COPPA
By Gareth HoyleLast updated How we research
COPPA is the Children's Online Privacy Protection Act, which requires verifiable parental consent before online services collect or disclose data from children under 13.
COPPA is the Children's Online Privacy Protection Act of 1998, 15 USC 6501 to 6505, enforced by the FTC through the COPPA Rule at 16 CFR Part 312. It covers operators of websites and online services directed to children under 13, and operators with actual knowledge that they collect personal information from a child under 13.
What changed in 2025?
The FTC finalized amendments in January 2025, published on April 22, 2025 and effective June 23, 2025, with most compliance required by April 22, 2026. Operators now need separate verifiable parental consent to disclose a child's personal information to third parties unless the disclosure is integral to the service. In its commentary, the FTC said disclosures to train or otherwise develop AI technologies are not integral and would require consent.
What does COPPA mean for a data seller?
COPPA means children's data from an app, game or learning service is almost never licensable for AI training without fresh parental consent. Sellers usually exclude it entirely and confirm the exclusion in the data manifest.
UK GDPR and EU GDPR set no single age threshold for every purpose, and the UK's Age Appropriate Design Code adds design standards for children's services.