What COPPA Actually Protects, A Parent’s Guide to Kids’ Online Privacy
You’ve probably seen “we do not knowingly collect information from children under 13” buried in some app’s privacy policy and wondered what that actually means. That line exists because of a federal law called COPPA, and it just went through its biggest update since the rule first took effect back in 2000.
COPPA stands for the Children’s Online Privacy Protection Act. Congress passed it in 1998, and the Federal Trade Commission has enforced it ever since. The core idea hasn’t changed in over two decades. Any commercial website, app, or online service that’s aimed at kids under 13, or that knowingly collects personal information from kids that age, has to get a parent’s permission first. Not permission from the child. From you.
What Counts as Personal Information
This covers more than you might expect. It includes the obvious stuff, a name, home address, email, or phone number. But it also covers a child’s photo, video, or voice recording, their exact location, and any persistent identifier that could be used to track them across sites and apps over time, like a device ID or an advertising cookie.
What Changed in 2025
The FTC finalized a significant update to the COPPA Rule in April 2025, with most of the new requirements now in effect. A few changes are worth knowing about as a parent, since they directly affect the consent notices and settings you’ll actually see.
Companies now have to get your consent separately for two different things. One consent covers collecting and using your child’s information for the service itself. A second, separate consent is required before that information can be shared with outside third parties or used for targeted advertising. Before, one blanket yes covered everything. Now you can say yes to the app working, and no to your kid’s data being sold or shared around, and companies have to actually offer you that choice.
Companies also can’t hold onto your child’s data forever anymore. They’re required to delete it once it’s no longer needed for whatever it was originally collected for, instead of the old pattern of quietly storing it indefinitely.
Verifying that it’s actually a parent giving consent, and not the kid clicking through a pop up, has gotten more rigorous too. Companies can now use methods like facial age estimation or knowledge based verification questions in addition to the older options like a credit card check or a signed form.
What This Means for You Day to Day
In practice, this shows up as consent screens and privacy notices you’ll actually be asked to interact with, not just legal text nobody reads. If your child wants to sign up for an app or a game and it asks for your email to confirm you’re the parent, that’s COPPA in action. If a service explains that it won’t share your child’s information with advertisers unless you specifically agree to that, that’s also new, and it’s a real improvement over how things worked before.
It’s worth remembering that COPPA only applies to services actually built for or knowingly used by kids under 13. Once your child turns 13, or if they’re using a general audience platform that isn’t specifically marketed to children, these particular protections no longer apply the same way. That’s exactly the point where staying involved and knowing what tools are available matters most. Our guide to parental control tools and our piece on keeping your child safe online both pick up where the law’s protections leave off.
If you ever want to see exactly what a company is required to disclose, or you think a site or app aimed at kids is mishandling this, the FTC keeps its official COPPA guidance here, and you can file a complaint directly with the FTC at ReportFraud.ftc.gov if something feels off.