All regulations / US Privacy
COPPA
Know the rule before it knows you.
Verifiable parental consent before collecting data from children under 13 in the US.
What it is
COPPA requires websites, apps and online services directed to children under 13, or with actual knowledge of child users, to obtain verifiable parental consent before collecting personal information, to post a compliant privacy notice, and to limit data retention and third-party sharing. The 2025 rule update tightens consent for targeted advertising and adds security and retention requirements.
This applies to you if
- Your service is directed to children or attracts under-13 users in the US
- You operate ed-tech, games, toys or family apps
- You embed third-party SDKs that collect data from such services
What it asks of you
- Verifiable parental consent, separate consent for third-party disclosure
- Direct notice to parents and an online privacy policy
- Data minimisation, written security programme and retention policy
What it costs to ignore
Civil penalties per violation, enforced by the FTC and state attorneys general.
Key dates
Rule update effective June 2025; compliance deadline April 2026.
How we help
Not sure which apply to you? Send us three lines about what you sell and to whom, and we will tell you which rules matter and which do not.
Have a regulatory question?
Send a short description of your situation. We reply within one working day, usually with a view on scope and a fixed fee where possible.