Examples of COPPA in Action

Everyone · Explainer · Updated October 1, 2026 · LearnLife Editorial

What is COPPA in plain words?

COPPA is a federal law created to protect children’s privacy when they use the internet. It applies to children under 13 years old and requires websites, apps, and online services aimed at kids or knowingly collecting kids’ personal data to get parental consent before collecting, using, or sharing that data. The law defines personal information broadly; it includes a child’s name, address, email, phone number, photos, videos, location data, and even device identifiers like IP addresses.

For example, if a website offers games or videos specifically for children, it must comply with COPPA by informing parents about the type of data collected and obtaining permission before gathering any personal details. This law helps parents control their children’s online information and limits what companies can collect or share. Websites not targeted at children or not knowingly collecting kids’ data usually do not fall under COPPA, but operators should carefully evaluate their audience and data practices.

How does COPPA work in practice? A detailed, hypothetical example

Imagine an app designed for children ages 6 to 10 that allows kids to create avatars and play educational puzzles. When a child opens the app, it asks for a first name and email address to save progress and send notifications. Because the app collects personal information from children under 13, COPPA requires that the company obtains verifiable parental consent before collecting this data.

Here’s how that might look step-by-step:

1. Provide Clear Notice: The app shows a pop-up with a simple message like, “This app collects your child’s name and email address to save progress. We need your permission to collect this information.” It links to a full privacy policy written in plain language.
2. Obtain Verifiable Parental Consent: The app might send an email to the parent asking for permission. The email includes a consent form stating: “By signing this form, you agree to allow us to collect and use your child’s information as described.” The parent can reply with “I consent” or sign electronically.
3. Collect Information After Consent: Only after the parent provides consent does the app allow the child to enter their name and email.
4. Allow Parental Access and Control: The app provides a parent portal or contact email where parents can review the child’s information, request changes, or ask for deletion. For example, a parent might email “Please delete my child’s profile” and the company must comply promptly.
5. Limit Data Use and Sharing: The app uses the data only to personalize the game and send progress updates. It does not share or sell the child’s information to advertisers.

If parental consent is not obtained, the app should allow children to use the app without entering personal information, such as playing as a guest. This example shows the process of giving parents control over their child’s data while still letting children enjoy the app safely.

Why does COPPA matter for families and online users?

COPPA matters because children are less able to understand the risks of sharing personal information online. Without protections, their data can be collected and misused, potentially exposing them to marketing, identity theft, or harmful contact. For parents, COPPA provides tools to control what information companies can collect about their children and how it is shared or used.

For educators, caregivers, and families, understanding COPPA helps guide the choice of safe digital tools for children. For example, schools selecting online learning platforms should check if those platforms have clear COPPA compliance policies to protect student privacy. For companies, following COPPA avoids legal troubles and builds trust with parents, who want assurance their children’s data is handled responsibly.

COPPA also promotes transparency by requiring clear disclosures about data collection and use. Knowing what data is collected and why helps parents make informed decisions about their children’s online experiences. It encourages companies to collect only what is necessary, reducing unnecessary risks.

What terms do people confuse with COPPA, and how are they different?

Some terms often confused with COPPA include:

• GDPR (General Data Protection Regulation): A European law protecting the personal data of individuals of all ages, including children, with different consent rules. It applies internationally for EU residents but is separate from COPPA.
• FERPA (Family Educational Rights and Privacy Act): A U.S. law protecting the privacy of student educational records in schools. It does not regulate general online data collection or marketing.
• Privacy Policy: A document explaining how a website or app collects and uses data. COPPA requires child-directed sites to have a clear privacy policy, but privacy policies themselves are not laws.
• Terms of Service: Rules users agree to when using a website or app, which may mention privacy but focus on usage rights rather than data collection protections.
• Children’s Online Privacy: A broad concept about protecting kids' data online, including COPPA as a key law but also encompassing other regulations and best practices.

Knowing these distinctions helps clarify that COPPA specifically governs how children’s personal information is collected and used in the U.S.

What are concrete examples of COPPA compliance?

Websites and apps comply with COPPA by implementing several clear practices:

• Clear Privacy Policies: For example, a children’s video streaming site states, “We do not collect personal information from children under 13 without parental consent.” This policy is easy to find and written in plain language.
• Verifiable Parental Consent: A kids’ educational website sends an email form to parents that must be signed and returned before account creation.
• Minimal Data Collection: An app for kids’ drawing only asks for a nickname and does not require email or location.
• Parental Rights: Allowing parents to access, correct, or delete their child’s information via a “Parent Support” page or contact email.
• Data Security: Using secure servers and encryption to protect collected data from unauthorized access.

For example, a children’s book club website might ask parents to fill out a consent form before allowing their child to sign up and receive newsletters. It includes a clear privacy policy and offers a “Contact Us” link for parents to request changes or deletion of data.

What are the consequences of COPPA violations?

Violating COPPA can lead to enforcement actions by the Federal Trade Commission. Consequences may include:

• Monetary penalties: The FTC can impose fines for each violation, with amounts determined case-by-case.
• Corrective actions: Companies may be required to change how they collect and use children’s data, improve consent processes, or delete improperly collected information.
• Reputational harm: Public enforcement actions can damage a company’s credibility and reduce user trust.

For example, if a social media app collects location data from children under 13 without parental consent and shares it with advertisers, the FTC might investigate and require the company to fix its practices and notify affected users. Parents can report suspected violations directly to the FTC through their complaint process.

What should parents and website owners do next about COPPA?

If you are a parent:

• Review the privacy policies of websites and apps your child uses. Look for clear statements about COPPA compliance and data collection practices.
• Ask whether the site obtains parental consent before collecting your child’s personal information.
• Use device or app parental controls to manage what your child can access or share.
• Teach your child not to share personal details online without your permission.
• Report any suspected COPPA violations to the FTC through their official complaint form.

If you operate a website or app that may collect data from children under 13:

1. Assess whether your service is directed at children or knowingly collects children’s data.
2. Publish a clear, easy-to-understand privacy policy describing what data you collect and how it is used.
3. Implement verifiable parental consent mechanisms before collecting any personal information.
4. Limit data collection to what is necessary for your service.
5. Provide parents with easy ways to review, correct, or delete their child’s data.
6. Use reasonable security measures to protect collected data.
7. Keep records of consent and data handling in case of audits or investigations.

If uncertain about compliance, seek legal advice or consult FTC guidance. The FTC offers detailed resources and sample consent forms to assist website owners.

Frequently asked questions

Can a website collect data from children under 13 without parental consent if it only collects anonymous data?

No, COPPA covers any personal information that can identify a child, including persistent identifiers like device IDs or IP addresses, even if the data appears anonymous.

What should a parent do if their child’s information was collected without consent?

Parents can contact the website or app to request deletion of the child’s data and report the issue to the FTC for investigation.

Does COPPA apply to children outside the U.S.?

COPPA applies to websites and services targeting or collecting data from children under 13 in the U.S., regardless of where the company is located. Other countries may have different laws.

How can a company verify parental consent?

Methods include sending a consent form by email, requiring a signed form, using a credit card or phone call verification, or other reasonable steps that ensure the person giving consent is a parent.

What happens if a website changes its audience and starts targeting children?

The website must review its data collection practices and comply with COPPA, including obtaining parental consent, updating privacy policies, and adjusting how data is handled.

Can parents review and delete their child's data?

Yes, COPPA requires that parents have the right to review the personal information collected, withdraw consent, and request deletion of their child’s data at any time.