COPPA: What the Children’s Privacy Rule Means for Parents
The US rule covers children under 13, not teenagers.
By Siddharth ShankarUpdated October 23, 2026The FTC’s COPPA Rule is designed to protect children under 13. It applies to operators of commercial websites and online services, including mobile apps and Internet of Things devices, that are directed to children under 13, and to general-audience operators that have actual knowledge they are collecting information from a child under 13. Operators must get verifiable parental consent, with limited exceptions, before collecting a child’s personal information. Parents can review and delete the data and prevent further collection. COPPA does not apply to teenagers.
Your email is the key to most of your accounts. Has it already leaked?
Free · About 30 seconds · No sign-up · Email not stored
COPPA is the main US law about collecting personal information from young children online. This guide follows the FTC’s “Complying with COPPA: Frequently Asked Questions” page, written for businesses but useful for parents who want to know what to expect.
What COPPA is
COPPA stands for the Children’s Online Privacy Protection Act, and the FTC enforces it through the COPPA Rule. The FTC says the Rule was designed to protect children under age 13.
Who it covers
The FTC says the Rule applies to operators of commercial websites and online services, including mobile apps and Internet of Things devices, that are directed to children under 13. It also covers operators of general-audience sites and services that have actual knowledge they are collecting personal information from a child under 13.
What counts as personal information
The FTC lists categories such as a first and last name, a physical address, a telephone number and a Social Security number. It also includes a persistent identifier that can be used to recognise a user over time and across different websites or online services. That last item matters because it can cover identifiers that do not look like personal details, such as ones used for tracking.
Parental consent
Operators must obtain verifiable parental consent, with limited exceptions, before collecting personal information online from children. This is why some services for young children ask a parent to confirm.
Quick check before you read on: is your email in a known data breach? Free, about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
Your rights as a parent
The FTC says the Rule requires operators to:
- give parents access to their child’s personal information so they can review it and have it deleted;
- give parents the opportunity to prevent further use or online collection of a child’s personal information.
What COPPA does not do
The FTC states that COPPA does not apply to teenagers, although it is concerned about teen privacy. Many popular social media services set a minimum age and ask for a birth date, but COPPA is not a general guarantee for all minors. Parents of teenagers need to rely on settings, conversation and other laws.
Practical steps for parents
- Check the age rules of any app or game your child wants to use, and read what it says about collecting information from children.
- Look for parental controls and a way to see and delete your child’s data.
- Use the deletion rights. If a service holds your child’s information, ask to see it and have it deleted.
- Limit what you share about your child. Photos and names can build a digital footprint before they can choose for themselves. See what sharenting is.
- Review privacy settings together on the platforms your older children use. Guides such as how to make TikTok private and how to make Instagram private walk through the steps.
- Talk about location sharing, for example on Snap Map.
COPPA in action
The FTC has used COPPA to take action against large companies. One example is its case about children’s Alexa voice recordings; read the Amazon Alexa case.
Looking at the bigger picture
COPPA covers collection by operators, but it does not clean up what has already spread. For a broader view of a young person’s online presence, read the parents’ guide to children’s digital footprints.
A caution on the FTC page
The FAQ page is long and aimed at businesses. If you need an answer about a specific service, check the FTC’s guidance directly or contact the FTC.
Sources
- FTC: Complying with COPPA: Frequently Asked Questions (age threshold, coverage, personal information, parental rights)
Frequently asked questions
What age does COPPA cover?
Children under 13. The FTC says it does not apply to teenagers.
Who must follow COPPA?
Operators of commercial websites and online services directed to children under 13, and general-audience operators with actual knowledge they collect data from a child under 13.
Do operators need parental consent?
Yes. They must obtain verifiable parental consent, with limited exceptions, before collecting a child’s personal information.
Can I ask to delete my child’s data?
Yes. The FTC says parents can review the information and have it deleted, and can prevent further collection.
Does a persistent identifier count as personal information?
The FTC lists a persistent identifier that can recognise a user over time and across websites as personal information.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Compare data removal services
See which services work in your country, what they cost, and the free do-it-yourself route.
Compare removal services →Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.