The children’s online privacy protection act (coppa) sets rules for online services that collect data from children under 13. Parents must know their rights. Site owners must know their duties. This article explains who COPPA protects, what data counts, and how services must act to meet the law in 2026.
Key Takeaways
- The Children’s Online Privacy Protection Act (COPPA) protects children under 13 by regulating the collection of their personal data online.
- COPPA requires services targeting children or knowingly collecting their data to obtain verifiable parental consent before data collection.
- Operators must provide clear privacy notices detailing data collection, usage, sharing, and parental rights under COPPA.
- To comply with COPPA, operators should limit data collection to necessary information, securely store it, and delete it when no longer needed.
- COPPA extends responsibility to third-party services collecting data through platforms, necessitating contracts and audits for vendor compliance.
- Operators operating in or targeting the U.S. must navigate COPPA’s rules carefully and document compliance efforts, including parental consents and data flow mappings.
Who COPPA Protects And Which Data Is Covered
COPPA protects children under 13. The children’s online privacy protection act (coppa) covers personal information that identifies or contacts a child. The law lists examples. The law covers names, email addresses, phone numbers, home addresses, and persistent identifiers like device IDs. The law also covers photos, videos, geolocation that pinpoints a child, and audio recordings that identify a child. The law treats data that links to a child as personal data.
Parents act as the primary decision makers. The children’s online privacy protection act (coppa) gives parents the right to review and delete their child’s data. Parents can refuse further collection and can demand deletion. The law requires services to give clear notice to parents about what they collect and how they use it.
Some data sits in a gray area. Aggregate or de-identified data may fall outside the law if the data cannot reasonably identify a child. The children’s online privacy protection act (coppa) still applies when a service targets content to children by age or subject. The law applies when a site or app uses child-directed content or knowingly attracts child users.
The law extends to advertising and analytics that collect persistent identifiers. The children’s online privacy protection act (coppa) treats tracking IDs and ad identifiers as covered data when the audience includes children under 13. Services must assess their audience and data flows regularly. A service that mistakenly exposes child data still faces liability under the children’s online privacy protection act (coppa).
How COPPA Applies To Websites, Apps, And Third-Party Services
COPPA applies when a site or app targets or collects data from children under 13. The children’s online privacy protection act (coppa) applies to owned platforms and to third parties that collect data through those platforms. Site owners must map where data flows. They must identify any third-party SDKs, ad networks, analytics tools, or plugins that collect identifiers or personal information.
The children’s online privacy protection act (coppa) holds both operators and certain third parties responsible. Operators must obtain verifiable parental consent before collecting covered data. Third parties that collect data on behalf of an operator must follow the operator’s consent and notice obligations. Some third parties may face direct liability if they act as independent operators under the children’s online privacy protection act (coppa).
Compliance depends on context. A general audience site that does not target children may still fall under the children’s online privacy protection act (coppa) if it has actual knowledge that it collects data from kids under 13. The law uses both intent and actual knowledge tests. The children’s online privacy protection act (coppa) hence requires careful audience assessment, clear age gates, and honest data practices.
Operators must consider cross-border issues. The children’s online privacy protection act (coppa) applies to services that operate in the United States or that direct services to U.S. children. Operators outside the U.S. that target U.S. children must follow the children’s online privacy protection act (coppa) requirements. Operators should document their geographic targeting and data residency decisions to show good faith compliance under the children’s online privacy protection act (coppa).
Practical Steps To Comply: Parental Consent, Notice, And Data Security
Operators must get verifiable parental consent before they collect covered data. The children’s online privacy protection act (coppa) allows several consent methods. Services can use email plus a follow-up, credit card verification, government ID, or a video conference. The children’s online privacy protection act (coppa) requires the consent method to be reasonably designed for the audience and the risk.
Operators must post a clear privacy notice. The children’s online privacy protection act (coppa) requires a notice that lists what data is collected, how the operator uses the data, whether the operator shares data with third parties, and how parents may review and delete their child’s data. The notice must appear on the site or app and at the point of collection.
Operators must limit data collection and retention. The children’s online privacy protection act (coppa) requires operators to collect only what they need and to delete data after it is no longer required. Operators should set retention schedules and delete data automatically when the purpose ends. The children’s online privacy protection act (coppa) expects operators to document business purposes for each data element.
Operators must secure child data. The children’s online privacy protection act (coppa) requires reasonable security measures. Services should use access controls, encryption in transit and at rest, and logging to track access. The children’s online privacy protection act (coppa) also expects breach response plans. Operators should train staff and limit access to only those who need it.
Operators must manage third-party vendors. The children’s online privacy protection act (coppa) requires operators to use contracts that prohibit vendors from using child data beyond the specified purpose. Operators should audit vendors and require them to show compliance. The children’s online privacy protection act (coppa) compliance improves when operators run periodic vendor reviews and remove services that fail to meet standards.
Operators should keep records. The children’s online privacy protection act (coppa) requires documentation of parental consents, notices, data inventories, and vendor contracts. Regulators look for records when they audit. The children’s online privacy protection act (coppa) cases often hinge on missing documentation rather than technical failures.
Operators should seek legal advice for complex cases. The children’s online privacy protection act (coppa) has specific rules and evolving enforcement priorities. A lawyer can help interpret the law, draft consent flows, and design vendor agreements that reduce risk under the children’s online privacy protection act (coppa).
