Coppa Compliance

COPPA Compliance — Children's Online Privacy Protection Act

Overview

The Children's Online Privacy Protection Act (COPPA), codified at 15 U.S.C. Sections 6501-6506 and implemented through the FTC's COPPA Rule at 16 CFR Part 312, regulates the online collection, use, and disclosure of personal information from children under 13 years of age. COPPA applies to operators of commercial websites and online services (including mobile apps) directed to children under 13, or operators with actual knowledge that they are collecting personal information from a child under 13. The FTC's 2013 amendments significantly expanded the scope to cover persistent identifiers used for behavioural advertising, photos, videos, audio recordings, and geolocation data. The FTC issued a Notice of Proposed Rulemaking (NPRM) in December 2023 proposing further amendments including restrictions on push notifications to children and expanded consent requirements for targeted advertising.

Statutory and Regulatory Framework

COPPA Statute — 15 U.S.C. Section 6502

• Section 6502(a)(1): Unlawful for an operator of a website or online service directed to children, or having actual knowledge of collecting from a child under 13, to collect personal information in a manner that violates the FTC's regulations.
• Section 6502(b)(1): FTC must issue regulations requiring operators to: (A) provide notice of information practices; (B) obtain verifiable parental consent; (C) allow parents to review information collected; (D) allow parents to refuse further collection/use; (E) limit collection to what is necessary for the activity.
• Section 6502(b)(2): FTC shall apply regulations considering competitive impact, costs, and benefits, and potential effect on existing safe harbor programs.

COPPA Rule — 16 CFR Part 312

Section 312.2 — Key Definitions

• Child: An individual under the age of 13
• Operator: Any person who operates a website or online service and collects or maintains personal information from or about users, or on whose behalf such information is collected or maintained
• Personal information: Individually identifiable information including: first and last name; home or physical address; online contact information (email); telephone number; Social Security number; persistent identifier that can be used to recognise a user over time and across different websites; photograph, video, or audio file containing a child's image or voice; geolocation information sufficient to identify street name and city; information concerning the child or parents collected and combined with any of the above
• Website or online service directed to children: Determined by: subject matter, visual content, use of animated characters, child-oriented activities and incentives, music, age of models, presence of child celebrities, ads directed at children, competent evidence regarding the target audience
• Support for internal operations: Activities necessary to maintain or analyse the functioning of the website or online service, including one-time collection and non-contact use, frequency capping, legal compliance, security, contextual advertising, personalising content (not for advertising)

Section 312.3 — Obligations of Operators

1. Direct notice to parents (Section 312.4): Before collecting, using, or disclosing personal information from a child, the operator must provide clear and prominent notice on the website/service and directly to the parent
2. Verifiable parental consent (Section 312.5): Must obtain verifiable parental consent before any collection, use, or disclosure, except for narrow exceptions
3. Parental access (Section 312.6): Must provide parents with reasonable means to review the personal information collected from their child and to refuse to permit further collection or use
4. Confidentiality, security, and integrity (Section 312.8): Must establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children
5. Data minimisation (Section 312.7): Must not condition a child's participation in an activity on providing more personal information than is reasonably necessary
6. Data retention (Section 312.10): Must retain personal information collected from a child only as long as reasonably necessary to fulfil the purpose for which it was collected

Verifiable Parental Consent Methods — Section 312.5(b)

The FTC recognizes the following methods for obtaining verifiable parental consent. Controllers must select the appropriate method based on the sensitivity of data collected and how it will be used.

Method 1: Signed Consent Form

• Parent prints, signs, and returns a consent form to the operator via postal mail, fax, or electronic scan
• Form must identify the operator, list all information to be collected, describe uses and disclosures, and state that the parent can revoke consent
• Suitable for initial high-assurance verification
• Limitation: Slow turnaround, accessibility barriers for parents without printing capability

Method 2: Credit Card or Other Online Payment Transaction

• Parent uses a credit card, debit card, or other online payment system that provides notification of each discrete transaction to the primary account holder
• The transaction must be a bona fide purchase or donation, or a micro-transaction (e.g., USD 0.50) disclosed to the parent
• Credit card verification alone (without a transaction) is insufficient; there must be an actual monetary transaction
• Limitation: Excludes unbanked families; may deter participation

Method 3: Toll-Free Telephone Number or Video Conference

• Parent calls a toll-free number staffed by trained personnel who verify the parent's identity through knowledge-based questions
• Alternatively, parent connects through a video conference call where identity is confirmed visually
• Operator must train staff on COPPA requirements and verification protocols
• Limitation: Resource-intensive; staffing requirements for multi-language support

Method 4: Government-Issued ID with Comparison to Database

• Parent submits a government-issued identification (driver's license, passport) which the operator checks against a database
• The ID must be deleted promptly from the operator's records after verification is complete
• Must comply with Section 312.5(b)(4) requirements for deletion of ID after verification
• Limitation: Privacy concerns about collecting sensitive identity documents; storage risk

Method 5: Knowledge-Based Authentication

• Operator uses a series of challenge questions drawn from a third-party database (e.g., TransUnion, Experian, LexisNexis) that only the parent would likely be able to answer
• Questions must be dynamically generated and different for each verification attempt
• Must meet threshold of difficulty that prevents a child from successfully answering
• Limitation: Dependent on third-party data accuracy; may fail for parents with thin credit files

Method 6: Facial Recognition Technology (FTC-Approved Method, 2013)

• Parent submits a photograph that is compared against a previously verified government-issued photo ID
• The photograph and ID image must be deleted promptly after the comparison is complete
• Currently an approved method under the FTC's COPPA Rule but raises significant privacy concerns
• Limitation: Biometric data collection concerns; accuracy disparities across demographics

Method 7: Email Plus (Limited Use)

• Parent receives an email from the operator containing a notice and a link or response mechanism
• The operator sends a confirmatory email to the parent after a reasonable delay
• This method is approved ONLY for internal uses of collected information — NOT when the operator will disclose personal information to third parties or make it publicly available
• Limitation: Lowest assurance; child may access parent's email

Consent Method Selection Matrix

Direct Notice Requirements — Section 312.4

Notice on the Website or Online Service — Section 312.4(b)

The operator must post a clear and prominent link to an online notice of its information practices with respect to children on the home page and each area where personal information is collected from children. The notice must state:

1. Name, physical address, email address, and telephone number of all operators collecting or maintaining personal information through the site/service (or one designated operator with hyperlink to list of all)
2. Description of what information is collected and whether collected actively or passively
3. How the operator uses (and may use) the information
4. Whether personal information is disclosed to third parties; if so, the types of businesses, their general purposes, and whether they have agreed to maintain the confidentiality and security of the information
5. That the parent can review and have deleted the child's personal information, and can refuse to permit further collection
6. Procedures for the parent to exercise rights

Direct Notice to Parent — Section 312.4(c)

Before collecting personal information from a child, the operator must send a direct notice to the parent that includes:

1. Statement that the operator has collected the parent's online contact information for the purpose of obtaining parental consent
2. The information practices of the operator
3. That if the parent does not respond within a reasonable time, the parent's online contact information will be deleted
4. A link to the online notice
5. The means by which the parent can provide consent

FTC Safe Harbor Programs — Section 312.11

Industry groups or other persons may apply to the FTC for approval of self-regulatory guidelines (safe harbor programs) that implement the protections of the COPPA Rule. Operators subject to an approved safe harbor program are deemed to be in compliance with Section 312.