Does COPPA apply to a general audience website?

Only when the operator has actual knowledge that it is collecting personal information from children, unless the service is itself directed to children under 13. Actual knowledge is present, for example, when an operator learns of a child's age or grade from the child's registration or from a concerned parent.

Does collecting a birthdate give a site actual knowledge that a user is a child?

It can, according to the FTC's enforcement complaints. In the complaint against Yelp, the FTC alleged that because Yelp collected information from users who gave birthdates showing they were under 13, it was deemed to have actual knowledge that it was collecting information from several thousand children.

Can a company's own human review of apps or content give it actual knowledge under COPPA?

It can, according to one Commissioner's account of the OpenX ad-exchange case. Commissioner Phillips wrote that OpenX's human review of the sites it classified failed, and that only the human review supplied the actual knowledge the Commission needed to obtain civil penalties under COPPA.

Are small businesses exempt from COPPA?

No. The Commission considered and decided not to propose an exemption for small businesses. In its view, an exemption would undermine the very purpose of the statute and Rule.

Does COPPA apply to companies based outside the United States?

Yes, when they direct their service to children in the United States or knowingly collect personal information from children in the United States. The FTC's complaint against InMobi, for instance, alleged that it purposefully directed its activities to the United States.

Can I run behavioral advertising or third-party ad networks on a child-directed app?

Not without parental consent for the persistent identifiers used to target a specific child. On a child-directed property, at least one entity must be strictly responsible for notice and consent even when another party collects the data.

Can a child-directed service use an age screen to avoid treating everyone as a child?

Generally not. Child-directed sites or services whose primary target audience is children must presume all users are children and provide COPPA protections accordingly. The exception is a mixed audience service, which must collect no personal information before asking age in a neutral manner.

Can I use a parental consent method that the Rule does not list?

Only after it has been approved, either by the FTC or, for its member operators, by an FTC-approved safe harbor program. An interested party may file a written request for Commission approval of parental consent methods not currently enumerated in § 312.5(b). The request must include a detailed description of the proposed methods and an analysis of how they meet § 312.5(b)(1), and the Commission shall issue a written determination within 120 days of the filing.

What does a safe harbor program have to show to be approved, and what does membership give an operator?

A proposed program must show that its requirements give children substantially the same or greater protections as §§ 312.2 through 312.8 and 312.10. It must also have a mandatory independent assessment of its operators, including a comprehensive review at least annually. In return, an operator that complies with the approved guidelines is deemed to be in compliance with those sections, though the Commission reserves the right to revoke an approval if the guidelines or their implementation do not meet the Rule's requirements.

Does COPPA protect teenagers?

No. The statute defines a child as an individual under the age of 13. Chair Lina Khan's statement on the final rule says the same thing, noting that COPPA does not apply to kids 13 and older.

KidsAct or rule

COPPA

Berkeley Robinson, Managing Attorney at Robinson Law Firm PLLC

Author

Berkeley Robinson, Esq.

Managing Attorney, Robinson Law Firm PLLC

Berkeley has served as the go-to counsel for many scaling businesses in a transactional and litigation management capacity. Before becoming an attorney, Berkeley grew sales teams, ran online marketing campaigns, and did everything else an entrepreneur does—and still does today as the founder of two online businesses.

Definition

COPPA is the federal statute under which it is unlawful for an operator of a website or online service directed to children, or any operator that has actual knowledge that it is collecting personal information from a child, to collect that information in a manner that violates the FTC's regulations. Source: 15 U.S.C. § 6502(a)(1) A child is an individual under the age of 13, and the FTC's COPPA Rule implements the statute. Source: 15 U.S.C. § 6501(1)

Key legal rules

These are the primary duties COPPA places on a business:

Whether a website or online service, or a portion of one, is directed to children depends on factors the FTC weighs, including subject matter, visual content, animated characters or child-oriented activities, music, age of models, child celebrities, language, and whether its advertising is directed to children. Source: 16 C.F.R. § 312.2 A website or online service is deemed directed to children when it has actual knowledge that it is collecting personal information directly from users of another website or online service directed to children. Source: 16 C.F.R. § 312.2
A service directed to children but not primarily so is a mixed audience service only if it collects no personal information from any visitor, other than for the limited purposes in the consent exceptions, before collecting age information or otherwise determining whether the visitor is a child, and any age check must be neutral and must not default to a set age or encourage visitors to falsify their age. Source: 16 C.F.R. § 312.2
For child-directed properties, at least one entity must be strictly responsible for giving parents notice and obtaining consent when personal information is collected through the site. Source: Children's Online Privacy Protection Rule, Statement of Basis and Purpose (2013 amendments), Part II.A.4.a An operator must obtain verifiable parental consent before any collection, use, or disclosure of personal information from a child, except as the Rule's listed exceptions provide. Source: 16 C.F.R. § 312.5(c)(8) An operator must give the parent the option to consent to collection and use of the child's information without consenting to disclosure to third parties, unless the disclosure is integral to the website or online service, and must obtain separate verifiable parental consent for that disclosure. Source: 16 C.F.R. § 312.5(c)(8) Operators may not gather persistent identifiers for behaviorally targeted advertising to a specific child without parental consent, though collecting only a persistent identifier solely to support the site's internal operations is excepted. Source: Children's Online Privacy Protection Rule, Statement of Basis and Purpose (2013 amendments), Part II.A.5.b An operator may not condition a child's participation in a game, the offering of a prize, or another activity on the child's disclosing more personal information than is reasonably necessary to participate. Source: 16 C.F.R. § 312.7
An operator must make reasonable efforts, taking into account available technology, to ensure that a parent receives direct notice of its practices for collecting, using, or disclosing children's personal information, including notice of any material change to practices the parent previously consented to. Source: 16 C.F.R. § 312.4(b), (d) In addition to direct notice, an operator must post a prominent and clearly labeled link to an online notice of its practices with regard to children on its home or landing page or screen and at each area where personal information is collected from children. Source: 16 C.F.R. § 312.4(b), (d)
Upon a parent's request, an operator must give the parent a description of the specific types or categories of personal information collected from children and the opportunity at any time to refuse further use or future online collection and to direct deletion of the child's personal information. Source: 16 C.F.R. § 312.6(a)
An operator must establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of children's personal information, and at a minimum must establish, implement, and maintain a written information security program. Source: 16 C.F.R. § 312.8 Before letting other operators, service providers, or third parties collect or maintain children's personal information on its behalf, or before releasing that information to them, an operator must take reasonable steps to determine that they can keep it confidential and secure and must obtain written assurances that they will do so. Source: 16 C.F.R. § 312.8
Personal information collected online from a child may not be retained indefinitely, and the operator must maintain a written data retention policy stating the purposes of collection, the business need for retention, and a timeframe for deletion. Source: 16 C.F.R. § 312.10

For the sake of space, this page lists only the primary rules related to this term that most businesses should follow. More may apply to your situation, and your unique facts affect how they apply.

Send us a message through our online form to talk through yours.

Send a message

Response within 24 hours

Why these rules exist

Congress enacted COPPA in 1998 to protect children's safety and privacy online by prohibiting the unauthorized or unnecessary collection of their personal information by operators of websites and online services. Source: Complaint for Permanent Injunction, Civil Penalties and Other Relief, United States v. InMobi Pte Ltd. The primary goal is to place parents in control over what information is collected from their young children online. Source: Letter from Maneesha Mithal, FTC Division of Privacy and Identity Protection, to BabyBus (Fujian) Network Technology Co., Ltd. (Dec. 17, 2014) That control only works if consent comes before collection, because once a child has posted personal information, it is too late to obtain parental consent. Source: Children's Online Privacy Protection Rule, Statement of Basis and Purpose (2013 amendments), Part II.A.1.a

One Commissioner's review of the record found a broad consensus that unauthorized or unnecessary collection, use, retention, and disclosure of children's information endangers children's safety, exposes families to hacks and data breaches, and lets third-party companies develop commercial relationships that prey on children's trust and vulnerability. Source: Statement of Commissioner Alvaro M. Bedoya on the Issuance of the Notice of Proposed Rulemaking to Update the COPPA Rule (Dec. 20, 2023) For that reason the Rule gives parents a separate choice over disclosure to third parties: the rulemaking record showed those disclosures to be among the most sensitive and risky uses of children's personal information. Source: Children's Online Privacy Protection Rule, Statement of Basis and Purpose, 64 Fed. Reg. 59888 (Nov. 3, 1999), Part II.D.1

Enforcement examples

United States v. Xanga.com, Inc. (blog hosting and social networking site)

Complaint and Consent Decree and Order, United States v. Xanga.com, Inc.

Approximately 1.7 million Xanga.com accounts were opened by children under 13 in the five years before the complaint. Source: Complaint, United States v. Xanga.com, Inc. According to the complaint, the defendants disclosed those children's information to the public by posting it in the profile area of the children's blogs. Source: Complaint, United States v. Xanga.com, Inc. The complaint added that the defendants did not take the steps the Rule requires to obtain verifiable consent from parents before collecting, using, or disclosing the information. Source: Complaint, United States v. Xanga.com, Inc.

Outcome. The case carried a $1 million civil penalty, which the FTC Chairman described in 2007 as a record. Source: Keynote Address of FTC Chairman Deborah Platt Majoras, Family Online Safety Institute (Dec. 6, 2007) The consent decree also enjoined the defendants from violating any provision of the COPPA Rule. Source: Consent Decree and Order, United States v. Xanga.com, Inc.

United States v. RockYou, Inc. (slideshow and widget website)

Complaint and Consent Decree and Order for Civil Penalties, Injunction and Other Relief, United States v. RockYou, Inc., No. 12-CV-1487 (N.D. Cal.)

RockYou's website was intended for a general audience but attracted a significant number of children. Source: Complaint for Civil Penalties, Permanent Injunction, and Other Relief, United States v. RockYou, Inc. From about December 2008 through January 2010 it accepted registrations from children under 13 and collected email addresses, passwords, and other registration details from approximately 179,000 of them. Source: Complaint for Civil Penalties, Permanent Injunction, and Other Relief, United States v. RockYou, Inc. The complaint alleged that, contrary to its privacy policy, RockYou knowingly collected and did not delete children's personal information and let children publicly disclose it through profile pages and slideshows. Source: Complaint for Civil Penalties, Permanent Injunction, and Other Relief, United States v. RockYou, Inc.

Outcome. The consent decree required a $250,000 civil penalty. Source: Consent Decree and Order for Civil Penalties, Injunction and Other Relief, ¶¶ 14, 16, 18, No. 12-CV-1487 (N.D. Cal.) (United States v. RockYou, Inc.) It also required RockYou to delete the personal information it had collected in violation of the Rule from April 21, 2000 through the date of entry of the order. Source: Consent Decree and Order for Civil Penalties, Injunction and Other Relief, ¶¶ 14, 16, 18, No. 12-CV-1487 (N.D. Cal.) (United States v. RockYou, Inc.)

FTC and New York v. Google LLC and YouTube, LLC (video-sharing platform)

Complaint and Stipulated Order for Permanent Injunction and Civil Penalty Judgment, FTC and New York v. Google LLC and YouTube, LLC

YouTube enabled behavioral advertising by default on monetized channels. Source: Complaint for Permanent Injunction, Civil Penalties, and Other Equitable Relief, ¶ 24 (FTC and New York v. Google LLC and YouTube, LLC) The complaint alleged that YouTube had actual knowledge it was collecting personal information directly from users of child-directed channels, which made it an operator of a service directed to children. Source: Complaint for Permanent Injunction, Civil Penalties, and Other Equitable Relief, ¶ 24 (FTC and New York v. Google LLC and YouTube, LLC) It further alleged that YouTube never tried to give parents the COPPA-specified notice or to obtain verifiable parental consent. Source: Complaint for Permanent Injunction, Civil Penalties, and Other Equitable Relief, ¶ 24 (FTC and New York v. Google LLC and YouTube, LLC)

Outcome. The stipulated order provided for a $136,000,000 civil penalty judgment in favor of the FTC. Source: Stipulated Order for Permanent Injunction and Civil Penalty Judgment, FTC and New York v. Google LLC and YouTube, LLC It also provided for $34,000,000 in favor of the State of New York as damages, restitution, or other compensation to its residents. Source: Stipulated Order for Permanent Injunction and Civil Penalty Judgment, FTC and New York v. Google LLC and YouTube, LLC In addition, the order barred YouTube from failing to develop, implement, and maintain a system for channel owners to designate whether their content is directed to children. Source: Stipulated Order for Permanent Injunction and Civil Penalty Judgment, FTC and New York v. Google LLC and YouTube, LLC

In re Miniclip S.A. (mobile and online game publisher)

Complaint, In the Matter of Miniclip S.A., Docket No. C-4722 (June 29, 2020)

Miniclip joined CARU's COPPA safe harbor program in July 2009. Source: Complaint, In the Matter of Miniclip S.A., Docket No. C-4722 (June 29, 2020) It told the public on a website page that it had been accepted to the program and certified as COPPA compliant. Source: Complaint, In the Matter of Miniclip S.A., Docket No. C-4722 (June 29, 2020) CARU terminated Miniclip's participation on July 6, 2015. Source: Complaint, In the Matter of Miniclip S.A., Docket No. C-4722 (June 29, 2020) Miniclip nonetheless kept making the claims afterward. Source: Complaint, In the Matter of Miniclip S.A., Docket No. C-4722 (June 29, 2020)

Outcome. The proposed one-count complaint alleged a deceptive act or practice, not an unlawful collection of children's data: falsely representing that Miniclip was a current participant in the safe harbor program when it was not. Source: Analysis of Proposed Consent Order to Aid Public Comment, In the Matter of Miniclip S.A., File No. 192 3129 The decision and order barred Miniclip from misrepresenting the extent to which it participates in any privacy or security program sponsored by a government or a self-regulatory or standard-setting organization. Source: Decision and Order, In the Matter of Miniclip S.A.

United States v. Kurbo, Inc. and WW International, Inc. (children's weight-management app)

Complaint, United States v. Kurbo, Inc., No. 22-CV-946 (N.D. Cal.), and Stipulated Order

The complaint alleged that, since at least 2014, the defendants offered weight management services to children online and collected and kept those children's personal information without notifying or obtaining consent from their parents. Source: Complaint, United States v. Kurbo, Inc. and WW International, Inc., No. 22-CV-946 (N.D. Cal.) The app's age gate, the complaint said, signaled to children that they could register without involving a parent by indicating they were at least 13. Source: Complaint, United States v. Kurbo, Inc. and WW International, Inc. Until August 2021 the defendants also retained children's personal information indefinitely, deleting it only when a parent asked. Source: Complaint, United States v. Kurbo, Inc. and WW International, Inc.

Outcome. The stipulated order entered a $1.5 million civil penalty judgment against the defendants jointly and severally. Source: Stipulated Order, United States v. Kurbo, Inc. and WW International, Inc. It also required a retention schedule for children's personal information with a deletion time frame that may not exceed one year after a user last tracked food, weight, or activity intake. Source: Stipulated Order, United States v. Kurbo, Inc. and WW International, Inc.

United States v. Edmodo, LLC (education platform)

Complaint and [Proposed] Stipulated Order for Permanent Injunction and Civil Penalty Judgment, United States v. Edmodo, LLC

The complaint alleged that Edmodo did not give parents direct notice, did not obtain parental authorization before collecting students' personal information, and did not retain children's information only as long as reasonably necessary. Source: Complaint for Permanent Injunction, Civil Penalties, and Other Equitable Relief, United States v. Edmodo, LLC The complaint also charged an FTC Act violation for unfairly requiring schools and teachers to comply with the Rule on Edmodo's behalf without giving them adequate information or support. Source: [Proposed] Stipulated Order for Permanent Injunction and Civil Penalty Judgment, United States v. Edmodo, LLC

Outcome. The settlement required a $6 million civil penalty, which has been suspended due to inability to pay. Source: Reasons for Settlement, United States v. Edmodo, LLC The proposed stipulated order enjoined Edmodo from relying on schools to act as intermediaries to obtain verifiable parental consent on its behalf. Source: [Proposed] Stipulated Order for Permanent Injunction and Civil Penalty Judgment, United States v. Edmodo, LLC

United States v. Amazon.com, Inc. (Alexa voice assistant)

Complaint and Stipulated Order for Permanent Injunction, Civil Penalty Judgment, and Other Relief, United States v. Amazon.com, Inc.

The complaint alleged that, until September 2019, Amazon retained children's voice recordings and transcripts indefinitely unless a parent actively deleted them. Source: Complaint, United States v. Amazon.com, Inc. It also alleged that when parents asked Amazon to delete their children's voice recordings, Amazon did not also delete the written transcripts of those recordings. Source: Complaint, United States v. Amazon.com, Inc., Count IV

Outcome. The stipulated order required deletion, within 90 days of identifying an inactive child profile, of personal information collected from the child, unless the parent asks that it be retained or the profile becomes active again. Source: Stipulated Order for Permanent Injunction, Civil Penalty Judgment, and Other Relief, United States v. Amazon.com, Inc., No. 2:23-cv-00811-TL (W.D. Wash.) Under the order's definition, an inactive profile was one that has not been used for 18 months or more. Source: Stipulated Order for Permanent Injunction, Civil Penalty Judgment, and Other Relief, United States v. Amazon.com, Inc., Definition K

United States v. Cognosphere, LLC (Genshin Impact online video game)

Complaint and Proposed Stipulated Order for Permanent Injunction, Civil Penalty Judgment, and Other Relief, United States v. Cognosphere, LLC

The complaint alleged that, although Genshin Impact met the criteria for being directed to children, Cognosphere did not give parents notice or receive their consent before collecting children's personal information, and did not attempt to differentiate adult from child players at all. Source: Statement of Commissioner Andrew N. Ferguson Concurring in Part and Dissenting in Part, In the Matter of Cognosphere, LLC The complaint further alleged that Cognosphere took no corrective action even when it became aware that specific users were children. Source: Statement of Commissioner Andrew N. Ferguson Concurring in Part and Dissenting in Part, In the Matter of Cognosphere, LLC

Outcome. The stipulated order imposed a civil penalty of $20,000,000. Source: Reasons for Settlement, United States v. Cognosphere, LLC and Cognosphere Pte. Ltd. It also required the defendants to implement a neutral age gate within 120 days after the effective date. Source: Proposed Stipulated Order for Permanent Injunction, Civil Penalty Judgment, and Other Relief, United States v. Cognosphere, LLC

United States v. Disney Worldwide Services, Inc. (child-directed videos on YouTube)

Complaint and Stipulated Order for Permanent Injunction, Civil Penalty Judgment, and Other Relief, United States v. Disney Worldwide Services, Inc.

The complaint alleged that Disney made popular child-directed videos available through YouTube but failed in some cases to mark them as child-directed, which allowed targeted advertising through the collection of children's personal information without parental notice or consent. Source: Complaint, United States v. Disney Worldwide Services, Inc.

Outcome. The order entered a $10,000,000 civil penalty judgment. Source: Order for Permanent Injunction, Civil Penalty Judgment, and Other Relief, United States v. Disney Worldwide Services, Inc. It also required Disney to establish, implement, and maintain for ten years a program to review whether each of its YouTube videos is a Kids Video. Source: Order for Permanent Injunction, Civil Penalty Judgment, and Other Relief, United States v. Disney Worldwide Services, Inc., Part II A federal judge approved the order in December 2025. Source: FTC Case Summary, Disney Worldwide Services, Inc. and Disney Entertainment Operations LLC

Exposure

A violation of the COPPA Rule is treated as a violation of a rule defining an unfair or deceptive act or practice, subject to the safe harbor and enforcement provisions in sections 6503 and 6505. Source: 15 U.S.C. § 6502(a)(1) Section 6505 adds that any entity that violates the rule is subject to the penalties provided in the Federal Trade Commission Act. Source: 15 U.S.C. § 6505(b), (d) For some entities the statute assigns enforcement to a sector regulator instead, such as the National Credit Union Administration Board for federal credit unions. Source: 15 U.S.C. § 6505(b), (d) In the complaint against Iconic Hearts, the government pleaded a ceiling of $53,088 for each violation of the Rule assessed after January 17, 2025. Source: Iconic Hearts Complaint, ¶ 63 That figure has risen over time: the early Looksmart complaint cited a ceiling of $11,000 per violation. Source: Complaint, United States v. Looksmart Ltd.

Penalties are pleaded per event, not per case. Each collection, use, or disclosure of a child's personal information that violates the Rule is charged as a separate violation. Source: Iconic Hearts Complaint, ¶ 63 Time adds to the count as well, because each day an operator maintains data collected in violation of the Rule, or continues to collect such data, is pleaded as a continuing failure and a separate violation. Source: Iconic Hearts Complaint, ¶ 63

In a separate statement, Commissioner Phillips wrote that, in setting an amount, the Commission is guided by the civil penalty factors in Section 5(m) of the FTC Act: the degree of culpability, any history of prior such conduct, ability to pay, effect on ability to continue to do business, and such other matters as justice may require. Source: Separate Statement of Commissioner Noah Joshua Phillips, United States and People of the State of New York v. Google LLC and YouTube, LLC (Sept. 4, 2019) The results vary widely. The YouTube order provided for $136,000,000 for the FTC plus $34,000,000 for New York. Source: Stipulated Order for Permanent Injunction and Civil Penalty Judgment, FTC and New York v. Google LLC and YouTube, LLC The Disney order entered $10,000,000. Source: Order for Permanent Injunction, Civil Penalty Judgment, and Other Relief, United States v. Disney Worldwide Services, Inc. At the other end, the Edmodo settlement's $6 million penalty was suspended because the company could not pay. Source: Reasons for Settlement, United States v. Edmodo, LLC

Individuals can be liable too. In the HyperBeard matter, the proposed stipulated order entered a $4,000,000 civil penalty judgment jointly and severally against the corporation and an individual officer. Source: [Proposed] Stipulated Order for Permanent Injunction and Civil Penalty Judgment, United States v. HyperBeard, Inc. The remainder of that judgment would be suspended once the corporation paid $150,000. Source: [Proposed] Stipulated Order for Permanent Injunction and Civil Penalty Judgment, United States v. HyperBeard, Inc. Orders also enjoined future violations, as in the Xanga consent decree. Source: Consent Decree and Order, United States v. Xanga.com, Inc.

State attorneys general can also enforce the Rule. When a state attorney general has reason to believe a practice that violates the Commission's regulation threatens or adversely affects the state's residents, the state, as parens patriae, may sue in federal district court. Source: 15 U.S.C. § 6504(a), (d) A state may not bring that action against a defendant named in an FTC action on the same regulation while the FTC action is pending. Source: 15 U.S.C. § 6504(a), (d) In the YouTube matter, the complaint invoked 15 U.S.C. § 6504(a)(1) for New York to enjoin violations, enforce compliance, and obtain damages, restitution, or other compensation. Source: Complaint for Permanent Injunction, Civil Penalties, and Other Equitable Relief, FTC and New York v. Google LLC and YouTube, LLC, ¶ 56 One Commissioner wrote that state attorneys general can seek only forfeiture of ill-gotten gains and refunds to victims, not financial penalties beyond that. Source: Dissenting Statement of Commissioner Rohit Chopra, In the Matter of Google LLC and YouTube, LLC (Sept. 4, 2019)

FAQs

1.15 U.S.C. § 6502. 15 U.S.C. § 6502(a)(1)
2.s6501. 15 U.S.C. § 6501(1)See also 16 CFR 312.1. 16 C.F.R. § 312.1
3.16 CFR 312.2. 16 C.F.R. § 312.2