WebBuilding

Laws and standards

COPPA

Summary

The Children's Online Privacy Protection Act of 1998 (COPPA) is a US federal law that requires commercial websites and online services directed to children under 13, or that knowingly collect personal information from them, to give notice and get verifiable parental consent first. It was enacted on October 21, 1998, and the Federal Trade Commission's COPPA Rule took effect on April 21, 2000. The FTC amended the rule in 2013 and again in 2025, with compliance due by April 22, 2026.

Web Building Encyclopedia · Laws and standards · Last reviewed October 22, 2026 · 10 min read

What COPPA is

The Children’s Online Privacy Protection Act of 1998, known as COPPA, is a United States federal law about personal information collected online from children. For the law, a child is anyone under 13.1

The law itself is short. It sets the basic duties and tells the Federal Trade Commission (FTC), the federal agency that polices unfair and deceptive business practices, to write the detailed rules. Those rules are the Children’s Online Privacy Protection Rule, often called the COPPA Rule, at Part 312 of Title 16 of the Code of Federal Regulations.12 When people say a site must “comply with COPPA,” they usually mean the rule.

COPPA covers two kinds of operators, meaning the companies that run a commercial website or online service and collect or keep personal information from its users:

  • Sites and services directed to children. The statute defines these as sites or services targeted to children, which can mean a whole site or only a part of one.1
  • General audience sites with actual knowledge. Any operator that has “actual knowledge that it is collecting personal information from a child” must also follow the rule.1

The statute excludes most nonprofit organizations.1 The FTC says nonprofits that work for the profit of their commercial members may still be covered.3 Location does not decide coverage either: a site based outside the United States must comply if it is directed to children in the United States or knowingly collects their information.3

The FTC enforces COPPA, and so do some other federal agencies for the businesses they regulate, such as banks and airlines.1 State attorneys general can also sue in federal court on behalf of their residents, after giving the FTC written notice.1

Why Congress passed it

In June 1998 the FTC sent Congress a report called Privacy Online. It had looked at 212 websites aimed at children and found that 89% collected at least one type of personal information from them.4 Only 1% of the sites surveyed, three in all, required parental consent to the collection and use of that information.4

The report asked Congress for a law “placing parents in control of the online collection and use of personal information from their children.”4 It suggested parental notice and consent for children aged 12 and under.4

Two months later, on August 13, 1998, the FTC announced a settlement with GeoCities, the large home page community, and called it the agency’s first internet privacy case.5 The FTC said GeoCities had misrepresented why it collected information from children and adults. The order required parental consent before GeoCities collected personal information from children 12 and under.5 COPPA later drew the same line, at under 13.1

COPPA was enacted on October 21, 1998, as Title XIII of Division C of Public Law 105-277.1 It passed during the dot-com boom of the late 1990s. The statute delayed its main duties until at least 18 months after enactment.1

The FTC announced the first version of the rule on October 20, 1999, by a 4 to 0 vote, and it took effect on April 21, 2000.6 At first it allowed a temporary “sliding scale” for consent: an email from a parent, with an extra confirmation step, was enough when the site used the information only internally, while sharing it with others or posting it publicly needed a more reliable method.6

What the rule requires

The rule lists five core duties for a covered operator.2

  • Post a notice. The site must publish a clear notice of what it collects from children, how it uses that information and whether it discloses it to others. The rule says the notice must contain “no unrelated, confusing, or contradictory materials.”2
  • Get verifiable parental consent first. Before collecting, using or disclosing a child’s personal information, the operator must notify a parent directly and get consent by a method reasonably calculated to make sure the person consenting really is the parent.2
  • Let parents review and delete. Parents can see what was collected, refuse further collection or use, and have the information deleted.2
  • Do not ask for more than needed. An operator may not make a child give more personal information than is reasonably necessary to take part in a game, prize or other activity.2
  • Keep it secure, and not forever. The operator must protect the information and keep it only as long as reasonably necessary for the purpose it was collected for.2

What counts as personal information

The list is broader than a name and address. It includes online contact information such as an email address, a screen name that works like contact information, a telephone number, a photo, video or audio file with a child’s image or voice, and geolocation precise enough to identify a street name and city.2

It also includes persistent identifiers: a customer number held in an HTTP cookie, an IP address or a device identifier, which can recognize the same user over time and across different sites.27 Since 2025 the list also covers biometric identifiers such as fingerprints, voiceprints and facial templates, and government-issued identifiers.28

How a parent can consent

The current rule lists accepted methods, including a signed form returned by mail, fax or scan, a payment card transaction that notifies the account holder, a call to a toll-free number or a video call with trained staff, and a check of a government ID that is then deleted.2 It also lists knowledge-based questions too hard for a child to answer, and a facial match between a parent’s photo ID and a live image.2

A simpler “email plus” or text message method is allowed only for operators that do not disclose the child’s information to anyone else, and it needs an extra confirming step.2 Companies can ask the FTC to approve new methods, and the agency must decide within 120 days.2

When consent is not needed first

The rule has a short list of exceptions. An operator can collect a child’s online contact details to answer a single specific request and then delete them, and it can use persistent identifiers solely to support the internal operations of the site or service.2 The FTC’s guidance applies the first exception to email: a site may answer a child’s message without parental consent, then must delete the contact information promptly.3

Updates in 2013 and 2025

The FTC began reviewing the rule in 2010 to keep up with how children used the internet, including on mobile devices and social networks.7 It announced the amended rule on December 19, 2012, and the changes took effect on July 1, 2013.7

The 2013 changes brought the rule into the social web and app era:

  • Persistent identifiers, photos, videos, audio files and geolocation became personal information.7
  • A child-directed site or app became responsible when it let third parties, such as plug-ins and advertising networks, collect children’s information through it. Those third parties were covered when they knew they were collecting through a child-directed service.7
  • App stores were not made liable simply for offering child-directed apps.7
  • Sites that target children as a secondary audience could screen for age and get consent only from users who said they were under 13.7

The FTC voted 5 to 0 on January 16, 2025, to finalize another round of changes.8 They were published in the Federal Register on April 22, 2025, took effect on June 23, 2025, and gave businesses until April 22, 2026, to comply, except for three safe harbor provisions (sections 312.11(d)(1), (d)(4) and (g)) that the deadline does not cover.9

The 2025 amendments:

  • Require separate parental consent before disclosing a child’s personal information to third parties, including for targeted advertising, unless the disclosure is integral to the service.82
  • Require a written data retention policy, included in the online notice, and say children’s information “may not be retained indefinitely.”2
  • Require a written security program, with risk assessments at least once a year.2
  • Add a formal definition of a mixed audience site, which the FTC described as a subset of child-directed sites, not an expansion of them.9
  • Require safe harbor programs to publish their membership lists and report more to the FTC.8

The FTC did not finalize proposed limits on push notifications to children or proposed changes for education technology used in schools.8

Safe harbor programs

COPPA lets industry groups write their own guidelines and ask the FTC to approve them. An operator that follows approved guidelines is treated as complying with most of the rule.12 As of October 2026, the FTC lists six approved programs: the Children’s Advertising Review Unit (CARU), the Entertainment Software Rating Board (ESRB), iKeepSafe, kidSAFE, PRIVO and TRUSTe.10

Penalties and major cases

A COPPA violation is treated as a violation of an FTC rule on unfair or deceptive practices.2 Courts can impose civil penalties for each violation. The maximum is adjusted for inflation: as of October 2026 it is $53,088 per violation, the figure that applies to penalties assessed after January 17, 2025.113 In August 2024 the FTC gave the earlier figure, up to $51,744 per violation, per day.12 The FTC says the actual amount depends on factors such as how serious the violations were, how many children were involved and the size of the company.3

DateCompanyOutcomeWhat the government alleged
February 27, 2019Musical.ly (now TikTok)$5.7 millionCollected personal information from users under 13 without notifying parents or getting their consent, and did not delete it when parents asked13
September 4, 2019Google and YouTube$170 million ($136 million to the FTC, $34 million to New York)Used cookies to track viewers of child-directed channels for targeted ads without parental consent14
December 19, 2022Epic Games (Fortnite)$275 million COPPA penaltyCollected information from children under 13 without notifying parents or getting consent, and made deletion requests hard15
June 5, 2023Microsoft (Xbox)$20 millionCollected information from children signing up for Xbox before involving parents, and kept some of it for years16
August 21, 2026TikTok and ByteDance$400 million settlement (as reported by Al Jazeera)Knowingly let children under 13 use regular accounts and collected their information without parental consent17

Each case set a marker at the time. The FTC called the Musical.ly penalty the largest it had obtained in a children’s privacy case.13 Months later it said the YouTube penalty was “by far the largest amount the FTC has ever obtained in a COPPA case.”14 It described the Epic penalty as the largest ever for violating any FTC rule.15

The YouTube order also changed how video creators work. YouTube had to build a system that lets channel owners mark their child-directed content, and to tell them that such content may be subject to COPPA.14

Not every child-related claim in these cases rested on COPPA. In the Epic case, the FTC treated Fortnite’s voice and text chat being switched on by default as an unfair practice under the FTC Act, not as a COPPA violation.15

The TikTok matter began on August 2, 2024, when the Department of Justice sued TikTok and ByteDance on the FTC’s behalf in federal court in California. The complaint also said the companies had violated the 2019 Musical.ly order.12 According to reports by Al Jazeera and JURIST, the Department announced a $400 million settlement on August 21, 2026: $300 million paid now and $100 million after the court enters an order vacating the 2019 Musical.ly consent decree.1718 JURIST reported that TikTok did not admit wrongdoing.18

Proposals to extend COPPA

COPPA’s protections stop at age 13, and it applies to general audience sites only when they have actual knowledge of a child user.1 A bill called the Children and Teens’ Online Privacy Protection Act, S. 836 in the 119th Congress and often called COPPA 2.0, would change both.

The version that passed the Senate on March 5, 2026, would:19

  • Add protections for teens, defined as people aged 13 to 16.
  • Cover operators that know a user is a child or teen, or whose knowledge is “fairly implied on the basis of objective circumstances.”
  • Bar the use of children’s and teens’ personal information for individual-specific advertising, with narrow exceptions such as contextual ads.
  • Let parents, and teens themselves, ask to see, correct and delete the information collected.

A bill becomes law only after both the House and the Senate pass it and the President signs it. As of October 2026, the latest primary record we could open is the Senate-passed text of March 5, 2026.19

COPPA is one of several privacy laws a website can fall under. California’s CCPA and CPRA and Europe’s GDPR and ePrivacy Directive have their own rules, and the CAN-SPAM Act covers commercial email. COPPA’s statute bars states from imposing liability for these activities that is inconsistent with it.1

Timeline

  1. Justice Department announces a $400 million settlement with TikTok and ByteDance17
  2. Deadline to comply with most of the 2025 rule amendments9
  3. Senate passes S. 836, the Children and Teens' Online Privacy Protection Act19
  4. The 2025 amendments to the COPPA Rule take effect9
  5. FTC votes 5 to 0 to finalize the 2025 amendments8
  6. Justice Department sues TikTok and ByteDance on the FTC's behalf12
  7. Microsoft agrees to pay $20 million over Xbox sign-ups16
  8. Epic Games agrees to a $275 million COPPA penalty15
  9. Google and YouTube agree to pay $170 million14
  10. Musical.ly agrees to pay $5.7 million13
  11. Amended rule covering persistent identifiers, photos and geolocation takes effect7
  12. The COPPA Rule takes effect6
  13. COPPA is enacted as part of Public Law 105-2771
  14. FTC announces its GeoCities settlement, its first internet privacy case5
  15. FTC report Privacy Online finds 89% of children's sites collect personal information4

What it means for your website

This is general information, not legal advice. Whether COPPA applies to a particular site depends on its audience and what it collects, so check the FTC’s own guidance or ask a lawyer.

  • Decide whether your site is directed to children. The FTC looks at subject matter, visual content, animated characters, music, the age of models, child-oriented activities, advertising and evidence about the real audience.2 Most sites for adult services, such as a plumber or a law firm, do not fit those factors. A site for a children’s toy, game, tutoring program or kids’ class may.
  • You do not have to investigate ages. The FTC says the rule “does not require operators of general audience sites to investigate the ages of visitors.”3 The law still applies once you have actual knowledge that you are collecting personal information from a child.1 If you do ask for age, the FTC says to ask in a neutral way, for example by letting users enter their month and year of birth freely.3
  • Treat contact forms with care. If a child writes in, the one-time response exception lets you reply, then delete the child’s contact details promptly.3
  • Check your tags and plugins. Advertising pixels and tracking scripts, often added through a plugin or tag manager, collect persistent identifiers. On a child-directed site, those count as personal information unless used only for internal operations, and since the 2025 amendments sharing children’s data for targeted advertising needs separate parental consent.38 Our page on websites and Google Ads covers what these tags do.
  • Write it down. A covered operator needs a written retention policy in its notice and a written security program.2
  • Know the cost of getting it wrong. As of October 2026, the maximum civil penalty is $53,088 per violation.11

On self-hosted WordPress, which we build on every week, a site owner chooses every form and plugin, so these choices are yours to make. On a hosted website builder, check which tracking the platform adds by default. Our guide to US website laws covers COPPA alongside the other rules a small business site may face, and our school websites section is for sites whose visitors include children.

See also

References

  1. 15 U.S.C. Chapter 91: Children's Online Privacy Protection (sections 6501 to 6506). United States Code, U.S. Government Publishing Office (govinfo). accessed October 22, 2026.
  2. 16 CFR Part 312: Children's Online Privacy Protection Rule. Electronic Code of Federal Regulations (eCFR), National Archives. 2026-10-21. accessed October 22, 2026.
  3. Complying with COPPA: Frequently Asked Questions. Federal Trade Commission. 2026-07-10. accessed October 22, 2026.
  4. Privacy Online: A Report to Congress. Federal Trade Commission. 1998-06. accessed October 22, 2026.
  5. Internet Site Agrees to Settle FTC Charges of Deceptively Collecting Personal Information in Agency's First Internet Privacy Case. Federal Trade Commission. 1998-08-13. accessed October 22, 2026.
  6. New Rule Will Protect Privacy of Children Online. Federal Trade Commission. 1999-10-20. accessed October 22, 2026.
  7. FTC Strengthens Kids' Privacy, Gives Parents Greater Control Over Their Information By Amending Children's Online Privacy Protection Rule. Federal Trade Commission. 2012-12-19. accessed October 22, 2026.
  8. FTC Finalizes Changes to Children's Privacy Rule Limiting Companies' Ability to Monetize Kids' Data. Federal Trade Commission. 2025-01-16. accessed October 22, 2026.
  9. Children's Online Privacy Protection Rule (final rule, 90 FR 16918, document 2025-05904). Federal Trade Commission, Federal Register. 2025-04-22. accessed October 22, 2026.
  10. COPPA Safe Harbor Program. Federal Trade Commission. accessed October 22, 2026.
  11. 16 CFR 1.98: Adjustment of civil monetary penalty amounts. Electronic Code of Federal Regulations (eCFR), National Archives. 2026-10-21. accessed October 22, 2026.
  12. FTC Investigation Leads to Lawsuit Against TikTok and ByteDance for Flagrantly Violating Children's Privacy Law. Federal Trade Commission. 2024-08-02. accessed October 22, 2026.
  13. Video Social Networking App Musical.ly Agrees to Settle FTC Allegations That it Violated Children's Privacy Law. Federal Trade Commission. 2019-02-27. accessed October 22, 2026.
  14. Google and YouTube Will Pay Record $170 Million for Alleged Violations of Children's Privacy Law. Federal Trade Commission. 2019-09-04. accessed October 22, 2026.
  15. Fortnite Video Game Maker Epic Games to Pay More Than Half a Billion Dollars over FTC Allegations of Privacy Violations and Unwanted Charges. Federal Trade Commission. 2022-12-19. accessed October 22, 2026.
  16. FTC Will Require Microsoft to Pay $20 million over Charges it Illegally Collected Personal Information from Children without Their Parents' Consent. Federal Trade Commission. 2023-06-05. accessed October 22, 2026.
  17. TikTok settles with US Justice Department for $400m over child privacy laws. Al Jazeera. 2026-08-21. accessed October 22, 2026.
  18. TikTok reaches $400 million settlement with US Justice Department over children's privacy. JURIST. 2026-08. accessed October 22, 2026.
  19. S. 836 (engrossed in Senate): Children and Teens' Online Privacy Protection Act, 119th Congress. U.S. Government Publishing Office (govinfo). 2026-03-05. accessed October 22, 2026.

Web Building Encyclopedia. First published October 22, 2026. Last reviewed October 22, 2026. Every fact on this page is linked to a source we opened. Spotted an error? Write to [email protected].