe Harbor | Websites, apps, games, connected products, and services that also may need age assurance or verifiable parental consent infrastructure | Annual audits, quarterly reviews, consent and identity tooling, consumer complaints, and continuing consultation | Certification and platform pricing are not published; quote required |
| TRUSTe / TrustArc | Organizations seeking enterprise privacy assurance | Broad enterprise privacy assessment | The FTC still lists the program, but the current public site does not show a clear child-specific intake or price. Confirm present availability and scope before treating it as a candidate |
The lack of public prices is itself a procurement fact. These audits are scoped around products, corporate revenue, data practices, third-party SDKs, regions, and ongoing support. An applicant should send one written scope covering the web service, iOS and Android apps, AI chat, user-generated content, analytics, advertising, subscriptions, and connected products, then ask every provider to identify exclusions.
For a service like Wonder Bricks, kidSAFE+ COPPA Certified is the clearest parent-facing option because its published scope expressly includes AI-enabled products, chat, UGC, and online-safety practices. ESRB Privacy Certified Kids Seal is the strongest alternative when game-industry recognition and a complex platform review matter more. Getting both would duplicate much of the COPPA assurance; one should normally be selected unless the two certificates cover materially different products.
School, store, and content labels solve different problems
Several valuable marks sit next to COPPA rather than replacing it.
| Program | Qualification | Cost | What the label can honestly support |
|---|---|---|---|
| iKeepSafe FERPA / California Student Privacy / ATLIS | Products used in educational settings that provide policies, contracts, test access, data questionnaires, and remediation | Quote-based subscription | School and district privacy procurement; not a general child-safety guarantee |
| 1EdTech TrustEd Apps Data Privacy | 1EdTech members that pass policy vetting, consultation, public-evidence review, and self-assessment | Certification is a member benefit; supplier dues are based on annual revenue and require a quote | Edtech procurement and a directory listing; not an FTC Safe Harbor |
| Common Sense Privacy Seal | Products that pass a 200-plus-question review and meet strict rules including no data sales, targeted advertising, cross-app tracking, or commercial profiling | No public universal application price; evaluation and award are not guaranteed | Independent family and school privacy signal; less than 10% of evaluated companies qualify, according to Common Sense |
| Google Play Teacher Approved | A Google Play app compliant with the Families policies may opt into review; approval is not guaranteed | No separate Teacher Approved fee is published. A Play Console account costs a one-time USD 25 | Store discovery and teacher review of age fit, design quality, and value |
| Apple Kids Category | An iOS or iPadOS app designed for ages 11 and under, assigned to 5-and-under, 6-8, or 9-11, with parental gates and Kids Category privacy controls | No separate Kids Category fee. Apple Developer Program membership is USD 99 per year | App Store placement and compliance with Apple’s Kids Category rules; not an external certification |
| IARC content rating | A game submitted through a participating digital storefront with a completed content questionnaire | Free to developers | A regional content age rating such as ESRB or Korea’s GRAC rating; not privacy or community-safety certification |
Google and Apple labels are useful because parents see them at the point of download. They are still distribution programs. A website does not earn Apple Kids Category status, and a game’s Everyone or All Ages rating applies to the rated content rather than every live chat, uploaded asset, or generated world on the platform.
Korean privacy marks have the clearest published prices
The Korean Personal Information Protection Association operates three private voluntary marks. They assess compliance with Korean privacy law and administrative, technical, and physical safeguards. They are not child-specific government certifications.
| OPA mark | Suitable applicant and scope | Published review fee | Practical use |
|---|---|---|---|
| ePRIVACY | Mainly a smaller company’s website and its administrator pages; 25 review criteria | New review KRW 1.5 million, plus KRW 100,000 application fee and direct expense by audit region. Renewal review KRW 1 million | Lowest-cost website-only trust mark |
| ePRIVACY PLUS | A website and the management, technical, physical, and connected systems used to operate it; 60 review criteria | New or renewal review KRW 3 million, plus KRW 100,000 on a new application and regional direct expense. Follow-up review KRW 2.5 million | Better when a web service and backend systems should be in scope |
| PRIVACY | A service or information system not limited to a website, including app-centered or broader systems; 60 review criteria | Scope-based quote for initial, renewal, and follow-up reviews, plus the applicable application and direct expenses | Best conceptual fit for a combined web, app, and backend service |
OPA lists regional direct expenses of KRW 40,000 for Seoul and Gyeonggi, KRW 100,000 for Chungcheong and Gangwon, KRW 200,000 for Jeolla and Gyeongsang, and KRW 400,000 for Jeju. The final quote can change when the audit scope or number of days changes. Applicants should also confirm tax treatment in the written estimate.
For a multi-surface product, the cheapest mark can create the weakest claim. Certifying only the marketing website would not support a statement that the mobile app, game runtime, AI system, and backend were all audited. A Wonder Bricks application should first ask OPA whether PRIVACY can cover the complete service. If the review is limited to the web property and its connected systems, ePRIVACY PLUS is the more precise label.
ISMS-P is stronger evidence, but not a parent badge
ISMS-P is Korea’s statutory information-security and privacy-management certification. Its integrated framework contains 16 management-system controls, 64 protection controls, and 21 privacy-lifecycle controls. Organizations that are not legally required to certify may still apply voluntarily.
There is no honest fixed price for a company from the public fee sheet alone. KISA’s version 1.9 calculator uses the scope’s information systems, personnel, outsourced providers, services that process personal information, audit type, and other factors to determine audit days and fees. Travel and other direct expenses may be added. Small companies and organizations eligible for specified discounts can receive adjustments, while external consulting and remediation are separate costs.
ISMS-P is therefore a later-stage proof for schools, partners, investors, and enterprise buyers. It does not explain child-facing moderation or age-appropriate AI behavior to a parent in one glance.
Three Korean routes are useful only in narrower cases
Privacy by Design pilot certification. The Korean Personal Information Protection Commission’s 2026 pilot accepted manufacturers and developers of products or solutions that process personal information. Selection considered fit with Privacy by Design and whether discovered weaknesses could be improved. The government covered expert consulting and the entire certification fee, estimated at KRW 10 million to KRW 20 million per selected product. The June 22, 2026 application deadline has passed, so interested companies must watch for the next call and confirm whether a consumer web platform fits the next scope.
Youth Activity Program Certification. National and local governments, youth facilities, individuals, corporations, and groups can apply for a specific educational youth activity they developed and will operate. The application must be filed at least 45 days before recruitment or launch, and a first-time applicant receives an on-site review. Festivals for an unspecified public audience and simple skills classes are excluded. The official guidance does not list an application fee and offers free pre-application consultation, but operators still bear program, instructor, insurance, venue, and documentation costs. The certification mark must name the certified activity, number, and audience; it cannot be presented as certification of the entire company or app.
Global CBPR. A company subject to Korea’s Personal Information Protection Act can apply, especially when it transfers personal information across borders or needs a common multinational privacy system. The 2026 rules allow a fee based on the ISMS-P fee method, adjusted for the certification period and number of controls. A universal amount is not published. This can strengthen international privacy operations, but it is not a child-safety mark.
Hardware opens additional routes
Software-only services do not qualify for toy and IoT product certificates. If a company later ships a connected toy, robot, speaker, wearable, or dedicated game device, additional evidence becomes relevant.
Korea’s IoT security certification covers IoT products and their linked mobile apps at Lite, Basic, and Standard levels. The 2026 small-business program supports 80% of the first certification test fee: KRW 4.8 million, KRW 10.4 million, or KRW 16 million respectively. Those figures imply total standard test fees of KRW 6 million, KRW 13 million, and KRW 20 million, leaving KRW 1.2 million, KRW 2.6 million, or KRW 4 million before other out-of-scope expenses. Support is limited by budget and requires the certificate to be issued in time.
Korean KC children’s-product procedures and the U.S. Children’s Product Certificate and ASTM F963 testing may be mandatory for physical toys. Laboratory cost varies by materials, functions, test count, and product family. These are compliance documents for physical products, not badges available to a web app.
The fee is not the whole cost
Published and quoted certification fees usually do not include the work needed to become certifiable. A child-facing AI platform should budget for:
- a complete data and SDK inventory across web, mobile, game runtime, AI providers, support tools, and analytics;
- a neutral age screen and separate U.S. under-13 and Korean under-14 parental-consent flows;
- parent access, correction, deletion, consent-withdrawal, and data-export operations;
- strict retention schedules and proof that production deletion jobs actually run;
- removal or replacement of adtech and analytics components that cannot support child-directed use;
- chat, UGC, generated-media, reporting, blocking, moderation, and incident-response controls;
- child-readable and parent-readable notices in every supported language; and
- engineering and policy remediation after the auditor finds gaps.
For COPPA work in 2026, the scope should expressly test separate parental consent for targeted advertising or other non-integral third-party disclosure, biometrics and voice features, AI vendors, and data-retention limits. A certificate obtained against an incomplete product inventory can become a narrow and expensive decoration.
A practical certification sequence for Wonder Bricks
The most defensible first step is to request matched quotes from kidSAFE and ESRB. The request should name the same web, iOS, Android, AI-chat, UGC, generated-game, analytics, subscription, and sharing surfaces. Choose kidSAFE+ COPPA Certified for the broadest parent-facing safety story, or ESRB Privacy Certified Kids Seal when game-industry recognition and platform-scale privacy review carry more weight.
In Korea, request a full-service OPA PRIVACY scope first and compare it with an ePRIVACY PLUS scope that explicitly includes the connected backend. Add IARC ratings per game and pursue Google Teacher Approved and Apple Kids Category only where the native apps meet their respective policies.
If school procurement becomes a primary channel, add iKeepSafe’s education certifications or 1EdTech TrustEd Apps. ISMS-P and ISO/IEC 27001 or 27701 belong after the underlying management system is mature enough to operate continuously, not merely prepared for audit week.
The public claim should always name the issuer and scope. A supportable sentence is: “This product was independently audited under an FTC-approved COPPA Safe Harbor program.” “The U.S. government certified this service as completely safe for children” is not supportable. Until a certificate is actually issued, a company-created safety icon must be labeled as its own policy commitment and must not imitate an official seal.
The strongest trust page is not a wall of logos. It shows the certificate number, exact products and domains in scope, issue and expiry dates, parent controls, data deletion procedure, moderation coverage, and the limits of each review. That gives parents something more useful than a shield: a claim they can verify.
Disclosure
Disclosure: Wonder News is published by SunnyLabs Inc., the company behind Wonder Bricks. Wonder Bricks is used as a practical example in this guide and is not represented as holding any certification described here.
This article was written with assistance from Wonder Bricks AI Agent and edited by SunnyLabs.