United StatesChildren's Online Privacy Protection Rule (COPPA), including 2025 biometric identifier amendments
16 CFR Part 312, as amended effective
In force since .
A data subject rights rule binding private bodies.
- Excludes recording-derived identifiers
- No
- Obligation class
- Consent, Age verification, Disclosure, Retention
- Audit expectation
- none
What it requires
- Obtain verifiable parental consent before collecting, using, or disclosing a child's personal information, including biometric identifiers such as voiceprints or facial templates.NIST Privacy FrameworkCT.PO-P1
- Give parents a way to review and delete a child's collected personal information.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text. Also read by: Federal Trade Commission (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
16 CFR 312.9 deems a violation of a regulation issued under COPPA Section 6502(a) to be a violation of a rule defining an unfair or deceptive act or practice under section 18(a)(1)(B) of the FTC Act (15 U.S.C. 57a(a)(1)(B)), which draws the same civil penalty as any other FTC trade-regulation rule violation under 15 U.S.C. 45(m)(1)(A): a nominal $10,000 per violation, adjusted for inflation to $53,088 per violation (2025 figure) by 16 CFR 1.98. A State attorney general may also sue as parens patriae under 15 U.S.C. 6504, but that is not a right of action for an individual private plaintiff.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 53,088
Who enforces it
Enforcement body
Federal Trade Commission; a State attorney general may also bring a parens patriae civil action under 15 U.S.C. 6504
Enforcement record
Counts the case entries on the FTC's own Cases and Proceedings listing filtered to the COPPA consumer-protection topic and sorted by date, using the page's own Last Updated field: Iconic Hearts Holdings (), Apitor (), Disney (), NGL (), and Illuminate Education (), five matters over the latest twelve months the filtered listing covers as of the read date. The next-older entries, Epic Games, Inc., U.S. v. and Epic Games, In the Matter of, are both Last Updated , outside this window. NGL's Last Updated date reflects the page's own listing of a January 2026 claims-process announcement in an action the Commission first brought in July 2024.
- As of
- Source link
- https://www.ftc.gov/legal-library/browse/cases-proceedings?field_consumer_protection_topics=1421&field_mission%5B29%5D=29&sort_by=field_date
- Actions per year
- 5
Settledness
- As of
- Guidance link
- https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions
- Guidance body
- Federal Trade Commission
- Open questions
- Which means of determining whether a visitor is a child is "reasonably calculated, in light of available technology" under the definition of a mixed audience website or online service in 16 CFR 312.2?
What it makes you log
Logging duty
The row's duties are the operator's parental consent and parental review and deletion duties (312.5 and 312.6). Those sections ask for verifiable consent, a way to review and delete, and prompt deletion of identification used for verification, and state no duty to keep a log or a record of consent, a retention period for such a record, or access to one by a regulator. Elsewhere in the Part, 312.8 and 312.10 require a written information security program and a written data retention policy, which are policy documents and not logs, and 312.11(d) sets a three-year record duty on approved safe harbor programs, a different party from the operator this row binds.
- Kind
- None
- As of
What this law does
Requires operators of websites and online services directed to children under 13, or that have actual knowledge they are collecting personal information from such children, to give notice and obtain verifiable parental consent before collecting, using, or disclosing a child's personal information, and to give parents a means to review and delete it.
The FTC's 2025 amendments, effective , add biometric identifiers, including voiceprints and facial templates, to the covered definition of personal information.
How courts have read itPremium data
Our analysis of this law draws on 1 court ruling.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .