COPPA
15 U.S.C. §§ 6501–6506; 16 C.F.R. Part 312Children's Online Privacy Protection Act
In force since April 21, 2000
Who it applies to
- Operators of websites or online services directed to children under 13
- Operators with actual knowledge that they collect personal information from children under 13
Consumer rights
- Access / know — grantedObtain the personal data held about you, and the categories, sources and purposes behind it.
- Correction — not granted
- Deletion / erasure — grantedRequire deletion of personal data, subject to the statute's retention exceptions.
- Portability — not granted
- Opt out of sale / sharing — not granted
- Opt out of targeted advertising — not granted
- Opt out of profiling — not granted
- Limit sensitive data use — not granted
- Human review of automated decisions — not granted
- Non-discrimination — not granted
- Appeal a refusal — not granted
- Private right of action — not granted
Obligations
- Consent model
- Opt-in
- Universal opt-out signal
- Not required
- Risk assessments
- Not required
- Data protection officer
- Not required
- Records of processing
- Not required
- Processor contract
- Required
- Right to cure
- None — enforcement may follow immediately
- Data broker registration
- Not required
- Minors
- The entire statute is the minors rule: verifiable parental consent before collection, with rights exercised by the parent rather than the child.
Breach notification
- To individuals
- Not addressed by this Act
- To the regulator
- Not required by this law
- What triggers it
- Not addressed by this Act
Penalties
- Headline
- Civil penalties per violation under the FTC Act, adjusted annually for inflation
- Private right of action
- No — enforcement is by the regulator only
- Notes
- Penalties are assessed per child affected, which is how COPPA settlements reach nine figures. State attorneys general may also enforce.
Exemptions
Entities
- Non-profit organisations outside FTC Act jurisdiction
Amendment history
July 1, 2013
Revised COPPA Rule
Expanded personal information to cover persistent identifiers, geolocation, photos, video and audio.
June 23, 2025
2025 COPPA Rule amendments
Added separate verifiable parental consent for third-party disclosure, written retention policies and security-programme requirements.
Sources
- PrimaryRegulation16 C.F.R. Part 312 — COPPA Rule
- OfficialRegulatorFTC — Children's Online Privacy Protection Rule