COPPA (Children’s Online Privacy Protection Act)

A 1998 U.S. federal law (effective 2000) restricting how sites and services collect personal information from children under 13. It applies to any site or app directed at children under 13 — judged by subject matter, visual/audio style, animated characters, and similar cues — or to any operator with actual knowledge that a user under 13 is providing information, regardless of the site’s general audience.

A 1998 U.S. federal law (effective 2000) restricting how sites and services collect personal information from children under 13.

Determine whether the law applies before designing around it

A site doesn’t need to be a “kids’ site” to trigger COPPA — actual knowledge is enough, and actual knowledge can come from the interface’s own design. Asking a birthdate on registration, or an age-identifying question like “what grade are you in?”, creates that knowledge the moment a user answers honestly.

A site doesn’t need to be a “kids’ site” to trigger COPPA — actual knowledge is enough, and actual knowledge can come from the interface’s own design.

A general-audience site that screens for age has to keep that screen genuinely neutral — no framing nudging a user toward one answer over another — and can then rely on whatever age a user enters, even an inaccurate one. The operator’s compliance obligation attaches to what it does with the answer, not to catching every miskeyed age.
A “mixed audience” site (not aimed at children, but not excluding them either) can use an age screen too, but only if it asks age before collecting any other personal information and gates further collection for anyone who answers under 13 behind COPPA’s notice-and-consent steps.
A site actually directed to children doesn’t get this option at all — unlike a general-audience site, it can’t use an age screen to simply turn child users away; it has to go through parental notice and consent instead.

Post a compliant privacy policy, and notify parents directly before collecting

A COPPA privacy policy has to name every operator collecting the child’s information — not just the site’s own operator — with contact details for each, describe what’s collected, how it’s used, and any third-party disclosure, and state a data-retention/deletion timeframe. The link to it must be clear and prominent on the homepage and at every collection point, not buried in fine print or crowded in among unrelated disclosures.

Before collecting anything from a known child, send the parent that same substance directly — what’s being collected, how it will be used, how consent works, and what happens (deletion) if the parent doesn’t respond — rather than relying on the parent finding and reading the general privacy policy unprompted. A material change to what’s actually collected or how it’s used requires sending updated direct notice and getting fresh consent, not just editing the policy page.

Before collecting personal information from a known child under 13, an operator needs verifiable parental consent. The FTC applies a sliding scale rather than one fixed method: lower-risk internal uses can accept lighter verification (email confirmation plus a follow-up check, “email plus”), while disclosure to third parties calls for stronger verification — a signed form, a credit-card or payment confirmation, a phone or video call, or matching a submitted photo against a government ID. Choosing which tier applies is itself a design decision, not just a legal one. Whatever method is used, the consent flow must offer parents an internal-use-only option: a parent can agree to let an operator collect and use their child’s data without also being forced to agree to sharing it with third parties, so a single all-or-nothing consent bundling both isn’t compliant.

The lighter card only needs two steps; the stronger one needs proof of identity because the data is about to leave the site.

Minimize what’s collected and how long it’s kept

Children’s data should be limited to what a given activity actually needs, and retained only as long as that purpose requires before deletion. This extends to persistent identifiers (tracking cookies, device IDs), which need the same parental notice and consent as other personal information, unless used solely for internal site operations with no other collection. Retention has a security counterpart: an operator needs a written information-security program, scaled to how sensitive the collected data is and to the operator’s own size and complexity, and must get written assurances that any third-party service provider or business partner can maintain that same standard before anything is shared with them.

Give parents visibility and control

Parents must have a reasonable way to review what’s been collected about their child, and to refuse further collection or request deletion. In practice this needs a clear, discoverable path to a parental-account view or request channel — the same access and choice baseline Fair Information Practices describes for any customer, exercised here by the parent on the child’s behalf.

Parents must have a reasonable way to review what’s been collected about their child, and to refuse further collection or request deletion.

Patterns

Standards

Fair Information Practices

Sources

Children's Online Privacy Protection Act (Wikipedia) (CC BY-SA) is this page’s original source for COPPA’s “directed at children”/actual-knowledge trigger, the FTC’s risk-calibrated verifiable-parental-consent sliding scale, the persistent-identifier rule, and the parental review/refusal/deletion rights.

Complying with COPPA: Frequently Asked Questions (FTC) (public domain) is the FTC’s own compliance FAQ, the source for the neutral-age-screen and mixed-audience-site age-gating guidance above.

Children's Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business (FTC) (public domain) is the FTC’s own six-step compliance walkthrough, the source for the internal-use-only consent option, the written-security-program and vendor-assurance requirement, and the privacy-policy disclosure/direct-notice guidance above.