Protect children's data and meet COPPA with confidence

COPPA is the Children's Online Privacy Protection Act, a US federal law passed in 1998 that protects the personal information of children under 13 online. The FTC implements it through the COPPA Rule (16 CFR Part 312), which requires operators to post a clear privacy policy, give direct notice to parents, obtain verifiable parental consent before collecting children's data, let parents review and delete it, and keep it secure.

COPPA applies to operators of commercial websites, apps and online services directed to children under 13, and to general audience services with actual knowledge that they collect personal information from a child under 13. Third parties such as ad networks and plug-ins are also covered when they knowingly collect data through a child-directed service. Foreign companies are covered if they target or knowingly collect data from children in the US.

Violations of the COPPA Rule are treated as unfair or deceptive practices under the FTC Act, so courts can impose civil penalties for each violation, at a maximum amount the FTC adjusts every year for inflation. State attorneys general can also bring actions. FTC settlements have included large civil penalties, mandatory deletion of unlawfully collected data and ongoing compliance obligations, so the exposure for a popular service can be significant.

The FTC published amendments to the COPPA Rule on 22 April 2025, and most operators had to comply by 22 April 2026. Changes include separate verifiable parental consent for disclosing children's data to third parties such as advertisers, a written information security programme, a written data retention policy published in the privacy notice, and an expanded definition of personal information that includes biometric identifiers and government-issued identifiers.

To comply with COPPA, first decide whether your service is directed to children or has actual knowledge of under-13 users. Then publish a compliant privacy policy, give parents direct notice, obtain verifiable parental consent before collecting data, let parents review and delete their child's information, collect only what is reasonably necessary, keep a written security programme and retention policy, and check the third parties you share data with.

COPPA overlaps with GDPR, which sets its own age of consent for children's data between 13 and 16 depending on the EU member state, but the two laws have different scopes and consent rules. ISO 27001 does not address parental consent, but its security controls support COPPA's requirement for a written information security programme and reasonable safeguards. Mapping controls across all three avoids duplicated work.

There is no official government COPPA certification. Operators can self-assess against the COPPA Rule or join an FTC-approved safe harbor programme, which reviews member practices and gives a degree of protection when a member follows the programme's guidelines. Safe harbor membership does not remove the operator's own legal responsibility to comply with the Rule.

Yes. COPPA is supported in OneClickComply today. You can use mapped controls, AutoComplete policies, automated evidence collection, vendor risk management and Ask an Auditor guidance to work towards COPPA's security, retention and governance obligations. Controls you already run for ISO 27001, SOC 2 or GDPR count towards COPPA too. OneClickComply does not certify COPPA compliance.