COPPA — Children’s Online Privacy Protection Act
- ClassificationCategoryData Protection & PrivacyDomainPrivacyFramework FamilyGlobal Privacy Regulations
- Regulatory ContextTypeRegulationLegal InstrumentActSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionNorth AmericaRegion DetailUnited StatesPublisherFederal Trade Commission (FTC)
- VersioningVersionCOPPA (15 U.S.C. 6501-6506) and the COPPA Rule (16 CFR Part 312), as amended April 22, 2025 (90 Fed. Reg. 16918; effective June 23, 2025; compliance date April 22, 2026)Effective DateApril 21, 2000 (Rule); amendments effective June 23, 2025Issue DateOctober 21, 1998 (Act); April 21, 2000 (Rule)
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityModerate
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
The Act and the Rule are U.S. federal law, published free by the Federal Trade Commission, the Federal Register and the Code of Federal Regulations, and are included with the platform for reference.
Framework text is licensed by its publisher and is included only where stated above.
- COPPA requires operators of online services directed to children under 13, or with actual knowledge of child users, to obtain verifiable parental consent.
- Congress enacted the Act on October 21, 1998, and the FTC's COPPA Rule took effect on April 21, 2000.
- The FTC enforces the Rule, and state attorneys general can bring civil actions; nonprofits exempt from the FTC Act are outside its scope.
- Amendments published April 22, 2025 add a written security program, a retention policy, separate consent for third-party disclosure, and biometric identifiers.
- Most operators had until April 22, 2026 to comply with the amended Rule.
Overview
The Children's Online Privacy Protection Act of 1998 (COPPA, 15 U.S.C. 6501 to 6506) and the COPPA Rule (16 CFR Part 312) require operators of websites and online services directed to children under 13, and operators with actual knowledge that they collect a child's personal information, to give parents notice and obtain verifiable parental consent first. Congress enacted the Act on October 21, 1998, and the Rule took effect on April 21, 2000.
The Federal Trade Commission (FTC) issues and enforces the Rule, and state attorneys general can bring civil actions under 15 U.S.C. 6504. A violation is treated as a violation of an FTC trade regulation rule on unfair or deceptive acts or practices (16 CFR 312.9). The Rule covers commercial websites and online services, including apps. Nonprofit entities exempt from section 5 of the FTC Act are outside the definition of operator (section 312.2).
The FTC published amendments on April 22, 2025 (90 Fed. Reg. 16918). They took effect on June 23, 2025, and most operators had until April 22, 2026 to comply. They add a written information security program (section 312.8), a written data retention policy (section 312.10), separate parental consent for disclosure to third parties (section 312.5(a)(2)) and biometric and government-issued identifiers to the definition of personal information. On February 25, 2026 the FTC also issued a policy statement on age verification and said it intends to review the Rule on that subject.
Why does it matter?
COPPA is the main U.S. federal rule on the personal information of children under 13 online, and the FTC enforces it. It turns age and parental consent into records an operator must be able to show: who is a child, what counts as personal information, and what notice, consent, security and retention steps were taken (sections 312.2 to 312.10).
Key benefits include:
- Clear coverage test
The Rule applies to operators of websites or online services directed to children and to any operator with actual knowledge that it collects personal information from a child (section 312.3). A mixed audience service may screen age in a neutral manner (section 312.2).
- Consent that can be proven
An operator must obtain verifiable parental consent before any collection, use or disclosure, using a method reasonably calculated to ensure the person consenting is the child's parent (section 312.5(b)).
- Parents stay in control
A parent can review the information collected, refuse further use or collection and direct deletion, and the operator must provide a means that is not unduly burdensome (section 312.6).
- Security and retention are written duties
Since the 2025 amendments the Rule requires a written information security program (section 312.8(b)) and a written data retention policy (section 312.10).
- Enforcement is direct
A violation is treated as a violation of an FTC rule on unfair or deceptive practices (section 312.9). State attorneys general may seek an injunction, damages or restitution (15 U.S.C. 6504).
How does it work?
The Rule has thirteen sections: scope (312.1), definitions (312.2), the general prohibition and list of duties (312.3), notice (312.4), parental consent (312.5), parent review (312.6), no conditioning of participation (312.7), security (312.8), enforcement (312.9), retention and deletion (312.10), safe harbor programs (312.11), voluntary Commission approval processes (312.12) and severability (312.13).
An operator first decides whether it is covered. In deciding whether a service is directed to children, the FTC considers subject matter, visual content, animated characters, music, the age of models, advertising and competent and reliable empirical evidence of audience (section 312.2). A mixed audience service must not collect personal information, other than for limited purposes in section 312.5(c), before it determines whether the visitor is a child by a neutral age screen that does not default to a set age.
Where consent is needed, the operator sends direct notice to a parent with the content listed in section 312.4(c), obtains consent by a method in section 312.5(b), and asks separately for consent to disclosure to third parties unless the disclosure is integral to the service (section 312.5(a)(2)). Operators that follow self-regulatory guidelines approved by the FTC under a safe harbor program are deemed in compliance (15 U.S.C. 6503; section 312.11).
Key Elements
- Direct notice and online notice (section 312.4)
Direct notice goes to the parent and must state what information the operator collects, how it will be used and which third parties receive it. A clearly labeled link to an online notice sits on the home or landing page and next to each place where children's information is collected.
- Verifiable parental consent (section 312.5)
Methods include a signed consent form, a payment card transaction that notifies the account holder, a toll-free call, video conference, government ID checks, knowledge-based authentication and a photo ID matched to a face image. Operators that do not disclose children's information may use email or text with extra confirmation steps.
- Exceptions to prior consent (section 312.5(c))
Nine exceptions cover, for example, collecting a parent's contact information to obtain consent, a one-time response to a child's request, protecting a child's safety, and collecting only a persistent identifier to support the internal operations of the service.
- Parent review and deletion (section 312.6)
On request an operator describes the types of information collected, lets the parent refuse further use or collection, directs deletion and provides a means to review the information after confirming the requester is the parent.
- Information security program (section 312.8)
The written program designates employees to coordinate it, includes at least annual risk assessments, safeguards matched to the risks, regular testing and monitoring, and an annual evaluation. Before releasing data to third parties the operator obtains written assurances.
- Retention and minimization (sections 312.7 and 312.10)
An operator may not condition a child's participation in a game or prize on disclosing more information than is reasonably necessary. It keeps children's data only as long as reasonably necessary for the purpose and states its retention timeframe in a written policy.
What does it cover?
The Rule applies to operators of commercial websites and online services, including mobile apps, that are directed to children under 13, and to operators of other services that have actual knowledge they collect personal information from a child (sections 312.2 and 312.3). Personal information includes names, addresses, online contact information, persistent identifiers such as cookies and IP addresses, photos, video and audio of a child, geolocation, biometric identifiers and government-issued identifiers.
What are its objectives?
The Rule sets mandatory duties for operators that handle children's personal information.
Provide direct notice to parents and a clearly labeled online notice (section 312.4).
Obtain verifiable parental consent before any collection, use or disclosure, and separate consent for disclosure to third parties (section 312.5).
Let parents review information, refuse further use and direct deletion (section 312.6).
Collect no more than is reasonably necessary for a child to take part in an activity (section 312.7).
Keep a written information security program and obtain written assurances from third parties (section 312.8).
Retain children's data only as long as reasonably necessary, under a written retention policy (section 312.10).
Framework in Context
COPPA covers children under 13 only. Organizations that also serve teens or users in other jurisdictions map COPPA duties to broader privacy frameworks and check the age threshold each law sets. On February 25, 2026 the FTC issued a policy statement saying it will not bring Rule enforcement actions against certain general audience and mixed audience operators that collect information solely to determine age, under stated conditions. The statement stays in effect until the FTC publishes final amendments on age verification or withdraws it.
Common Framework Mappings
Organizations map COPPA to broader privacy frameworks to align consent, notice, security and retention evidence across jurisdictions.
Mapped frameworks include:
APEC PF
CCPA/CPRA
ePrivacy Directive
GDPR
ISO 27701
LGPD
NIST Privacy Framework v1.0
PIPEDA
How SmartSuite Supports COPPA
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Privacy Management to hold the children's data inventory, notices, consent records and parent requests an operator may be asked to show, Third Party Risk Management for the written assurances from service providers, and Cyber & IT Risk for the written information security program.
Children's Data Inventory
Record each category of personal information collected from children, including persistent identifiers, the purpose and the retention timeframe (16 CFR 312.2 and 312.10).
Direct Notice and Consent Evidence
Track the direct notice sent, the parental consent method used, the date, and any separate consent for disclosure to third parties (sections 312.4 and 312.5).
Parent Review and Deletion Requests
Run parent requests to review information, refuse further collection or direct deletion, with identity checks and response dates (section 312.6).
Third-Party Assurances
Hold the written assurances and due diligence for each service provider or third party that collects or receives children's data (section 312.8(c)).
Information Security Program
Assign the coordinating employees and schedule the annual risk assessment, safeguards, testing and program evaluation the Rule requires (section 312.8(b)).
Retention Policy and Compliance Reporting
Keep the written retention policy and deletion timeframes with open gaps in one view for internal reviews (section 312.10).
Related frameworks
The APEC Privacy Framework (2015) sets nine information privacy principles that APEC economies use to protect personal information while keeping data flowing across the region.
The CCPA, as amended by the CPRA, gives California residents rights to know, delete, correct and opt out, and is enforced by the California Privacy Protection Agency.
The GDPR (Regulation (EU) 2016/679) sets principles, lawful bases, individual rights and accountability duties for personal data, with fines up to EUR 20 million or 4 percent of turnover.
ISO/IEC 27701:2025 specifies requirements for a stand-alone privacy information management system (PIMS) for PII controllers and processors, replacing the 2019 edition.
The LGPD is Brazil's data protection law: ten principles, ten legal bases, data subject rights and ANPD fines of up to 2% of Brazilian revenue, capped at R$50 million.
Frequently Asked Questions For COPPA (Children’s Online Privacy Protection Act)
Operators of commercial websites and online services, including apps, that are directed to children under 13, and operators of other services that have actual knowledge they collect personal information from a child (16 CFR 312.3). Nonprofit entities exempt from section 5 of the FTC Act are outside the definition of operator (section 312.2). The FTC enforces the Rule, and state attorneys general can sue under 15 U.S.C. 6504.
The FTC published the final rule on April 22, 2025 (90 Fed. Reg. 16918). It took effect June 23, 2025, and operators had until April 22, 2026 to comply, with earlier dates for safe harbor program duties in sections 312.11(d)(1), (d)(4) and (g). Changes include separate consent for disclosure to third parties (section 312.5(a)(2)), a written information security program (section 312.8(b)), a written retention policy (section 312.10) and biometric and government-issued identifiers in the definition of personal information.
Any method must be reasonably calculated, in light of available technology, to ensure the person giving consent is the child's parent (section 312.5(b)). The Rule lists methods such as a signed form, a payment card transaction, a toll-free call, video conference, a government ID check, knowledge-based authentication and a photo ID matched to a face image. An operator that does not disclose children's information may use email or text plus confirmation steps.
Section 312.8(b) requires a written program with safeguards suited to the sensitivity of the data and the operator's size. The operator designates employees to coordinate it, assesses internal and external risks at least annually, designs safeguards for those risks, tests and monitors them, and evaluates and updates the program at least annually. It must also obtain written assurances from third parties that receive children's data (section 312.8(c)).
It applies once the operator has actual knowledge that it collects personal information from a child (section 312.3). A mixed audience service, which is directed to children but does not target them as its primary audience, must determine age with a neutral screen before collecting personal information, other than for limited purposes in section 312.5(c). It is not deemed directed to children for any visitor not identified as under 13 (section 312.2).
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.