COPPA (Children's Online Privacy Protection Act)

· About COPPA (Children's Online Privacy Protection Act)

Key Takeaways

  • COPPA applies to operators of websites, apps, and online services directed to children under 13, and to operators with actual knowledge they collect personal information from a child under 13; the FTC enforces it under 16 CFR Part 312.[3][6]
  • The FTC’s 2025 amendments became effective on 23 June 2025, and most operators had until 22 April 2026 to reach full compliance, with some provisions earlier for FTC-approved safe harbor programs.[3][11][15]
  • Covered operators must obtain verifiable parental consent before collecting, using, or disclosing a child’s personal information, and the amendments require separate consent for third-party disclosures such as targeted advertising.[1][3][7]
  • Covered operators must now maintain a written data retention policy, implement a written information security program, and disclose retention periods in their privacy notices.[1][11][15]
  • COPPA penalties are civil, and the FTC’s published materials state a maximum civil penalty of $53,088 per violation.[12]
  • The FTC also expanded the definition of personal information and tightened conditions for the “support for internal operations” exemption, increasing compliance scope and documentation burdens.[1][2][15]

What It Is

COPPA is the U.S. children’s online privacy regime that restricts how operators of child-directed online services, and operators with actual knowledge of collecting data from children under 13, may collect, use, and disclose personal information.[3][6] The rule is enforced by the Federal Trade Commission under 16 CFR Part 312.[3][10]

Congress enacted COPPA in 1998, and the FTC’s most recent final rule amendments were published on 22 April 2025, became effective on 23 June 2025, and reached full compliance on 22 April 2026 for most regulated entities.[3][11][15] The FTC has also issued a 25 February 2026 policy statement addressing age-verification use cases, but that statement is interim guidance and not a substitute for the rule itself.[4][10]

Who Must Comply

COPPA applies to operators of websites, online services, and mobile apps directed to children under 13, and to general-audience operators that have actual knowledge they are collecting personal information from a child under 13.[3][6] The rule is not limited to U.S.-based companies; extraterritorial exposure arises whenever an operator targets U.S. children or knowingly collects children’s data in a covered context, because the FTC regulates conduct affecting U.S. consumers.[3][6]

The rule contains limited exemptions, including narrow exceptions for certain passive or internal uses, but the FTC’s 2025 amendments narrowed the “support for internal operations” path and added conditions for related disclosures.[1][15] FTC-approved COPPA safe harbor programs have separate obligations and, for some amendments, earlier compliance timing than the general April 2026 deadline.[1][15]

Core Requirements

  1. Notice and transparency. Covered operators must provide direct notice to parents and a clear online privacy notice describing collection practices, uses, disclosure categories, retention periods, and parental rights.[3][11]
  2. Verifiable parental consent. Before collecting, using, or disclosing personal information from a child under 13, operators must obtain verifiable parental consent, with separate consent now required for third-party disclosures tied to targeted advertising and similar transfers.[1][3][7]
  3. Data minimization and retention. Operators must have a written retention policy that specifies how long children’s personal information is kept and must delete it when no longer reasonably necessary for the purpose collected.[1][11][15]
  4. Information security. Operators must implement and maintain a written information security program with safeguards appropriate to the sensitivity of children’s personal information.[1][15]
  5. Vendor and third-party controls. Operators disclosing children’s data to third parties must align contracts and procedures with COPPA limits, especially where the recipient supports internal operations or receives data for ad-related purposes.[1][2][15]
  6. Operational limits on internal use. The “support for internal operations” exemption is not a blanket permission; the amendments add specific conditions and require closer control over analytics, service improvement, and similar uses.[1][15]
  7. Age verification handling. The FTC’s 2026 policy statement recognizes a narrow enforcement posture for age verification data collected solely to determine age, but only if the operator follows strict purpose limitation, deletion, security, notice, and third-party diligence conditions.[4]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Final amendments published | 22 April 2025 | FTC published the revised COPPA Rule in the Federal Register.[3][11] | | Amendments take effect | 23 June 2025 | The amended rule became effective.[1][2][11] | | Full compliance deadline | 22 April 2026 | Most regulated entities had to comply with the amendments by this date.[1][2][11][15] | | FTC age-verification policy statement | 25 February 2026 | Interim enforcement guidance for certain age-verification data practices.[4] |

The FTC has stated that COPPA civil penalties can reach $53,088 per violation.[12] In addition to monetary penalties, the FTC can seek injunctive relief, compliance monitoring, deletion or destruction obligations, and other remedial measures through enforcement actions and settlements.[6][12]

How to Comply

  1. Map child-directed and mixed-audience services. Identify all websites, apps, SDKs, ad-tech flows, analytics tags, and embedded third parties that may collect data from children under 13.
  2. Classify data flows against COPPA definitions. Treat identifiers, geolocation, persistent identifiers, photos, audio, video, and other expanded personal information categories as in-scope where applicable.[1][15]
  3. Implement parental consent workflows. Build consent collection, verification, recordkeeping, and revocation processes, and separate consent for third-party disclosures and ad-related transfers.
  4. Write and operationalize retention and security controls. Align the written retention policy and security program with ISO 27001 controls for governance and access management, and use NIST CSF 2.0 to structure identify-protect-detect-respond-recover capabilities.
  5. Tighten vendor governance. Update DPAs, advertising terms, SDK approvals, and data-sharing inventories so third parties only receive COPPA-permitted data and are contractually bound to protect it.
  6. Review product design and UX. Minimize default collection, disable unnecessary profiling, and make notice and consent screens understandable to parents and children.
  7. Test and audit regularly. Run periodic privacy and security assessments, monitor for new features or audience shifts, and use ISO 42001-style AI governance if automated systems infer age, personalize content, or moderate child-directed experiences.
  8. Prepare incident and enforcement response. Document escalation paths for regulator inquiries, complaints, and children’s data incidents, including evidence preservation and remediation timelines.

Related Regulations

The General Data Protection Regulation (GDPR) overlaps where a service is offered to children in the EU, but GDPR’s child-consent framework, lawful bases, and age thresholds differ from COPPA’s under-13 parental-consent model. The California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) can apply to the same operator for broader consumer-data processing, while COPPA governs the narrower children’s-data layer. The UK Age Appropriate Design Code overlaps with COPPA for child-facing design choices, but it is a broader product-design code and not a parental-consent statute. The EU Digital Services Act can affect child protection, advertising, and recommender-system design on online platforms, creating additional obligations beyond COPPA’s data-collection rules. The FTC Health Breach Notification Rule is not a direct child-privacy substitute, but health or wellness apps aimed at minors may trigger both regimes depending on the data and service model.

FAQ

Does COPPA apply to companies outside the United States?

Yes. COPPA can apply when a foreign company directs services to children in the United States or knowingly collects personal information from children under 13 in a covered service. The key question is whether the operator falls within the FTC’s jurisdiction and the rule’s child-directed or actual-knowledge triggers.[3][6]

Does COPPA require parental consent for targeted advertising?

Yes. The FTC’s 2025 amendments require separate verifiable parental consent before disclosing children’s personal information to third parties for targeted advertising and similar purposes.[1][7] That is stricter than the pre-amendment structure, which allowed more ambiguity around downstream ad-tech disclosures.[1][15]

What changed in the 2025 COPPA amendments?

The biggest changes were expanded personal-information coverage, separate consent for third-party disclosures, a written retention policy requirement, a written information security program, and tighter rules for internal operations uses.[1][11][15] The FTC also addressed age-verification practices in a 2026 policy statement, but that is guidance rather than a permanent rule change.[4]

When did operators need to be fully compliant?

For most operators, the amended rule became effective on 23 June 2025 and full compliance was due by 22 April 2026.[1][2][11][15] FTC-approved safe harbor programs had to meet some requirements earlier where the rule specified earlier compliance dates.[1][15]

What are the penalties for noncompliance?

The FTC’s published materials cite a maximum civil penalty of $53,088 per violation.[12] Enforcement can also include injunctions, mandated deletion, compliance reporting, and settlements that impose long-term oversight obligations.[6][12]

Does a privacy policy alone satisfy COPPA?

No. COPPA requires operational controls, not just disclosures. Operators must obtain verifiable parental consent where required, honor retention limits, secure children’s data, and control third-party disclosures in addition to publishing notices.[3][11][15]

Sources

Put it into practice

More compliance guides