COPPA Compliance — Children's Online Privacy Protection Act
Overview
The Children's Online Privacy Protection Act (COPPA), codified at 15 U.S.C. Sections 6501-6506 and implemented through the FTC's COPPA Rule at 16 CFR Part 312, regulates the online collection, use, and disclosure of personal information from children under 13 years of age. COPPA applies to operators of commercial websites and online services (including mobile apps) directed to children under 13, or operators with actual knowledge that they are collecting personal information from a child under 13. The FTC's 2013 amendments significantly expanded the scope to cover persistent identifiers used for behavioural advertising, photos, videos, audio recordings, and geolocation data. The FTC issued a Notice of Proposed Rulemaking (NPRM) in December 2023 proposing further amendments including restrictions on push notifications to children and expanded consent requirements for targeted advertising.
Statutory and Regulatory Framework
COPPA Statute — 15 U.S.C. Section 6502
Section 6502(a)(1): Unlawful for an operator of a website or online service directed to children, or having actual knowledge of collecting from a child under 13, to collect personal information in a manner that violates the FTC's regulations.
Section 6502(b)(1): FTC must issue regulations requiring operators to: (A) provide notice of information practices; (B) obtain verifiable parental consent; (C) allow parents to review information collected; (D) allow parents to refuse further collection/use; (E) limit collection to what is necessary for the activity.
Section 6502(b)(2): FTC shall apply regulations considering competitive impact, costs, and benefits, and potential effect on existing safe harbor programs.
COPPA Rule — 16 CFR Part 312
Section 312.2 — Key Definitions
Child: An individual under the age of 13
Operator: Any person who operates a website or online service and collects or maintains personal information from or about users, or on whose behalf such information is collected or maintained
Personal information: Individually identifiable information including: first and last name; home or physical address; online contact information (email); telephone number; Social Security number; persistent identifier that can be used to recognise a user over time and across different websites; photograph, video, or audio file containing a child's image or voice; geolocation information sufficient to identify street name and city; information concerning the child or parents collected and combined with any of the above
Website or online service directed to children: Determined by: subject matter, visual content, use of animated characters, child-oriented activities and incentives, music, age of models, presence of child celebrities, ads directed at children, competent evidence regarding the target audience
Support for internal operations: Activities necessary to maintain or analyse the functioning of the website or online service, including one-time collection and non-contact use, frequency capping, legal compliance, security, contextual advertising, personalising content (not for advertising)
Section 312.3 — Obligations of Operators
Direct notice to parents (Section 312.4): Before collecting, using, or disclosing personal information from a child, the operator must provide clear and prominent notice on the website/service and directly to the parent
Verifiable parental consent (Section 312.5): Must obtain verifiable parental consent before any collection, use, or disclosure, except for narrow exceptions
Parental access (Section 312.6): Must provide parents with reasonable means to review the personal information collected from their child and to refuse to permit further collection or use
Confidentiality, security, and integrity (Section 312.8): Must establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children
Data minimisation (Section 312.7): Must not condition a child's participation in an activity on providing more personal information than is reasonably necessary
Data retention (Section 312.10): Must retain personal information collected from a child only as long as reasonably necessary to fulfil the purpose for which it was collected
The FTC recognizes the following methods for obtaining verifiable parental consent. Controllers must select the appropriate method based on the sensitivity of data collected and how it will be used.
Method 1: Signed Consent Form
Parent prints, signs, and returns a consent form to the operator via postal mail, fax, or electronic scan
Form must identify the operator, list all information to be collected, describe uses and disclosures, and state that the parent can revoke consent
Suitable for initial high-assurance verification
Limitation: Slow turnaround, accessibility barriers for parents without printing capability
Method 2: Credit Card or Other Online Payment Transaction
Parent uses a credit card, debit card, or other online payment system that provides notification of each discrete transaction to the primary account holder
The transaction must be a bona fide purchase or donation, or a micro-transaction (e.g., USD 0.50) disclosed to the parent
Credit card verification alone (without a transaction) is insufficient; there must be an actual monetary transaction
Limitation: Excludes unbanked families; may deter participation
Method 3: Toll-Free Telephone Number or Video Conference
Parent calls a toll-free number staffed by trained personnel who verify the parent's identity through knowledge-based questions
Alternatively, parent connects through a video conference call where identity is confirmed visually
Operator must train staff on COPPA requirements and verification protocols
Limitation: Resource-intensive; staffing requirements for multi-language support
Method 4: Government-Issued ID with Comparison to Database
Parent submits a government-issued identification (driver's license, passport) which the operator checks against a database
The ID must be deleted promptly from the operator's records after verification is complete
Must comply with Section 312.5(b)(4) requirements for deletion of ID after verification
Limitation: Privacy concerns about collecting sensitive identity documents; storage risk
Method 5: Knowledge-Based Authentication
Operator uses a series of challenge questions drawn from a third-party database (e.g., TransUnion, Experian, LexisNexis) that only the parent would likely be able to answer
Questions must be dynamically generated and different for each verification attempt
Must meet threshold of difficulty that prevents a child from successfully answering
Limitation: Dependent on third-party data accuracy; may fail for parents with thin credit files
Parent submits a photograph that is compared against a previously verified government-issued photo ID
The photograph and ID image must be deleted promptly after the comparison is complete
Currently an approved method under the FTC's COPPA Rule but raises significant privacy concerns
Limitation: Biometric data collection concerns; accuracy disparities across demographics
Method 7: Email Plus (Limited Use)
Parent receives an email from the operator containing a notice and a link or response mechanism
The operator sends a confirmatory email to the parent after a reasonable delay
This method is approved ONLY for internal uses of collected information — NOT when the operator will disclose personal information to third parties or make it publicly available
Limitation: Lowest assurance; child may access parent's email
Consent Method Selection Matrix
Data Use Scenario
Minimum Consent Method
FTC Expectation
Internal use only (no disclosure)
Email Plus (Method 7)
Acceptable minimum
Sharing with third parties
Method 1, 2, 3, 4, or 5
Higher assurance required
Public posting of child's information
Method 1, 2, 3, 4, or 5
Highest assurance recommended
Behavioural advertising
Method 1, 2, 3, 4, or 5
FTC scrutinises closely
Collection of photos/videos/audio
Method 1, 2, 3, 4, or 5
Must verify before publication
Direct Notice Requirements — Section 312.4
Notice on the Website or Online Service — Section 312.4(b)
The operator must post a clear and prominent link to an online notice of its information practices with respect to children on the home page and each area where personal information is collected from children. The notice must state:
Name, physical address, email address, and telephone number of all operators collecting or maintaining personal information through the site/service (or one designated operator with hyperlink to list of all)
Description of what information is collected and whether collected actively or passively
How the operator uses (and may use) the information
Whether personal information is disclosed to third parties; if so, the types of businesses, their general purposes, and whether they have agreed to maintain the confidentiality and security of the information
That the parent can review and have deleted the child's personal information, and can refuse to permit further collection
Procedures for the parent to exercise rights
Direct Notice to Parent — Section 312.4(c)
Before collecting personal information from a child, the operator must send a direct notice to the parent that includes:
Statement that the operator has collected the parent's online contact information for the purpose of obtaining parental consent
The information practices of the operator
That if the parent does not respond within a reasonable time, the parent's online contact information will be deleted
A link to the online notice
The means by which the parent can provide consent
FTC Safe Harbor Programs — Section 312.11
Industry groups or other persons may apply to the FTC for approval of self-regulatory guidelines (safe harbor programs) that implement the protections of the COPPA Rule. Operators subject to an approved safe harbor program are deemed to be in compliance with Section 312.
Currently Approved Safe Harbor Programs
Program
Administering Organisation
Focus Area
CARU (Children's Advertising Review Unit)
BBB National Programs
Advertising and marketing directed to children
kidSAFE Seal Program
kidSAFE, LLC
Websites and apps with child audiences
ESRB Privacy Certified
Entertainment Software Rating Board
Video games and interactive entertainment
Aristotle Integrity (formerly iKeepSafe COPPA Safe Harbor)
FTC will not bring enforcement action against an operator that is in compliance with an approved safe harbor program's guidelines
Safe harbor programs provide independent compliance review and monitoring
Programs offer dispute resolution mechanisms and consumer complaint handling
Membership signals compliance commitment to parents and regulators
Safe Harbor Obligations
Submit annual reports to the FTC on compliance activities
Provide effective enforcement mechanisms including consumer redress
Perform random, comprehensive compliance audits of members at least annually
Maintain publicly available list of members and compliance status
BrightPath Learning Inc. — COPPA Implementation
BrightPath Learning Inc. operates an educational gaming platform available to children in the United States. The platform includes interactive learning games, progress tracking, and parent communication features.
COPPA Compliance Architecture
Pre-Registration Flow:
Landing page prominently links to the Children's Privacy Policy
Registration form asks "Are you 13 or older?" with neutral yes/no options (no age pre-fill)
User selecting "No" is routed to the parental consent flow
User selecting "Yes" proceeds with standard registration (with age verification at Step 5)
Parental Consent Flow:
Child enters parent's email address
BrightPath sends direct notice to parent per Section 312.4(c) including full information practices disclosure
Parent clicks the consent link within 72 hours (contact information deleted if no response)
Parent completes credit card verification via USD 0.50 micro-transaction (refunded within 48 hours)
Parent reviews and provides granular consent for each data use:
Account creation and educational content delivery (required for service)
Learning progress reports sent to parent (optional)
Anonymized aggregate analytics for platform improvement (optional)
Confirmation email sent to parent with link to parental dashboard
Parental Dashboard Features:
View all personal information collected from the child
Download collected information in machine-readable format (JSON/CSV)
Delete specific data elements or the entire account
Modify consent preferences for each data use
Set usage time limits and content restrictions
Receive weekly activity summary reports
Data Minimisation Measures:
No persistent identifiers collected for advertising purposes
No geolocation data collected (GPS disabled; IP address truncated to /24)
No photographs, videos, or audio recordings stored beyond session
Profile avatar selected from pre-set options (no photo upload for children under 13)
Chat functionality disabled for accounts under 13; moderated text communication only through pre-approved messages
Annual COPPA Audit Checklist
#
Audit Item
Regulatory Reference
Status
1
Privacy policy posted and current
312.4(b)
Review quarterly
2
Direct notice sent before collection
312.4(c)
Automated system verified
3
Verifiable parental consent obtained
312.5
Credit card method validated
4
Parental access mechanism functional
312.6
Dashboard tested monthly
5
No excess data collection
312.7
Quarterly data mapping review
6
Security measures adequate
312.8
Annual penetration test
7
Retention limits enforced
312.10
Automated deletion verified
8
Third-party disclosures documented
312.4(b)(4)
Vendor list updated quarterly
9
Safe harbor membership current
312.11
kidSAFE renewal date tracked
10
Staff training completed
Internal policy
Annual COPPA training for all staff
FTC Enforcement Actions
Epic Games/Fortnite (FTC, 2022): USD 275 million penalty for collecting personal information from children under 13 without parental consent, enabling voice and text communications with strangers by default, and using dark patterns to induce purchases. Largest COPPA penalty in history.
Google/YouTube (FTC, 2019): USD 170 million settlement (USD 136 million FTC, USD 34 million New York AG) for collecting persistent identifiers from viewers of child-directed YouTube channels to serve targeted advertising without obtaining verifiable parental consent.
Musical.ly/TikTok (FTC, 2019): USD 5.7 million settlement for collecting names, email addresses, and other personal information from children under 13 without parental consent while knowing that a significant portion of users were children.
VTech Electronics (FTC, 2018): USD 650,000 settlement for collecting personal information from children including photos, chat logs, and audio recordings without parental consent, and failing to secure the data leading to a breach exposing 6.4 million children's records.
Unixiz Inc./Explore Talent (FTC, 2020): USD 2 million judgment for collecting personal information from children on a talent scouting website without posting a privacy policy, obtaining parental consent, or maintaining reasonable security.
Proposed 2024 COPPA Rule Amendments
The FTC's December 2023 Notice of Proposed Rulemaking proposes significant changes:
Separate consent for targeted advertising: Operators must obtain separate, opt-in parental consent specifically for targeted advertising directed at children — consent for the service itself cannot be bundled with advertising consent
Prohibition on push notification consent: Operators cannot condition access to the service on the parent's consent to send push notifications to the child
Enhanced data security requirements: Operators must implement a written information security program with specific technical safeguards
Expanded definition of personal information: Biometric identifiers added explicitly to the definition
Limits on data retention: Operators must retain children's personal information only for as long as reasonably necessary for the specific purpose for which it was collected
Safe harbor accountability: Enhanced FTC oversight of safe harbor programs including more detailed annual reporting requirements
Integration Points
GDPR Parental Consent: For services operating in both the US and EU, COPPA requirements (under-13 bright line) and GDPR Art. 8 requirements (13-16 depending on Member State) must both be satisfied
Age Verification Methods: COPPA requires age screening; the method must not incentivise false age claims
Children's Data Minimisation: COPPA Section 312.7 aligns with GDPR Art. 5(1)(c) data minimisation principle
EdTech Privacy Assessment: COPPA's school exception (Section 312.5(c)(4)) allows schools to consent on behalf of parents for educational technology used in the classroom
Children's Deletion Requests: COPPA Section 312.6 requires operators to delete children's information upon parental request
