COPPA
Children's Online Privacy Protection Act and Rule
Verifiable parental consent before collecting personal information from children under 13, with notice, access and deletion rights for parents.
The law in brief
COPPA protects the personal information of children under 13 online. Operators of websites, apps and online services directed to children, and general-audience services that know they collect information from children, must get verifiable parental consent before collecting it and must keep it secure.
The FTC enforces it through the Children's Online Privacy Protection Rule, which it updated in 2025.
Who it applies to
- Operators of websites, apps and online services directed to children under 13, judged by factors such as subject matter, visual content, characters and advertising.
- General-audience operators with actual knowledge that they collect personal information from a child under 13.
- Operators that collect personal information through a child-directed service, such as ad networks and plug-ins, where they have actual knowledge.
- Personal information includes names, contact details, persistent identifiers used across sites, photos, voice recordings, geolocation and, since the 2025 update, biometric identifiers.
What it requires
Verifiable parental consent first
Obtain verifiable parental consent before collecting, using or disclosing personal information from a child, using a method reasonably calculated to ensure the person consenting is the parent.
Notice to parents
Post a clear online notice of your practices and send parents a direct notice explaining what you collect and how to consent.
Collect only what is needed
Do not condition a child's participation on disclosing more personal information than is reasonably necessary for the activity.
Security and retention
Keep children's information confidential, secure and intact under a written security program, and keep it only as long as reasonably necessary under a written retention policy.
People's rights
Parents can review the personal information collected from their child, have it deleted, and refuse further collection or use, and must not be required to allow more collection than is reasonably necessary for the child to take part (16 CFR 312.6 and 312.7).
Enforcement and penalties
Civil penalties per violation, adjusted for inflation each year, enforced by the FTC and by state attorneys general. Settlements commonly add deletion orders and long-term compliance programs.
What's changing
Updated rule in force. The FTC's 2025 amendments require separate parental consent before disclosing children's information to third parties for purposes such as targeted advertising, a written information security program and a written data retention policy. Compliance with most of the changes was required by 22 April 2026.
What to do first
- Decide whether your service is directed to children, or whether you have actual knowledge of child users.
- Map every child data flow, including SDKs, analytics and advertising partners.
- Implement verifiable parental consent before collection, and separate consent for third-party disclosures where required.
- Publish a clear notice and a direct notice to parents.
- Adopt the written security program and retention policy the 2025 rule requires, and delete data once it is no longer needed.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Recent developments
-
Meta to implement age‑verification framework under $17 B settlement with 52 U.S. states
The settlement imposes extensive age‑verification and data‑retention obligations on Meta, affecting privacy and surveillance of all users. Meta has agreed to a $17 billion settlement with 52 state attorneys general that mandates age‑assurance technology for its platforms. The settlement requires Meta to apply age‑verification methods within one year, classify users into 18+, 13‑17, and under‑13 buckets, and retain age‑related data only briefly. It also obliges Meta to provide an appeal process and allows AGs to request user data for law‑enforcement purposes.
Source: EFF updates. COPPA in the regulations library.
Sources
- Children's Online Privacy Protection Rule (16 CFR Part 312) eCFR · Official text or regulator