Children’s Online Privacy Protection Act (COPPA)

If your online platform is directed toward children under 13 or knowingly collects their data, COPPA requires you to:

• Post a clear privacy policy detailing data practices for children’s information.
• Get verifiable parental consent before collecting personal data from children.
• Allow parents to review or delete their child’s personal information.
• Secure children's data with reasonable protection practices.
• Disclose any third parties with whom the data is shared.

Even businesses not based in the U.S. must comply if they target or serve U.S. children.

COPPA defines “personal information” broadly. It includes names, email addresses, geolocation data, photos, voice recordings, persistent identifiers (like cookies), and more.

Key COPPA rules include:

1. Notice and transparency: Tell parents what data you collect and how it's used.
2. Parental consent: Must be obtained before collection.
3. Data minimization: Only collect what’s necessary.
4. Right to deletion: Parents must be able to delete a child's info.
5. Security measures: You must keep the data safe from misuse or unauthorized access.

‍

Violating COPPA can lead to civil penalties of up to $50,120 per child per violation. In recent years, companies have faced multi-million dollar fines for non-compliance.

Examples include:

• YouTube (Google) fined $170 million in 2019
• TikTok (formerly Musical.ly) fined $5.7 million in 2019

The cost of non-compliance isn’t just financial—it can also damage your brand’s trust and credibility with families.