COPPA, the US law that protects children's data online

COPPA is the US Children's Online Privacy Protection Act, a 1998 federal law enforced by the Federal Trade Commission (FTC) that protects the personal information of children under 13. It applies to websites, apps and online services directed to children, and to any operator with actual knowledge that it collects data from a child under 13. The core COPPA requirements are:

• post a clear privacy notice and give parents direct notice
• get verifiable parental consent before collecting, using or disclosing a child's data, and separate consent before disclosing it to third parties such as advertisers
• let parents review and delete their child's data
• collect no more than the activity needs, keep it secure and delete it under a written retention policy

What COPPA requires and who it applies to

The Children's Online Privacy Protection Act is implemented by the COPPA Rule, 16 CFR Part 312. It applies to operators of websites, apps, and online services that either are directed to children under 13 or have actual knowledge that they are collecting personal information from children under 13.

COPPA does not only apply to websites designed for children. A general-audience site is covered once it has actual knowledge that it is collecting personal information from a child under 13, for example when a user enters a birth date showing they are 11. Whether a site counts as directed to children is a separate test, covered below, and features likely to attract younger users, such as games, quizzes or animated characters, feed into it.

The law covers a broad range of personal information: full names, email addresses, physical addresses, phone numbers, photographs, audio or video files, geolocation data, and persistent identifiers such as cookie IDs that can recognise a user over time and across different websites or services.

The 2025 COPPA Rule amendments

On 16 January 2025, the FTC approved significant amendments to the COPPA Rule. Published in the Federal Register on 22 April 2025, they took effect on 23 June 2025, and operators had until 22 April 2026 to comply with most of them. As of October 2026, every operator covered by COPPA must meet the amended rule.

The amendments expand the definition of "personal information" to include biometric identifiers and government-issued identifiers. They also tighten third-party sharing: operators must now obtain separate verifiable parental consent before disclosing a child's personal information to third parties, including for targeted advertising, unless the disclosure is integral to the service.

Data retention limits are another major change. Operators can no longer hold children's personal information indefinitely. They may keep it only for as long as reasonably necessary for the purpose it was collected for, and must publish a written data retention policy in their privacy notice.

FTC-approved safe harbour programmes must now publicly post a list of the operators they certify, with their websites and services, and update it every six months. This lets parents check whether a service is part of a programme.

Verifiable parental consent: methods and standards

The centrepiece of COPPA is verifiable parental consent (VPC). Before collecting, using, or disclosing personal information from a child under 13, you must notify the parent and obtain their verifiable authorisation.

The FTC does not prescribe a single method. Instead, it requires a method "reasonably designed, in light of available technology, to ensure that the person providing consent is the child's parent." Acceptable methods include:

• Signing and returning a consent form by post, fax, or email
• Credit card transactions where a charge is made and disclosed as a verification mechanism
• Knowledge-based authentication using questions a child under 13 could not reasonably answer
• Government-issued photo identification verified against a database
• Face verification compared against government-issued identification
• Video conferencing with trained personnel
• Text message verification combined with additional identity confirmation steps

There are limited exceptions. You do not need VPC to collect a child's email address solely to respond to a one-off request, or to collect a persistent identifier strictly to support the internal operations of the website, such as maintaining it or running analytics that are not used to build a profile or shared with third parties.

What counts as a "child-directed" website

The FTC uses a multi-factor test to decide whether a site or service is directed to children. Factors include subject matter, visual content, use of animated characters or child-oriented activities, the age of models, the presence of child celebrities, music or other audio content, and whether advertising on the site is directed at children.

"Mixed audience" sites are a special case. The amended rule defines a mixed audience service as one that is directed to children but does not target them as its primary audience. Such a service may screen visitors' ages before collecting personal information, and must then apply COPPA's protections to any user identified as under 13.

This matters for education websites, gaming platforms, and any service with user-generated content where children might participate alongside adults.

Persistent identifiers and cookies under COPPA

COPPA treats persistent identifiers - including cookies, device IDs, and IP addresses - as personal information when they can recognise a user over time and across different websites or services. On a child-directed site, an advertising identifier such as _fbp needs verifiable parental consent. An identifier used only for internal operations, such as first-party analytics with no profiling or sharing, can fall under the support-for-internal-operations exception.

This has direct implications for marketing cookies and third-party tracking scripts. If your site is directed to children, or you know some users are under 13, you need a way to keep advertising cookies off for them - even before a cookie banner interaction occurs.

FTC enforcement: recent actions and penalties

The FTC's recent cases show the scale of penalties:

On 2 September 2025, the FTC announced the Disney settlement: Disney uploaded child-directed videos to channels set as "Not Made for Kids", so many were not labelled correctly and data was collected for targeted advertising. The FTC acts against both large technology companies and smaller operators, including companies based outside the US such as Apitor (China) and Cognosphere (Singapore).

COPPA compared to other privacy frameworks

COPPA works differently from the GDPR, the CCPA and other privacy laws. Knowing the differences helps if your site serves a global audience.

If your website serves both US children and young users in the EU and UK, every applicable framework applies at once. COPPA is more prescriptive about verification methods than GDPR Article 8, but the GDPR's age thresholds can be higher.

Practical steps for COPPA

Start by assessing whether COPPA applies to your site: is it directed to children under the FTC's factors, or do you know some users are under 13?

Audit your data collection

Run a cookie scan to identify every cookie and tracker on your site. Document which ones collect persistent identifiers and whether they are used only for internal operations or for advertising and profiling.

Implement age screening

For mixed-audience sites, add a neutral age gate before collecting personal information. Do not design the gate to encourage children to enter a false age. The FTC considers "Please enter your birthday" with a free-form field more acceptable than "Are you over 13? [Yes/No]" where the correct answer is obvious.

Build a parental consent flow

Choose a VPC method appropriate for your audience and technical capabilities. Make sure your privacy notice is written in plain language and describes what data you collect, how you use it, which third parties receive it and how long you keep it. The FTC requires this notice to be "clearly and understandably written" with no unrelated or confusing material.

Block third-party scripts for under-13 users

Configure your site to conditionally load third-party scripts only after verifying a user is not under 13 or after obtaining valid parental consent. This applies to advertising pixels, analytics tools that build profiles, and social media widgets that set persistent identifiers.

Common COPPA misconceptions

"My site isn't for children, so COPPA doesn't apply." For a general-audience site, the test is actual knowledge. If you receive emails from parents, see birth dates showing users under 13, or collect ages that reveal them, you have that knowledge for those users. Content that clearly appeals to children can also make the site child-directed under the FTC's factors.

"COPPA only applies to US-based companies." The FTC has taken enforcement action against companies based in China and Singapore. If your site or app is directed to US children, or you know you collect data from US children, COPPA applies regardless of where your business is located.

"We just need a checkbox saying 'I am over 13'." A checkbox does not constitute verifiable parental consent. The FTC has been clear that age gates must be neutral and that parental consent must involve a genuine verification step.

Questions about COPPA

See which trackers could reach a child

If your website could attract visitors under 13, start by knowing which cookies and trackers are active on it. Kukie.io scans your pages, sorts each cookie by purpose and can hold advertising and analytics scripts until a choice is made.

Start free