Apple's Age & Parental Controls

At WWDC on Monday, Apple previewed its biggest set of parental controls in years, shipping this autumn in iOS 27. The headline features:

• Ask to Browse — a child requests a parent's approval before opening a new website in Safari.

• Time Allowances — daily limits set across whole app categories (Games, Social, Entertainment), with age-based recommendations built with the American Academy of Pediatrics.

• Communication Safety, expanded — the on-device filter that already blurs nudity now also blocks gore and violence.

• Redesigned Screen Time — one at-a-glance view of a child's usage, adjustable in a tap.

• Child Account — age-appropriate protections switched on from the moment a device is set up.

That's the consumer story, and it's most of the coverage. But Monday wasn't a standalone event — it's the latest step in an eighteen-month build-out, and the part that matters for anyone shipping an app sits underneath the headlines.

How Apple got here

Most readers are meeting this story at the WWDC announcement. Here's the run-up, because the developer tools didn't arrive on Monday — they've been landing in stages:

The takeaway: Declared Age Range and PermissionKit are not new — they shipped a year ago. What changed is that, over 2026, Apple turned them into a real compliance surface: the age signal now carries the details a law actually cares about, and there are hooks for consent, rating changes, and withdrawal.

Two layers: families vs. developers

It helps to split Monday's news cleanly:

• The family layer — Ask to Browse, Time Allowances, Screen Time, Child Account. Apple ships these directly to parents. An app doesn't integrate them.

• The developer layer — Declared Age Range, PermissionKit, Significant Change, StoreKit, server notifications. These are APIs an app calls.

What the developer layer gives an app

These are the inputs an app can read today:

Every one of these is an input or an enforcement hook — none of them says what the input means where the user lives.

That's the line. Apple supplies the who. What it does next is the part most coverage skips — so it's worth being exact about it.

What Apple's signal does not do

An age signal is a starting point, not a compliance posture. The moment an app has it, four gaps open up — and Apple closes none of them (by design, as Apple doesn’t have visibility over the inner workings and risk tolerance of each app).

1. It doesn't translate the age into a jurisdiction's rules. "13 to 15" means different things in different places, and the differences aren't cosmetic — they're the whole game:

Apple hands over the number. Mapping it to any of these is left to the app.

2. It doesn't gate features. Regulation doesn't act on apps — it acts on features. Loot boxes, chat, friend requests, targeted ads, AI companions, user-generated content: each carries its own age line, and each line moves by market. Apple's signal says nothing about which feature is allowed for this user, here, today.

3. It stops at the edge of iOS. Declared Age Range is iOS, iPadOS, and macOS only. But the same child is on an Android phone, a console, a Switch, the open web. An Apple-only signal is one device's worth of a problem that spans every device that child owns — and the answer has to be identical across all of them, or it isn't compliance.

4. It doesn't touch AI. This is the fast-moving frontier and Apple's age APIs don't reach it. When a minor talks to an AI companion or tutor, a new layer of law applies: California's SB 243 governs companion chatbots from Jan 1, 2027; the EU AI Act treats AI used on minors as high-risk and bars systems that exploit age-related vulnerabilities; the EDPB sets a high bar for training on a child's data. None of that is an age check — it's a set of decisions about what an AI may say, retain, train on, or recommend to a child versus a teenager versus an adult. Apple's signal is the front door; the AI rules are every room behind it.

Four gaps, all of them sitting between "an app knows the age" and "an app is compliant." Closing them is the entire job.

Enter the CDK

k-ID's Compliance Development Kit — the CDK — is the layer that takes an age signal and returns a compliance signal.

That's the whole idea in one line: a signal goes in, and what comes back is not more data but an answer — this user is a minor here, these features are gated, this consent is required, these are the defaults — already correct for the jurisdiction the user is in.

It is not a lookup table or a rules document a team reads and implements. It's a live compliance and safety harness: a service that holds the law for 200-plus markets — ECA Digital, the DSA, COPPA, Utah's account rules, the AI statutes — and resolves them per user, per feature, per market, on every call. When the law moves, the harness moves; the app calling it does nothing.

So Apple's four gaps collapse into one integration. The CDK speaks Apple's signal natively, translates the age into each jurisdiction's rules, gates the right features, spans every platform a child uses, and reaches the AI layer Apple's APIs never touch.

Apple supplies the who. The CDK supplies the what to do about it. The app just ships the result.

One signal in, every market's answer out

Here's what that looks like in practice. When Apple's signal reads "13 to 15," there's no spreadsheet of laws to reach for — the signal goes to the CDK, and back comes a finished decision for wherever the user actually is. One Declared Age Range signal, three markets, three correct answers:

Three markets, one signal, one CDK call. None of those rules were hand-written. The CDK holds them — and stays current as they move, so the same call returns a different, correct answer the day a law changes.

What the CDK does with each signal

Loot boxes that just became 18+. Ship loot boxes into Brazil and the storefront rating moved to 18+ as of February 24, 2026. Apple's signal marks the user as an adult; the CDK maps the in-app consequence — the feature unlocks for verified adults and stays shut for everyone else, automatically.

Social and communication. PermissionKit carries the parent's tap. The CDK decides when that tap is legally required — chat at 13 in one market, 16 in another — and moves the threshold as the law does. The bar shifts by the quarter: multiple US states now have enforceable age-assurance requirements for social features, spread across 14, 16, and 18. The CDK tracks all of them so application code doesn't have to.

Significant changes, before they bite. A feature that looks routine — adding messaging, opening user-generated content — can be a "significant change" that locks a child out until a guardian re-consents. The CDK flags which changes trip that wire in which markets ahead of ship, so ageRatingCode and Significant Change fire on cue instead of surprising a team post-launch.

Everywhere Apple isn't. Declared Age Range is iOS, iPadOS, macOS. The same child is on Android, on console, on the web. The CDK makes the age decision identical across all of them, from one integration — so an Apple signal slots into a story that's already whole.

How it runs

No age gate gets rebuilt. Apple's signal feeds k-ID's /age-gate/check, and k-ID returns a session with the permissions, consents, and defaults already resolved for that user's jurisdiction.

The integration path starts here: k-ID's developer docs and the age-assurance integration guide. The Apple-signal-to-session path is a first-class input.

One harness, every signal

Apple's signal is one of many the CDK already speaks. The same call that resolves Declared Age Range also resolves Google Play Families signals, Unity user data, console age signals, and a custom web age gate — into one jurisdiction-correct session. A child on an iPhone today and an Android tablet tomorrow gets the same correct treatment both times, from one integration instead of one per platform. That closes the cross-platform gap and the feature-gating gap in a single layer.

It also reaches the gap Apple's APIs never touch: AI. The same harness that decides whether a 14-year-old can open a chat decides what an AI companion may say, retain, or train on for that same user — SB 243, the EU AI Act, the EDPB's bar on children's data, resolved per market alongside everything else.

Underneath it all, neimo keeps the rulebook live: when Louisiana's account rules turn on July 1, or a state moves its social threshold, or a new AI-and-minors law lands, the CDK's answer changes without a redeploy.

That's age-aware in real time — the signal is the platform's, the judgement is continuous, and it never goes stale the day a law changes.

Somewhere right now an eight-year-old is downloading a game on a borrowed iPad, and a fourteen-year-old is asking to add a friend in it. Apple just made it possible to know, privately, that they're a child and a teenager. The CDK is what turns that knowing into the right experience for each of them — the right gate, the right consent, the right defaults, wherever they live — and reshapes it the moment the law does.

Apple gives a signal. The CDK gives every signal a market-perfect answer. That's age assurance that actually assures — across every store, every border, every age.