COPPA, the Children's Online Privacy Protection Act, is the US rule that stops websites, apps and online services from collecting personal information from children under 13 without verifiable parental consent. It covers services aimed at children and general audience services that know they're collecting data from a child under 13.
Most small businesses assume COPPA is a problem for toy companies and kids' game studios. It isn't that narrow. The FTC's own FAQ says a creator who posts child-directed videos on a general audience platform can be treated as an operator if personal information is collected on their behalf, for example a persistent identifier used for targeted advertising. That can bring marketers, course creators and app makers into scope.
Who COPPA applies to
| You run | Does COPPA apply? |
|---|---|
| A site or app directed to children under 13 | Yes, if you collect, use or disclose their personal information |
| A general audience site or app | Only if you have actual knowledge you're collecting data from a child under 13 |
| A mixed audience service (targets kids, but they aren't the main audience) | Yes, but you may age-screen and only treat under 13s as children |
| Child-directed videos on a platform such as YouTube | Yes, if personal information such as an ad identifier is collected on your behalf |
| A service for teenagers | No: the FTC says COPPA doesn't apply to teens, though it's concerned about teen privacy |
The rule is a US law, enforced by the Federal Trade Commission, but it doesn't stop at the border. The FTC says foreign-based websites and online services must comply if they're directed to children in the United States or knowingly collect personal information from children there. Being based in the UK, Canada or Australia doesn't take you out of it.
What counts as personal information
The definition is wider than name and email. The FTC lists items including first and last name, a home address, a telephone number, a photo, video or audio file containing a child's image or voice, geolocation information, and a persistent identifier that can recognise a user over time and across sites, such as a customer number held in a cookie, an IP address or a device ID. The rule also treats passive tracking through a persistent identifier as collection, not just a form the child fills in.
The 2025 changes you need to know
The FTC amended the COPPA Rule in 2025, and its FAQ now opens with a note that the rule was amended on April 22, 2025. The FTC's announcement said businesses would have one year from publication to come into full compliance with amendments that don't specify an earlier date, so that window has now closed. The changes that matter most:
- Separate verifiable parental consent before disclosing a child's personal information to third parties for targeted advertising and other third-party disclosures
- A limit on data retention: keep children's personal information only as long as reasonably necessary for the purpose it was collected, never indefinitely
- Stronger rights for parents, including requiring an operator to delete the personal information collected from their child
On 25 February 2026 the FTC also issued a COPPA policy statement aimed at encouraging the use of age verification technologies. If you run a general audience product with a younger following, that's a signal of where enforcement attention is heading.
How verifiable parental consent works
The FTC lists methods that automatically meet the standard. You can use any of them, or other methods that are reasonably calculated to make sure the person consenting is the parent:
- A signed consent form returned by post, fax or electronic scan
- A credit card, debit card or online payment system used in a monetary transaction that notifies the account holder
- A call to a toll-free number or a video call with trained staff
- Checking government-issued ID against databases, then promptly deleting the parent's ID
- Knowledge-based challenge questions approved by the Commission
- Email plus, but only if you use the data internally and never disclose it or make it public
Penalties
As of October 2026, the FTC's FAQ says a court can hold operators liable for civil penalties of up to $53,088 per violation. The amount depends on factors including how serious the violations were, whether it's a repeat, how many children were involved and what information was collected. The FTC notes some cases ended with no civil penalty and others reached millions of dollars.
A quick COPPA checklist for small businesses
- Decide honestly whether your content, characters, music or ads are aimed at under 13s.
- If you're general audience, use a neutral age screen (for example, free entry of month and year of birth that doesn't default to 13 or over); the FTC says you may then rely on the age users enter.
- Don't run targeted ads or third-party tracking on child-directed pages without separate parental consent.
- Write a children's privacy notice that's clear, complete and free of unrelated material, and link it from any children's area.
- Set a retention period and delete children's data when the purpose ends.
If you're building a kids' audience on social platforms, start with the platforms' own age rules: my guides on how old you have to be to have YouTube and the Instagram age limit cover them. For your own site, whether a small business website needs a privacy policy is the place to start.
My verdict
If your audience is adults, COPPA mostly asks you to avoid knowingly collecting data from under 13s and to act when you find out. If any part of your content is aimed at children, treat COPPA as a design decision, not a policy page: switch off third-party ad tracking on that content, collect as little as possible, and get consent the FTC's way before you collect anything else.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
California adds its own rules on top for teenagers and for selling data, and our CCPA guide sets those out.
Frequently asked questions
What does COPPA stand for?
COPPA stands for the Children's Online Privacy Protection Act. The FTC enforces it through the Children's Online Privacy Protection Rule.
What age does COPPA cover?
COPPA protects children under 13. The FTC says COPPA doesn't apply to teenagers.
Does COPPA apply to general audience websites?
Only where the operator has actual knowledge that it's collecting personal information from a child under 13, according to the FTC.
Does COPPA apply to YouTube creators?
The FTC says that if content you post on a general audience platform is directed to kids and personal information is collected by you or on your behalf, such as a persistent identifier used to serve targeted ads, you're an operator who needs to comply.
What is the penalty for violating COPPA?
The FTC's FAQ says a court can impose civil penalties of up to $53,088 per violation, depending on factors such as the number of children involved and the information collected.
What changed in the 2025 COPPA amendments?
The FTC's final rule requires separate verifiable parental consent to disclose children's personal information to third parties for targeted advertising, limits data retention to what's reasonably necessary, and strengthens parents' deletion rights.
Is an IP address personal information under COPPA?
Yes. The FTC lists persistent identifiers such as a customer number held in a cookie, an IP address or a device ID as personal information.
