COPPA

Who it applies to

Operators of websites and online services directed to children under 13, and general-audience operators with actual knowledge they collect personal information from children under 13.

Key requirements

• Post a clear privacy policy describing practices for children's data.
• Give direct notice to parents and obtain verifiable parental consent before collecting personal information from children.
• Let parents review and delete their child's information and withdraw consent.
• Keep children's information secure and retain it only as long as necessary.
• Do not condition a child's participation on collecting more information than reasonably necessary.

Breach and incident notification

COPPA has no specific breach notification deadline; state breach notification laws still apply.

Penalties

Civil penalties per violation, adjusted annually for inflation, enforced by the FTC and state attorneys general.

Go deeper