| Area | What the rule says | Planning use |
|---|---|---|
| Who is protected | Children under 13. COPPA reaches commercial websites and online services directed to them, and general audience services that have actual knowledge they are collecting a child’s data. | Parents can treat under-13 accounts as covered. Owners must decide whether their audience or their knowledge brings them in scope. |
| Consent | Verifiable parental consent is required before collecting, using or disclosing a child’s personal information. Disclosure to third parties for targeted advertising needs separate and additional consent. | Build consent as its own step. Do not bundle ad-sharing permission into general consent. |
| Covered data | The definition now includes biometric identifiers such as fingerprints, handprints, retina and iris patterns, and genetic data. It also includes government-issued identifier numbers. | Review forms, sign-up flows and analytics for any of these data types. |
| Security and retention | A written children’s personal information security program, annual risk assessments and at least an annual program review. Children’s data cannot be kept indefinitely. | Assign an owner for the security program and set deletion rules tied to the purpose of collection. |
| Timing | The amended COPPA Rule became effective June 23, 2025. Operators had until April 22, 2026 to comply. | Treat the amended requirements as the working baseline in 2026. |
Figures are drawn from Reinhart’s summary of the amended rule and TrustArc’s COPPA overview.
The childrens online privacy protection act coppa, usually called COPPA, limits how online services collect personal information from children under 13, and most of its duties fall on the operators of those services.
For the wider legal picture, see our data privacy laws explained overview. The rest of this page covers what the law changes for families, what it demands of site owners, and how enforcement has played out.
What COPPA changes for parents
COPPA protects children under 13 years old, and it does so by putting parents in control. Hyperproof’s key-facts guide describes its purpose as placing parents in control of what information is collected from their children online. The FTC issued the COPPA Rule in 2000, and the Rule has been revised since, most recently with the amendments that took effect on June 23, 2025.
In practice, parents hold three levers:
- Consent before collection. A covered service must obtain verifiable parental consent before it collects, uses or discloses a child’s personal information, according to Reinhart. If a service asks for your consent, expect an identity check rather than a simple tick box.
- Access and deletion. Organizations must give parents access to review their child’s personal information, and parents also hold deletion rights, per TrustArc. Use this when an old account or app is no longer wanted.
- A separate decision on advertising. Operators must obtain separate and additional parental consent before disclosing personal information to third parties for targeted advertising. Agreeing to collection does not by itself settle that question, so read that request on its own.
What COPPA changes for website and app owners
A site owner is covered when the service is directed to children under 13 years old, or when a general audience service has actual knowledge that it is collecting children’s personal information. Several practical decisions follow from that test.
- Decide whether your service is child-directed. If it is, COPPA applies from the first visit by a child. If it is not, the duty switches on once you actually know a user is under 13 years old, so a process for handling that knowledge matters.
- Inventory your third-party tools. Third parties such as ad networks and plug-ins must also comply with the rule when they collect children’s data, as Hyperproof explains. An embedded tool that collects identifiers can create exposure for the service hosting it as well as for the tool itself.
- Plan for the security program. The amended rule requires a written children’s personal information security program, with annual risk assessments and a program review at least annually. A small operator can start from the written program and widen it as data collection grows.
- Set retention limits. Operators may not retain children’s information indefinitely. They may keep it only as long as reasonably necessary for the purpose it was collected for, so deletion should be designed in rather than handled ad hoc.
Security duties under COPPA sit alongside wider obligations. The guide US Cybersecurity Laws: A Practical Guide For Businesses And Individuals (2026 Update) – Technopolicy covers the broader US framework that a children’s security program fits into.
Data covered by the COPPA Rule
The COPPA Rule treats a wide range of information as personal information, and the amended definition is broader than many owners assume. Reading the list against your own data flows is the quickest way to find hidden exposure.
- Persistent identifiers. An identifier that can be used to recognize a user over time counts, according to Hyperproof. This reaches tracking and analytics tools, not just sign-up forms.
- Photos, video and audio. Images and voice recordings of a child are covered, so features that let children upload content need the same scrutiny as account registration.
- Geolocation. Location information precise enough to identify a street and town is covered.
- Biometric identifiers. The amended definition adds fingerprints, handprints, retina and iris patterns, and genetic data, per Reinhart.
- Government-issued identifiers. Social security, passport, state identification card and birth certificate numbers now count.
Verifiable parental consent in practice
Websites obtain verifiable parental consent through methods that are reasonably calculated, in light of available technology, to ensure the person giving consent is the child’s parent. The rule sets that standard rather than endorsing a single tool, so an operator should pick a method that fits the risk of the data it collects.
Methods already accepted include:
- a signed consent form;
- a call to a toll-free telephone number;
- a video conference;
- government ID verification.
The amendments, as Reinhart reports, add three more:
- Knowledge-based authentication. This uses dynamic multiple-choice questions that a child would find difficult to answer.
- Government-issued photo identification. The parent submits the ID.
- Text message plus a follow-up. The operator receives a text and then completes an additional step, such as a follow-up text, letter or phone call.
The text-based route suits services that already hold a parent’s phone number, while the ID-based routes suit higher-risk collection. Whichever method you choose, keep the targeted advertising consent as its own request.
Enforcement and penalties
Penalties under COPPA scale with the facts of each case. Hyperproof lists the factors behind the size of a fine: the egregiousness of the violations, prior violations, the number of children involved, how the data was used and the size of the company. A small operator with a limited violation is therefore in a different position from a large platform with many child users, and no single figure should be treated as typical.
The record shows the pattern. Statista’s tracker counts 19 companies fined with disclosed amounts for COPPA violations from 2018 to January 2025. Epic Games received the largest of those penalties in December 2022. For owners, the lesson from that run of cases is that fines are not confined to services built for children; platforms with a large child audience have been among the most exposed.
Operators who also serve UK users face a separate regime, which UK Data Protection And Security Laws Explained: What Businesses And Citizens Need To Know In 2026 – Technopolicy explains.
Frequently asked questions
Does COPPA protect teenagers or adults?
No. COPPA only applies to the personal information of children under 13, according to TrustArc, so teen and adult data falls under other laws.
Do nonprofit organizations have to follow COPPA?
Nonprofit entities are generally not subject to COPPA, per Hyperproof. An organization that is unsure of its status should confirm it before collecting children’s data.
Can states enforce COPPA as well as the FTC?
Yes. COPPA gives states the authority to enforce compliance against entities under their jurisdiction, so an operator can face action beyond the FTC.
What is a safe harbor program?
Safe harbor programs are self-regulatory programs approved by the FTC that provide substantially the same or greater protections than the rule. Under the amended rule they must publicly disclose their membership lists and submit additional information to the FTC.
