Written by: Nicole Ogonowska, IT Growth Manager, Digital Colliers
Meta's settlement of state child safety claims for nearly $18B is the loudest signal yet that the age of the person on the other end of the transaction is about to become a first class data field. Meta's answer leans on OS and app store signals from Apple and Google. That pushes the age flag up the stack, out of the app, and into the device. If you sell anything a teenager might buy, your customer record probably has no reliable age on it today. That's the problem.
The deadline you're actually working to
There isn't a single statute forcing every retailer to hold an age signal by a specific Tuesday. There's something worse: a pile of overlapping ones, all landing inside the same eighteen month window.
- EU AI Act Article 50 transparency obligations apply from 2 August 2026, which covers any AI system interacting with people, including recommenders and chat.
- EU AI Act high risk obligations follow on 2 December 2027, with fines up to €15M or 3% of global turnover.
- GDPR is already live and reaches €20M or 4% of global turnover, and processing a minor's data without a lawful basis is one of the fastest routes to that ceiling.
Treat August 2026 as the working deadline. If your recommender, your email engine, or your on-site chat is talking to a fourteen year old and you can't prove you knew that, you're carrying risk you can measure in percentage of turnover.
Where the age signal actually lives
Most retail stacks have no field for age. They have date of birth on maybe 10% of accounts, self reported, unverified, and often blank at checkout. That's not going to hold up.
The pattern the platforms are converging on is simple. The device knows. The OS or app store passes a signal (adult, teen, under 13) to the app. The app decides what to show, what to log, and what to sell. You don't get the birth date. You get a band.
For a retailer, the practical version looks like this:
- A single field on the customer record:
age_bandwith values likeunknown,under_18,adult. - A source field next to it:
age_band_source(device signal, ID check at checkout, parental consent flow, self declared). - A timestamp, because signals go stale and audits ask when you knew.
That's three columns. Most teams don't have them.
The plumbing, end to end
Once the field exists, it has to actually flow. This is where projects stall, because the age band needs to reach every system that makes a decision about the customer.
- Identity layer (your CDP or auth provider) holds the canonical
age_band. - Site and app read it on every session and gate the product grid, the recommender, and any chat surface accordingly.
- Checkout reads it before applying upsells, financing offers, or age restricted SKUs.
- Marketing tools (ESP, SMS, paid audiences) get it as a suppression flag, not a targeting flag. Under 18 means excluded from behavioural audiences, not sliced into them.
- Your data warehouse logs every decision with the age band and source at time of decision. That log is your audit trail.
If you're a Shopify shop, the age band belongs on the customer object with a metafield and a matching customer segment. If you're headless, it belongs on the identity token so every downstream service sees the same value. The rule is one source of truth, read everywhere, written in one place.
What proving compliance looks like
Regulators and plaintiffs don't ask for your intentions. They ask for records. The operators who'll come out of 2026 cleanly are the ones who can answer three questions in SQL, not in a meeting.
- For any given order, what age band did we hold for this customer, from what source, at what time?
- For any given marketing send, which recipients were under 18 and why were they included or excluded?
- For any given recommender impression, what inputs were used and was age band one of them?
If your team runs those queries by hand today, that's fine for now. By August 2026 they need to be dashboards. The Meta settlement is the starting gun, not the finish line. The retailers who build the age signal pipeline in the next two quarters will spend 2026 selling. The ones who wait will spend it explaining.