What is COPPA (Children's Online Privacy Protection Act)?
COPPA is a US federal law that requires websites and online services directed at children under 13 to obtain verifiable parental consent before collecting personal information from children.
The Children's Online Privacy Protection Act (COPPA) is a US federal law enacted in 1998 and enforced by the Federal Trade Commission (FTC). It applies to operators of commercial websites and online services (including mobile apps) that are directed to children under 13, or that have actual knowledge that they are collecting personal information from children under 13. COPPA was updated in 2013 to address evolving online technologies including social networking, mobile apps, and behavioral advertising.
COPPA requires covered operators to post a clear and comprehensive privacy policy describing their information practices for children's data, provide notice to parents and obtain verifiable parental consent before collecting personal information from children, give parents the choice of consenting to collection and use without consenting to disclosure to third parties, provide parents access to their child's personal information, and maintain the confidentiality and security of collected information. Personal information under COPPA includes name, address, email, phone number, Social Security number, geolocation information, photos, videos, audio files, and persistent identifiers used for behavioral advertising.
The FTC enforces COPPA through administrative and civil actions, with penalties of up to $50,120 per violation (adjusted for inflation). Organizations serving younger audiences should use ConsentIQ to implement compliant parental consent mechanisms and DiscoverIQ to identify where children's personal information is collected and stored.
How IQWorks Helps
Related Terms
Consent Management
Consent management is the systematic process of obtaining, recording, tracking, and managing individuals' consent for the collection and processing of their personal data in compliance with privacy regulations.
Personally Identifiable Information (PII)
PII is any information that can be used to identify a specific individual, including names, addresses, email addresses, phone numbers, Social Security numbers, and biometric data.
Privacy Notice / Privacy Policy
A privacy notice is a public-facing document that informs individuals about how an organization collects, uses, stores, shares, and protects their personal data, as required by data protection regulations.
Supervisory Authority
A supervisory authority is an independent public body established by a country to monitor and enforce compliance with data protection laws, such as the ICO in the UK or the CNIL in France.