Children’s Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business (FTC)
The FTC’s own operational walkthrough of COPPA compliance, organized as six sequential steps rather than the FAQ format of Complying with COPPA: Frequently Asked Questions (FTC): determine coverage, post a compliant privacy policy, notify parents directly, obtain verifiable parental consent, honor ongoing parental rights, and implement security/retention procedures.
License: Public domain — U.S. federal government work (17 U.S.C. § 105), the same basis as Complying with COPPA: Frequently Asked Questions (FTC).
Key points
- Privacy policy disclosures: a compliant policy must list every operator collecting the child’s information (not just the site’s own operator) with contact details for each, describe what’s collected, how it’s used, and any third-party disclosure, and state a data-retention/deletion timeframe. The link to it must be “clear and prominent” on the homepage and at every collection point — not buried in fine print or crowded in with unrelated disclosures.
- Direct parental notice: before collecting anything from a known child, send the parent the same substance directly (what’s being collected, how it’ll be used, how consent works, and what happens if the parent doesn’t respond) rather than relying on them finding the general privacy policy on their own. A material change to what’s collected or how it’s used requires updated direct notice and fresh consent, not just an edited policy page.
- Consent granularity: parents must be given the option to consent to internal-only collection without also being forced to agree to third-party disclosure — bundling the two into one all-or-nothing consent isn’t allowed.
- Verifiable-consent methods, a longer list than the FAQ’s own summary: signed consent via fax/mail/scan, a payment-card or online-payment transaction confirmation, a trained-staff toll-free number or video call, government-ID verification against a database (the ID must then be deleted), knowledge-based challenge questions, and photo-ID verification via facial recognition (the photo must then be deleted). A lighter email/text-plus-confirmation method is allowed only when the information is used solely for internal purposes and never disclosed to third parties.
- Security and retention procedures: an operator needs a written information-security program scaled to the sensitivity of what’s collected and the business’s own size and complexity, and must obtain written assurances from any third-party service provider or business partner that they can maintain that same security standard before sharing anything with them. A written retention/deletion policy should minimize what’s collected in the first place and hold data only as long as the specific purpose requires.