🇺🇸Children's Online Privacy Protection Act

Skin

← Back to laws in United States

Children's Online Privacy Protection Act

COPPA protects children’s privacy online

The Children’s Online Privacy Protection Act applies to operators of websites or online services directed to children, and to operators that have knowledge that they collect or maintain personal information from children. A child under COPPA is an individual under the age of 13.

COPPA is not a general children’s safety law. It is a privacy law focused on the collection, use and disclosure of personal information from children online. It requires clear notices, verifiable parental consent, parental review rights, data minimisation for child participation and reasonable security procedures.

When COPPA applies

COPPA applies when an operator runs a website or online service directed to children or knowingly collects personal information from children online. A general-audience service may also fall into COPPA if it has actual knowledge that it is collecting personal information from children under 13.

Personal information under COPPA includes information that can identify or contact a child, such as name, address, email address, telephone number and other individually identifiable online information within the rule’s scope.

Key Provisions

Clear notice: the operator must provide a clear, complete and understandable notice describing its children’s information practices.

Verifiable parental consent: consent must generally be obtained before collecting, using or disclosing personal information from a child.

Parental review: parents must be able to review the child’s personal information and refuse further use or maintenance.

Data minimisation: operators must not require more information than is reasonably necessary for a child to participate in an activity.

Security: operators must maintain reasonable procedures to protect confidentiality, security and integrity of children’s personal information.

Notice and parental consent

The website or online service should place the children’s privacy notice clearly and prominently. The notice should explain who is collecting the information, what information is collected, how it is collected, how it is used, whether it is disclosed to third parties and how parents can review, delete or stop further collection or use.

Before collecting, using or disclosing personal information from children, the operator must make reasonable efforts to obtain verifiable parental consent, subject to limited exceptions. The method of obtaining consent should match the risk of the data use, especially where information may be disclosed publicly or shared with third parties.

Parental control is an ongoing obligation

COPPA does not end once consent is obtained. Parents must be able to request a description of the types of personal information collected from the child, review that information, refuse further use or collection and request deletion. The operator must also take reasonable steps to verify that the person making the request is the child’s parent.

If a parent refuses further collection or asks for deletion, the operator may terminate the service to that child where the information is necessary to provide the service.

Practical risk area

Age-gating alone is not a complete COPPA programme. If the service is child-directed or knowingly collects children’s information, the operator needs notice, consent, parental access, deletion handling, data minimisation and security controls.

What organisations should build

Organisations should identify whether any website, app, game, learning tool, chatbot, community feature or marketing campaign is directed to children or collects information from children. They should maintain a children’s data inventory, a child-specific privacy notice, parental consent records, parental request workflows and vendor controls for any third party that receives children’s personal information.

They should also test whether the service collects unnecessary data for games, prize offers, accounts, comments, avatars, messaging, analytics or advertising. COPPA compliance depends on what the product actually collects and how it behaves, not only on what the privacy notice says.

What this means for you

If your online service is child-directed or you knowingly collect information from children under 13, build COPPA controls before launch. The core compliance tasks are parental notice, verifiable consent, parental access and deletion, minimised collection, secure storage and vendor discipline.

Other laws in United States
CA-DELETE

California Delete Act and Data Broker Requirements

California Privacy Protection Agency

Open law Read analysis
CPPA

California Privacy Rights Act and California Privacy Protection Agency provisions

California Privacy Protection Agency

Open law Read analysis
CLOUD-ACT

Clarifying Lawful Overseas Use of Data Act (CLOUD Act)

United States Department of Justice

Open law Read analysis
42-CFR-P2

Confidentiality of Substance Use Disorder Patient Records

U.S. Department of Health and Human Services, Office for Civil Rights

Open law Read analysis
CAN-SPAM

Controlling the Assault of Non-Solicited Pornography And Marketing Act

Federal Trade Commission

Open law Read analysis
CPNI

Customer Proprietary Network Information Rules

Federal Communications Commission

Open law Read analysis
DPPA

Drivers Privacy Protection Act

United States Department of Justice and federal courts

Open law Read analysis
ECPA-SCA

Electronic Communications Privacy Act and Stored Communications Act

United States Department of Justice

Open law Read analysis
FERPA

Family Educational Rights and Privacy Act

U.S. Department of Education, Student Privacy Policy Office

Open law Read analysis
GINA

Genetic Information Nondiscrimination Act

U.S. Equal Employment Opportunity Commission and federal health agencies

Open law Read analysis
HITECH

Health Information Technology for Economic and Clinical Health Act

U.S. Department of Health and Human Services, Office for Civil Rights

Open law Read analysis
HIPAA

Health Insurance Portability and Accountability Act of 1996

U.S. Department of Health and Human Services Office for Civil Rights

Open law Read analysis
IL-BIPA

Illinois Biometric Information Privacy Act

Illinois Attorney General and private enforcement

Open law Read analysis
MT-CDPA

Montana Consumer Data Privacy Act

Montana Attorney General, Office of Consumer Protection

Open law Read analysis
NJDPA

New Jersey Data Privacy Law

New Jersey Attorney General and Division of Consumer Affairs

Open law Read analysis
PRIVACY-ACT

Privacy Act of 1974

U.S. Department of Justice, Office of Privacy and Civil Liberties

Open law Read analysis
RI-DTPPA

Rhode Island Data Transparency and Privacy Protection Act

Rhode Island Attorney General

Open law Read analysis
UCPA

Utah Consumer Privacy Act

Utah Attorney General and Division of Consumer Protection

Open law Read analysis
VT-DPOSA

Vermont Data Privacy and Online Surveillance Act

Vermont Attorney General

Open law Read analysis
VPPA

Video Privacy Protection Act

United States Department of Justice and federal courts

Open law Read analysis