The Children's Online Privacy Protection Act of 1998 (COPPA) is a United States federal law. The act, effective April 21, 2000, applies to the online collection of personal information by persons or entities under U.S. jurisdiction about children under 13 years of age, including children outside the U.S. if the website or service is U.S.-based. It details what a website operator must include in a privacy policy, when and how to seek verifiable consent from a parent or guardian, and what responsibilities an operator has to protect children's privacy and safety online, including restrictions on the marketing of those under 13.
Although children under 13 can legally give out personal information with their parents' permission, many websites, particularly social media sites, but also other sites that collect most personal info, disallow children under 13 from using their services altogether due to the cost and work involved in complying with the law.
Contents
Background
In the 1990s, electronic commerce was on its rise of popularity, but various concerns were expressed about the data collection practices and the impact of Internet commerce on user privacy—especially for children under 13, because very few websites had their own privacy policies. The Center for Media Education petitioned the Federal Trade Commission (FTC) to investigate the data collection and use practices of the KidsCom website, and take legal action since the data practices violated Section 5 of FTC Act concerning "unfair/deceptive practices." With the passing of the Drivers Privacy Protection Act in 1997, new precedents had been set in regard to the ability of congress to regulate information held by state agencies. After the FTC completed its investigation, it issued the "KidsCom Letter". The report stated that the data collection and use practices were indeed subject to legal action. This resulted in the need to inform parents about the risks of children's online privacy, as well as to parental consent necessity. This ultimately resulted in the drafting of COPPA.
COPPA was passed in 1998 and took effect reportedly in April 2000. The rule was issued by the Federal Trade Commission, and it is updated quite frequently to stay up to date with new technological advancements. The Federal Trade Commission (FTC) is an agency that works to protect people from illegal practices, scammers, create protection rules, and ensure they are helping people protect their data and information. COPPA was necessary because it has been reported that 89% of children's websites were taking personal information, and many of those websites were not giving privacy notices. Parents were not very involved with their children's website uses or made aware of the dangers of their children's private information being taken without knowledge.
The new millennium ushered in an era of regulation that many were simply unaware of. The early years of the transition were fraught with confusion and a lot of animosity. One of the main concerns of the time was the eventual accessibility of child-based websites at the fear many were unwilling to change their business practices. Many were left with a series of loose guidelines that determined what was correct. The simplification of COPPA provided by the FTC was met with a follow-up of demands to law enforcement that the: "... Commission should continue law enforcement efforts by targeting significant violations and seeking increasingly larger civil penalties, when appropriate, to deter unlawful conduct". A mandatory review of the COPPA regulations were conducted in 2005 (resulting with no changes to the original guidelines), found that there were no adverse effects to the online landscape.
The Federal Trade Commission (FTC) has the authority to issue regulations and enforce COPPA. Also, under the terms of COPPA, the FTC-designated "safe harbor" provisioning is designed to encourage increased industrial self-regulation. Under this provision, industry groups and others may request Commission approval of self-regulatory guidelines to govern participants' compliance, such that website operators in Commission-approved programs would first be subject to the disciplinary procedures of the safe harbor program in lieu of FTC enforcement. As of June 2016, the FTC has approved seven safe harbor programs operated by TrustArc, ESRB, CARU, PRIVO, Aristotle, Inc., Samet Privacy (kidSAFE), and the Internet Keep Safe Coalition (iKeepSafe). In August 2021, Aristotle, Inc. withdrew from the safe harbor program after FTC staff expressed serious concerns about its enforcement of its safe harbor provisions and communicated their intent to recommend the revocation of Aristotle's approval to run a safe harbor program. The FTC also announced its intention to more closely scrutinize the practices of the other six present safe harbors.
In September 2011, the FTC announced proposed revisions to the COPPA rules, the first significant changes to the act since the issuance of the rules in 2000. The proposed rule changes expanded the definition of what it meant to "collect" data from children. The proposed rules presented a data retention and deletion requirement, which mandated that data obtained from children be retained only for the amount of time necessary to achieve the purpose that it was collected for. It also added the requirement that operators ensure that any third parties to whom a child's information is disclosed have reasonable procedures in place to protect the information.
In 2013, the COPPA rules were updated due to the increase in children's use of the internet and mobile devices. The 2013 revision expanded the types of online services and categories of personal information covered by the rules, and reinforced that verifiable parental consent was required for collecting personal information on child-directed platforms. The FTC reviews rules and regulations every ten years, but due to the constant evolution of technology, it opened for review again in 2019.
The act applies to websites and online services operated for commercial purposes that are either directed toward children under 13 or have actual knowledge that children under 13 are providing information online. Most recognized non-profit organizations are exempt from most of the requirements of COPPA. However, the Supreme Court ruled that non-profits operated for the benefit of their members' commercial activities are subject to FTC regulation and consequently COPPA as well. The type of "verifiable parental consent" that is required before collecting and using information provided by children under 13 is based upon a "sliding scale" set forth in a Federal Trade Commission regulation that takes into account the manner in which the information is being collected and the uses to which the information will be put.
With technological advancements, children have become more accustomed to using online services in their everyday lives. Though COPPA tries to keep children's personal information and data safe, enforcement remains inconsistent. There are many apps and websites that are accessible by children that do not comply with COPPA rules. Furthermore, even if those apps do have terms and conditions that correlate with COPPA rules, many times the terms are vast and not legible by the children. Many privacy policies do not disclose the extent of information they are sharing to a third party. Many times developers are unaware of the target audience their app or website will reach, making it more difficult to incorporate COPPA rules to protect children. This can expose children to privacy risk and lead to leaking sensitive information. Studies have shown that data taken from children has been provided to third-party advertising, which leads to promoting content that leads to impulse spending or promoting unhealthy products.
COPPA 2.0 was introduced to expand the age range covered by COPPA to minors under 17. It was introduced in the Senate alongside the Kids Online Safety Act (KOSA). Both KOSA and COPPA 2.0 passed the Senate on a 91–3 vote on July 30, 2024. COPPA 2.0 would have required youth aged 13, 14, 15 or 16 to consent to the processing of their own data, but would not have required the parents of 13-16 year olds to consent to the data processing. COPPA 2.0, as well as KOSA, had not passed the House when the 118th US Congress expired on January 3, 2025. It was reintroduced in the Senate and passed unanimously in March 2026.
Violations
According to the FTC, courts may fine violators of COPPA up to $53,088 in civil penalties for each violation. The FTC has brought a number of actions against website operators for failing to comply with COPPA requirements, including actions against Google, TikTok, miHoYo, Girls' Life, American Pop Corn Company, Lisa Frank, Inc., Mrs. Fields Cookies, and The Hershey Company.
In February 2004, UMG Recordings, Inc. was fined US$400,000 for COPPA violations in connection with a website that promoted the then 13-year-old rapper Lil' Romeo and hosted child-oriented games and activities, and Bonzi Software, which offered downloads of an animated figure "BonziBuddy" that provided shopping advice, jokes, and trivia was fined $75,000 for COPPA violations. Similarly, the owners of the Xanga website were fined US$1,000,000 in 2006 for COPPA violations of repeatedly allowing children under 13 to sign up for the service without getting their parent's consent.
In 2016, the mobile advertising network inMobi was fined US$950,000 for tracking the geo-location of all users (including those under 12) without their knowledge. The advertising software continuously tracked user location despite privacy preferences on the mobile device. Other websites that were directed towards children and fined due to COPPA include Imbee (2008), Kidswirl (2011) and Skid-e-Kids (2011).
In February 2019, the FTC issued a fine of $5.7 million to ByteDance for failing to comply with COPPA with their TikTok app (then called Musical.ly). ByteDance agreed to pay the largest COPPA fine since the bill's enactment and to add a kids-only mode to the TikTok app.
Three dating apps by Wildec were pulled by Apple and Google from their respective app stores, after the FTC determined that the dating apps allowed users under 13 to register, that Wildec knew there were significant numbers of minor users, and that this allowed inappropriate contact with minors.
On September 4, 2019, the FTC issued a fine of $170 million to YouTube for COPPA violations, including tracking the viewing history of minors in order to facilitate targeted advertising. Many notable social media platforms were subjected to scrutiny from the FTC, especially groups like Facebook where the platform had users ignoring COPPA guidelines since inception. As a result, YouTube announced that as part of the settlement, in 2020 it would require channel operators to mark videos that are "child-oriented" as such, and would use machine learning to automatically mark those as clearly "child-oriented" if not marked already. In the settlement terms, channel operators that failed to mark videos as "child-oriented" could be fined by the FTC for up to $42,530 per video, which has raised criticism towards the settlement terms. The decision came in terms that, despite good faith, created many issues among the content creators on the site. Users such as Ryan's World, Philip DeFranco and TheOdd1sOut with vastly different content found themselves in conflict for their appealing content for children. The following guidelines were implemented on the basis set by the following rules:
Compliance
In December 2012, the Federal Trade Commission issued revisions effective July 1, 2013, which created additional parental notice and consent requirements, amended definitions, and added other obligations for organizations that (1) operate a website or online service that is "directed to children" under 12 and that collects "personal information" from users or (2) knowingly collects personal information from people under 13 through a website or online service. After July 1, 2013, operators must:
Post a clear and comprehensive online privacy policy describing their information practices for personal information collected online from persons under age 13;
Make reasonable efforts (taking into account available technology) to provide direct notice to parents of the operator's practices with regard to the collection, use, or disclosure of personal information from persons under 13, including notice of any material change to such practices to which the parents have previously consented;
Obtain verifiable parental consent, with limited exceptions, prior to any collection, use, and/or disclosure of personal information from persons under age 13;
Provide a reasonable means for a parent to review the personal information collected from their child and to refuse to permit its further use or maintenance;
Establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of the personal information collected from children under age 13, including by taking reasonable steps to disclose/release such personal information only to parties capable of maintaining its confidentiality and security;
Retain personal information collected online from a child for only as long as is necessary to fulfill the purpose for which it was collected and delete the information using reasonable measures to protect against its unauthorized access or use; and
Operators are prohibited from conditioning a child's participation in an online activity on the child providing more information than is reasonably necessary to participate in that activity.
International scope
The FTC has asserted that COPPA applies to any online service that is directed to U.S. users or knowingly collects information from children in the U.S., regardless of its country of origin. Referring to their official website, the following embodies such views:
The FTC's Office of International Affairs directs the agency's international activities for competition and consumer protection, which include:
strengthening relationships with foreign competition and consumer protection agencies
developing formal and informal arrangements and agreements with competition and consumer protection agencies around the world
engaging in cooperative dialogues and submitting reports at international forums for competition and consumer protection
helping agencies around the world develop and enhance their own competition and consumer protection programs
sharing information with foreign law enforcement authorities through the U.S. Safe Web Act
maintaining a robust International Fellows Program
However, the FTC rarely performs enforcement actions against foreign companies, and faces a number of practical challenges in doing so. The general assumption is that, despite the interconnected world of internet services, jurisdiction only applies to domestic operation. Nevertheless, it has successfully enforced COPPA against at least one foreign company with a significant US userbase, securing a $5.7 million settlement against the Chinese company ByteDance over their TikTok app.
Criticisms
COPPA is controversial and has been criticized as ineffective and potentially unconstitutional by legal experts and mass media since it was drafted. Complaints leveled against the legislation include website owners banning users 12 and under—which only "encourages age fraud and allows websites to bypass the burden of obtaining parental consent"—and the active suppression of children's rights to freedom of speech, self-expression, and other First Amendment rights due to necessity of registering accounts to do so.
Delays in obtaining parental consent often result in children moving on to other activities that are less appropriate for their age or pose bigger privacy risks.
In addition, age restrictions and the "parental consent" process are easy for children to circumvent, and parents generally help them to lie about their age.
An Internet Safety Technical Task Force composed of experts from academia and commercial companies found in 2012 that mandatory age verification is not only a poor solution for privacy but also constitutes a violation of privacy. The law has also many safety flaws. For example, it does not protect kids from predatory advertising, it does not prevent kids from accessing pornography or lying about their age, and it does not ensure a totally safe environment online. Tech journalist Larry Magid, a long-time vocal opponent of the law, also notes that parents, not the government, hold the bulk of responsibility of protecting children online. COPPA has also been criticized for its potential chilling effect on children's apps, content, websites and online services. For example, Snapchat released a Snapkidz version of its app in June 2013, but unlike Snapchat, Snapkidz did not allow photo sharing at all due to COPPA regulations. Similarly, it has been pointed out that the COPPA Rule was not necessarily about privacy protection but more about "enforcing the laws."
COPPA's penalties ($40,000 per violation) can be potentially catastrophic for small businesses, undermining their business model. By contrast, the FTC has been criticized, including by COPPA author Ed Markey, and FTC commissioner Rohit Chopra, for not fining major and big tech companies harshly enough for their COPPA violations, especially in comparison to their revenue. In contrast, violators of the European Union's General Data Protection Regulation (GDPR) may be fined up to 4% of their annual global revenue.
Effects in the mobile app and ad-tech ecosystem
While the internet continues to advance, children are now moving their attention of internet use from webpages to apps where applying COPPA rules is more complex to address. These advancements make it more difficult to keep up with the new kinds of risks that the original notice and rules do not comply with. Scholars have argued that the COPPA consent framework struggles to stay relevant with new features such as the third-party advertising, persistent identifiers, and real-time behavioral tracking that operate in ways that children along with parents are unaware of. Sandoval (2024) states that even if companies were able to follow direct COPPA rules, there is still a risk of being tracked due to lack of laws to fully protect individuals. Mobile apps such as app stores and networks are constantly collecting background data making individuals still vulnerable.
SDKs, also known as software development kits, are tools that developers use to build applications. Many child-directed mobile apps use SDKs along with other third-party trackers that create data collection pathways that users are unaware of. Researchers have states that these tracking tools transmit persistent identifiers, which are digital markers that track a device or user through time. Furthermore, they also track interaction patterns and device information, creating a behavioral profile regardless of COPPA regulations. Research has found that there are blind sports in child-directed apps that track their information that is not disclosed of. Other researchers have explained that because many child-directed apps profit off advertisement, they are more inclined and focused on collecting data for profit than children's privacy.
Age verification is important in protecting children online but it remains a challenge in the mobile environment. Apps tailored for children are simple to ensure that they have simple and fast access to play or stream as they please. The minimal standard for setup is simply entering an age, but this system is easy to bypass because children are able to enter an age much older than their age recorded at birth. Since children tend to use technology that is shared within the household, it makes it more difficult for apps to determine the age of the user. Policies that also allow for age verification tend to be an inconvenience for users because they require addition steps such as email confirmation or credit card validation. With COPPA's regulations it has been argued that the cutoff age of 13 does not regulate children's interaction with digital platforms.