Skip to Content

Privacy & Data

Tech Policy for Startups: Children’s Online Privacy Protection Act (COPPA)

The Gist: COPPA regulates information that is collected about children under the age of 13 and how it is used. The Federal Trade Commission (FTC) is tasked with developing and enforcing regulations for online service providers offering services to children under 13.

Why It Matters: If a business is geared towards children 12 and under, and has an online component (desktop and/or mobile), COPPA applies — even if kids are only part of the target audience. The main parts of COPPA require limiting the information a provider collects and getting parental consent before collecting personal information from children. Despite this, it is certainly possible to comply with COPPA and provide kids and schools with great websites and apps. The FTC has guidance on how to do so.

The Need to Know: The FTC has outlined six steps for businesses to consider if they their target audience/customer is children under 13.

  1. Determine if the company, website or online service collects personal information from kids under 13
  2. Post a privacy policy that complies with COPPA
  3. Notify parents directly before collecting information from their kids
  4. Get parents’ verifiable consent before collecting information from their kids
  5. Honor parents’ ongoing rights with respect to information collected from their kids
  6. Implement reasonable procedures to protect the security of kids’ personal information

All six steps require knowledge and understanding of COPPA and should be considered during the early stages of business or product development. Mobile developers should especially be aware that geo-location is considered personal information.

How to Know If COPPA Applies

COPPA applies to anyone offering a service that’s “directed to children” under 13. The FTC looks at a number of factors, including whether it features animated characters or language aimed at kids. The FTC will also consider whether advertising appearing on the site is targeted to children.

COPPA will also apply to businesses — even those aimed at adults — if the business has “actual knowledge” that a specific user is a child — that is, if it collects age or date-of-birth from a user and she indicates she’s under 13.

For businesses that COPPA is likely to apply to, the FTC breaks down each step and offers more information on complying with COPPA and has answers about the latest updates to the law.