United StatesChildren's Online Privacy Protection Act (COPPA)
15 U.S.C. §§ 6501-6506; 16 C.F.R. Part 312
In force since .
A social media and minors rule binding private bodies.
- Audit expectation
- none
What it requires
- Applies to operators of websites and online services directed to children under 13, and to operators with actual knowledge that they collect data from a child under 13.
- Provide notice before collecting a child's personal information.NIST Privacy FrameworkCM.AW-P1
- Obtain verifiable parental consent before collecting a child's personal information.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text. Also read by: Federal Trade Commission (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalties
Civil penalties per violation, adjusted periodically for inflation, enforced by the FTC and state attorneys general.
Who enforces it
Enforcement body
Federal Trade Commission and state attorneys general
Settledness
The FTC FAQ page states that the Rule was amended on and directs readers to the revised Rule for current requirements.
- As of
- Guidance link
- https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions
- Guidance body
- Federal Trade Commission
- Open questions
- Does a general audience operator, which has no duty under the Rule to investigate the ages of its visitors, have 'actual knowledge' under 16 C.F.R. § 312.2 that a user is under 13 when its own systems infer that age from behavioral or profile data?
What it reaches
Age threshold
13
Covered services
Websites and online services directed to children under 13, and general audience services with actual knowledge of child users.
Verification methods
Parental consent
What it makes you log
Logging duty
The FTC statute page this row cites summarizes the duties the Act directs the Commission's rules to impose: parental notice, verifiable parental consent, parental control and access, data minimization and reasonable security procedures. It names no record, log or retention limit. The Rule's own written security program, written data retention policy and deletion of consent-verification identification are coded on the Amended COPPA Rule (2025) row.
- Kind
- None
- As of
What this law does
Requires operators of websites and online services directed to children under 13, or that have actual knowledge they collect data from a child under 13, to provide notice and obtain verifiable parental consent before collecting personal information.
How courts have read itPremium data
Our analysis of this law draws on 2 court rulings.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .