COPPA: Children's Online Privacy Protection Guide
The Children's Online Privacy Protection Act (COPPA) regulates the online collection, use, and disclosure of personal information from children under 13 years of age. Enforced by the Federal Trade Commission (FTC), COPPA imposes strict requirements on operators of websites, apps, games, and online services directed at children — or that knowingly collect information from children — including verifiable parental consent, clear privacy notices, and data minimization.
What COPPA Covers
COPPA requires operators to post clear, comprehensive privacy policies describing their data practices for children's information. Before collecting personal information from children under 13, operators must obtain verifiable parental consent through an approved mechanism. Parents must be able to review their child's information, request deletion, and refuse further collection.
The definition of "personal information" under COPPA is broad, including names, addresses, email addresses, phone numbers, photos, videos, audio recordings, geolocation data, and persistent identifiers that can be used to recognize a user over time. The FTC has expanded enforcement to cover modern data collection practices including voice recordings by smart speakers and tracking through advertising identifiers.
Who Needs COPPA Compliance
COPPA applies to operators of commercial websites and online services directed at children under 13, and to operators of general audience services that have actual knowledge they are collecting information from children under 13. This includes children's apps, games, educational platforms, social media features, and websites with child-directed content. Third-party plugins and ad networks operating on child-directed sites must also comply.
Implementation Approach
Determine whether your service is child-directed or may collect information from children. Implement age screening mechanisms if operating a general audience service. Develop a COPPA-compliant privacy policy. Build verifiable parental consent mechanisms — FTC-approved methods include signed consent forms, credit card verification, government ID verification, and video conferencing. Implement data minimization practices and retention limits. Consider joining an FTC-approved COPPA Safe Harbor program for self-regulatory compliance.
Cost Considerations
COPPA compliance typically costs $15,000 to $100,000 including privacy program development, consent mechanism implementation, and legal review. FTC enforcement carries severe penalties — recent settlements have exceeded $170 million (Fortnite/Epic Games) and $275 million (Fortnite). The proposed 2024 rule amendments would strengthen requirements further, potentially increasing compliance costs.