COPPA, the Children's Online Privacy Protection Act, is a United States law that puts parents in control of what websites and apps collect from children under 13. Congress passed it in 1998, and the Federal Trade Commission (FTC) enforces it through a set of regulations known as the COPPA Rule [1].
It may sound like a purely American concern, but it does not stop at the US border. An app built in Bengaluru for primary-school children can fall under COPPA if it is aimed at American children or knowingly collects data from them. So the law matters to Indian edtech teams, as well as to the parents and teachers who use their products.
What Does COPPA Actually Do?
The idea is simple. Before a covered company collects personal information from a child under 13, it has to tell the parents and get their consent. Most of what follows in the law flows from that.
The FTC's first Rule took effect on 21 April 2000. It was updated in 2013 and again in 2025, and most companies had until 22 April 2026 to meet the latest changes [2]. That deadline has now passed.
Why Is the Age 13?
That was Congress's choice. The FTC explains that younger children "are particularly vulnerable to overreaching by marketers and may not understand the safety and privacy issues created by the online collection of personal information" [1]. Teenagers are not covered.
What Counts as Personal Information?
More than most people would guess. A name and home address count, but so do a nickname that can be used to contact a child, a voice recording and a device's tracking identifier. The Rule's list [3] covers:
- name, home address and phone number
- online contact details, and a screen name that works like one
- government identifiers such as a birth certificate or passport number
- identifiers that recognise a user over time and across services
- photos, videos and audio containing a child's image or voice
- location precise enough to identify a street and a city or town
- biometric data such as fingerprints, voiceprints and faceprints
The last two groups matter most to apps that use a child's voice or face. Government identifiers and biometrics are the main additions from 2025.
Which Companies Must Follow It?
COPPA applies to commercial websites and online services, including mobile apps and connected devices such as smart toys [1]. It reaches two kinds of company:
- those whose service is aimed at children under 13
- those running a service for general audiences who actually know they are collecting information from a child under 13
Being based abroad does not change this. The FTC says foreign services "must comply with COPPA if they are directed to children in the United States, or if they knowingly collect personal information from children in the U.S." [1] Nor does a line in the terms of service saying children may not use a product. The FTC looks at what the service is and who it is really for.
What Can Parents Do?
COPPA gives parents a say at each stage [1][3]. A parent can:
- read a clear privacy policy, and get a direct notice before information is collected
- agree or refuse, with limited exceptions
- allow the app to use the information but refuse sharing with third parties, unless that sharing is integral to the service
- see what has been collected, have it deleted and stop further collection
The company, for its part, has to keep the information secure, hold it only as long as it needs it, and not ask a child for more than an activity requires.
Can a School Give Consent Instead?
Often, yes, and this is how many children meet edtech. A school can act for parents, but only within limits. The FTC says "the school's ability to consent for the parent is limited to the educational context – where an operator collects personal information from students for the use and benefit of the school, and for no other commercial purpose" [1].
So a school can agree to a reading app for classwork. It cannot agree on parents' behalf to that app using the data for its own marketing. The duty also stays with the company, which "should not state in Terms of Service or anywhere else that the school is responsible for complying with COPPA" [1].
What Happens If a Company Breaks It?
The FTC can seek "civil penalties of up to $53,088 per violation", depending on factors such as how serious the breach was and how many children were affected [1].
Two cases show the range. In 2023 the FTC charged the edtech provider Edmodo, with a $6 million penalty that was suspended because the company could not pay [4]. In August 2026 the US Justice Department announced a $400 million settlement with TikTok and ByteDance. That settlement resolves allegations, with no finding of liability [5].
Is India's Law the Same?
No. India's Digital Personal Data Protection Act treats anyone under 18 as a child, where COPPA stops at 13, and its main duties begin in May 2027. Both rely on parental consent, but they differ on much else. Our explainer on the DPDP Act sets out how the Indian law works.
Frequently Asked Questions
What does COPPA stand for?
The Children's Online Privacy Protection Act, a US law passed in 1998 and enforced by the Federal Trade Commission.
Is parental consent needed to collect data from a 12-year-old?
Yes, in general. A company covered by COPPA needs verifiable parental consent before collecting a child's personal information, with limited exceptions. In a school setting, the school may be able to consent for the educational purpose.
How does a company check that a parent has really agreed?
The Rule lists accepted methods. They include a signed consent form, a card payment, a check of government ID, knowledge-based questions that a young child would find hard to answer, and a photo ID matched to the parent's face. A company that does not share children's data may use a text message with extra steps [3].
Does COPPA apply to companies outside the US?
Yes, if their service is aimed at children in the US or they knowingly collect personal information from children there.
Does a website have to ask every visitor's age?
No. The FTC says the Rule does not require operators to ask the age of visitors. A service for general audiences is covered when it actually knows it is collecting from a child under 13.
Does age verification break COPPA?
The FTC moved on this in February 2026. It said it will not bring COPPA enforcement against general and mixed audience services that collect information "for the sole purpose of determining a user's age" without prior parental consent, if they meet its conditions [6].
This article is general information about a US law. It is not legal advice, and a company deciding how COPPA applies to its product should speak to a qualified lawyer.
References
[1] FTC, Complying with COPPA: Frequently Asked Questions: https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions
[2] Children's Online Privacy Protection Rule, 90 FR 16918, 22 April 2025: https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-rule
[3] 16 CFR Part 312: https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312
[4] FTC Says Ed Tech Provider Edmodo Unlawfully Used Children's Personal Information for Advertising: https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-says-ed-tech-provider-edmodo-unlawfully-used-childrens-personal-information-advertising
[5] Justice Department Secures $400M Settlement with TikTok and ByteDance to Resolve Children’s Privacy Litigation: https://www.justice.gov/opa/pr/justice-department-secures-400m-settlement-tiktok-and-bytedance-resolve-childrens-privacy
[6] FTC Issues COPPA Policy Statement to Incentivize the Use of Age Verification Technologies: https://www.ftc.gov/news-events/news/press-releases/2026/02/ftc-issues-coppa-policy-statement-incentivize-use-age-verification-technologies-protect-children
