Children's Online Privacy Protection Act (COPPA) Explained

Any website or app that might attract children under 13 faces a specific, strictly enforced federal privacy law — and the penalties for getting it wrong can be severe.

Who COPPA Covers

COPPA applies to operators of websites and online services directed at children under 13, and to general-audience services that have actual knowledge they're collecting personal information from children under 13.

Whether a service is "directed to children" depends on factors like subject matter, visual content, use of animated characters, and actual audience composition — not simply whether the operator intends the service for children.

Core COPPA Requirements

Covered operators generally must provide clear notice of their data practices, obtain verifiable parental consent before collecting personal information from children under 13, and give parents the ability to review and request deletion of their child's information.

The law also restricts how children's data can be used, particularly for behavioral advertising, and imposes specific data retention and security requirements.

Enforcement and Penalties

The Federal Trade Commission actively enforces COPPA, and violations can result in significant civil penalties assessed per violation, which can add up quickly for services with many affected child users.

High-profile COPPA enforcement actions against both children's platforms and general-audience platforms that failed to properly screen for child users have resulted in some of the largest privacy penalties ever imposed in the U.S.

Frequently Asked Questions

Does COPPA apply to my general-audience app if some users happen to be under 13?

It can, if the operator has actual knowledge of this, which is why age-screening mechanisms matter even for services not specifically designed for children.

What counts as verifiable parental consent under COPPA?

The FTC recognizes several acceptable methods, including a signed consent form, credit card verification, or a phone or video call, among others.

COPPA compliance is a strict, actively enforced area of privacy law. An attorney can help you determine whether your service is covered and build compliant data practices from the outset.