What Is the Children’s Online Privacy Protection Act?

Everyone · Explainer · Updated October 1, 2026 · LearnLife Editorial

What is the Children’s Online Privacy Protection Act (COPPA)?

COPPA is a federal law created to safeguard the online privacy of children younger than 13 years old. It requires websites, apps, and online services that collect personal information from children to follow specific rules designed to protect that information. These rules mandate that companies clearly disclose what data they collect, how they use it, and who they share it with. Most importantly, companies must obtain verifiable parental consent before gathering any personal details from children.

“Personal information” under COPPA is broader than just name and email. It includes full names, home or email addresses, phone numbers, photos, videos, geolocation data, and even persistent identifiers such as device IDs or cookies. For example, if a child uses an app to play games and the app wants to collect the child’s name and location to personalize content or ads, COPPA requires the app to get the parent’s permission first.

COPPA applies to any operator of a website or online service that either targets children under 13 or knowingly collects information from them. This means even general websites that realize children under 13 use their services must comply. Understanding COPPA helps adults recognize the protections in place for children’s online privacy and the legal responsibilities companies have.

How does COPPA work in practice?

COPPA requires websites or apps to obtain verifiable parental consent before collecting personal information from children under 13. This means a parent or guardian must actively approve data collection in a way that confirms their identity and intent. Common methods to verify consent include:

• Sending an email to the parent with a consent form to complete
• Having parents call a toll-free number or video call to confirm permission
• Using a credit card or other payment system for verification
• Requiring parents to sign and return a permission form by mail or fax

For example, imagine a child wants to join an online club that offers story readings and interactive games. When the child tries to create an account, the site asks for their name and email. Instead of immediately collecting this data, the site emails the parent a consent form with a clear privacy policy explaining what information will be collected and why. Only after the parent clicks a link or signs the form does the site allow the child to provide personal data and access the club.

Beyond consent, COPPA requires companies to post a clear, easy-to-understand privacy policy explaining:

• What personal information is collected
• How it will be used
• Whether it will be shared with third parties
• How parents can review or delete their child’s information

Parents can also revoke consent at any time and request the deletion of their child’s data, which companies must honor promptly.

Why does COPPA matter for parents and guardians?

COPPA gives parents control and awareness over their children’s online information, helping prevent risks like identity theft, unwanted marketing, or exposure to inappropriate content. Children often don’t know the consequences of sharing personal details online. COPPA ensures that parents must approve before that information is collected, helping protect children from online dangers.

For parents, COPPA means:

• Knowing which online services collect data and why
• Controlling when and how children’s personal data is shared
• Preventing children from being targeted by ads based on their profiles without parental consent

For example, if a child’s favorite game tries to collect their location or email to send marketing messages, COPPA ensures parents are informed first and can say no. Parents can then explain why sharing such information without permission is risky, helping build healthy online habits.

You can support these conversations by teaching kids about online privacy and safety, using resources like Teaching kids about online privacy and safety. This builds understanding beyond just legal protections.

What terms are often confused with COPPA?

Several privacy-related terms can be mixed up with COPPA or misunderstood:

• General Data Protection Regulation (GDPR): A European privacy law covering all citizens, including children, with rules different from COPPA. GDPR applies globally but focuses on broader data privacy beyond just children.
• Children’s data privacy laws: COPPA is one of several laws protecting children’s privacy. Some states or countries have additional rules.
• Privacy policy: A document explaining how a website or app collects and uses personal information. COPPA specifically requires clear policies for children’s data.
• Parental controls: Settings that help parents manage children’s device or app use but do not replace legal requirements like COPPA.
• Online safety: A broader idea including avoiding cyberbullying and harmful content. COPPA focuses specifically on data privacy rules.

Understanding these distinctions helps parents and guardians distinguish legal protections from tools or general safety advice. For more on the broader online privacy landscape, see Online Privacy Laws in the US.

What happens if a website or app breaks COPPA rules?

The Federal Trade Commission enforces COPPA. If a company violates the law—for example, by collecting children’s personal information without parental consent—the FTC can investigate and impose penalties. These penalties can include fines and orders to change the company’s practices.

Parents and guardians can report violations to the FTC at ReportFraud.ftc.gov. For instance, if an app is collecting children’s emails without asking parents first, you can file a complaint. This helps protect other children and encourages companies to improve privacy practices.

Warning signs of non-compliance include:

• No clear privacy policy or one that is confusing
• Collecting personal information immediately, without asking for parental consent
• Asking for unnecessary data like a child’s full home address or phone number

If you suspect a violation, reporting it is an important step to protect children’s privacy.

What practical steps can parents and educators take to protect children’s online privacy?

Besides understanding COPPA, parents and educators can adopt concrete steps to protect children’s privacy:

1. Review Privacy Policies: Before letting children use a website or app, read its privacy policy for clear information about data collection and parental consent.
2. Confirm Parental Consent Processes: Ensure the site uses reliable methods to get permission before collecting data.
3. Teach Children What to Say: Help kids use phrases like, “I need to ask my parent before sharing that,” or “I don’t share my full name or address online.”
4. Use Parental Controls: Enable device or app controls to limit which apps children can download or use, and to restrict data sharing.
5. Create Family Email Accounts: Use an email address parents control when signing children up, making it easier to manage permissions and communications.
6. Report Suspicious Practices: If you notice a site collecting data without consent, report it to the FTC or consumer protection organizations.
7. Discuss Privacy Regularly: Make conversations about data privacy part of family or classroom routines to build habits and awareness.

For more detailed guidance, parents can explore resources like Online privacy information for parents and Data privacy for kids.

How does COPPA fit into the broader landscape of online privacy laws?

COPPA is one of several U.S. laws focused on protecting personal data. Other important laws include:

• FERPA: Protects student education records.
• HIPAA: Protects medical and health information.
• State Privacy Laws: Some states have privacy laws that include extra protections for children beyond COPPA.

COPPA specifically targets children’s online data and parental consent, serving as a foundation for protecting children in digital spaces. It works alongside other laws to create a safer internet environment for all users.

For families, understanding COPPA and related laws helps build a comprehensive approach to privacy and safety. More information can be found in articles like Understanding Online Privacy Rules and Child data privacy laws.

Frequently asked questions

Can children under 13 legally use popular social media apps?

Most social media platforms require users to be at least 13 due to COPPA restrictions and company policies. Children under 13 should not create accounts without parental permission or supervision.

Does COPPA require companies to delete children’s personal information if parents ask?

Yes. Parents have the right to review and request deletion of their child’s data collected by a company, and companies must comply promptly.

How can parents check if a website or app follows COPPA?

Look for a clear privacy policy that mentions children’s data, check if parental consent is requested before data collection, and ask the company questions if unsure. You can also report concerns to the FTC.

Are parental controls enough to protect children’s online privacy?

Parental controls help manage access and usage but do not replace legal protections like COPPA. Both work together to keep children safe online.

Does COPPA apply to educational websites and apps?

Some educational platforms may be exempt if they only collect data necessary for educational purposes and do not use it for marketing. Parents should carefully review privacy policies for each service.