Every day, thousands of children go online. While that access opens doors for learning, creativity, and interaction, it also raises serious privacy concerns. To address these risks, the U.S. enacted the Children’s Online Privacy Protection Act (COPPA), a federal law designed to safeguard the personal data of children under 13. Many business owners approach us with many questions about how COPPA applies in their situation. In this article, we address the most frequently asked questions to help you understand what COPPA requires.

Q: Who Does COPPA Apply To?

COPPA applies to operators of websites, apps, and online services that are directed to children under 13 and collect information from them. It also extends to general-audience platforms that knowingly collect personal data from children under 13. Essentially, even if your platform is not designed for kids, COPPA still applies if you know that children are using it and providing personal information.

Q: What Counts as “Personal Information” Under COPPA?

Personal information can include identifiers such as the child’s name, home address, phone number, email address, or Social Security number. The child’s platform username can also count. Additionally, less obvious data, such as cookies or device IDs that track users over time, can also fall under COPPA unless they are strictly used for internal operations. Even information about a child’s parent can fall under COPPA if it’s collected from the child and linked to an identifier.

Q: How is Parental Consent Verified?

To verify that a parent has consented to the collection of information from a child, the FTC allows several methods. These include knowledge-based authentication questions that a child cannot answer, facial recognition matching a parent’s photo to a government ID, or sending confirmation texts after consent is given.

Q: What Types of Online Services are Covered?

COPPA applies to services such as mobile apps, online games, social networking platforms, smart speakers, connected toys, location-based services, voice assistants, and any internet-enabled service that collects personal data from children.

Q: Does an Operator Have to Keep Children’s Data Forever?

No. COPPA only requires operators to keep children’s personal information as long as it is reasonably necessary for its original purpose. If the information is no longer needed, it should be securely deleted. This means that if a parent requests access and you deleted the data because you reasonably no longer needed it, you can simply state that the information is no longer retained.

Q: What Happens if You Do Not Comply?

Non-compliance can be costly. As of 2025, civil penalties can reach up to $53,088 per violation, and each non-compliant event can count separately. The FTC has actually imposed multimillion-dollar fines in several cases. One notable example involved Disney’s YouTube channels. Child-directed videos were incorrectly labelled as “not made for kids,” leading to targeted advertising and features not intended for children. The FTC settlement required a $10 million penalty and significant changes to how Disney designates its content.

In addition to financial penalties, violating COPPA rules can result in reputation damage and even increased regulatory oversight. It’s therefore in your best interest to comply and avoid making costly mistakes.

Contact the Consumer Data Privacy and Compliance Attorneys at Revision Legal

For more information, contact the experienced Consumer Data Privacy and Compliance Lawyers at Revision Legal. You can contact us through the form on this page or call (855) 473-8474.