Federal Internet Law & Policy
An Educational Project
Children's Online Privacy Protection Act Dont be a FOOL; The Law is Not DIY
  Who Must Comply
  What is Required
    Parental Consent
    Sliding Scale
    Parental Review
    Data Security
  "Personal Info"
  Giving Away Stuff

- Privacy
- Fair Info Practices
- 4th Amendment
- - ECPA
- - FISA
- - Patriot Act
- - Expectation
- - Cybersecurity
- - Anonymity
- - ID Theft
- - Spyware
- - Children's Privacy
- - Cookies
- - Social Networks
- - Advertising
- - Online Profiling
- - Privacy Policies
- - Enforcement
- - CPNI
- - Cable
Dept of Commerce
- - NTIA
- - NIST
- - EU Safe Harbors
- The Feds
- - Pri.Protection Act
- - Privacy Act
- - Pri. Impact Statements
- - Info Law
- - The Press
- Geolocation
- - Location Based Services
- Reference

Congressional concern over children’s privacy led it to passage in 1998 of the Children’s Online Privacy Protection Act (COPPA)[16 CFR Part 312]. [See Privacy Introduction for background] More information can be found online at the FTC’s Children’s Privacy website.

Who Must Comply With COPPA?

One falls under the requirements of COPPA if you

  • are the operator [COPPA Sec. 1302(2)] of a
  • commercial website [16 CFR § 312.2] or
  • online service
  • (Note that the term "online service" is not defined by the statute. At a July 2010 Hearing, panelists struggled with whether American Idol voting might be an "online service")
  • That either
  • Is Directed at Children, or [COPPA Sec. 1303(1)(a)]
  • Appeals generally to the public but has a subsection dedicated and focused on little ones. [COPPA Sec. 1303(1)(a)] [COPPA Sec. 1302(10)]
  • For example, many professional sports pages will have a kid's area with kids activities, kids booster clubs, trading cards, games, and other specialties. If a professional sports team has a kids club where children can sign up for the club online and gain the special bobble head freebies, then would probably fall under COPPA.
  • Has actual knowledge that it is collecting information from children [COPPA Sec. 1303(1)(a)], or
  • Child mean an individual under the age of 13;
  • [COPPA Sec. 1302(1) ("The term "child" means an individual under the age of 13")]
  • [FTC July 2010 Hearing (Panel 2: testimony that requirement has taught and led children to lie)]
  • "In enacting the statute, Congress determined to apply COPPA's protections only to children under 13. Congress and industry self-regulatory bodies have traditionally distinguished children aged 12 and under, who are particularly vulnerable to overreaching by marketers, from children over the age of 12, for whom strong, but more flexible protections may be appropriate. In addition, distinguishing adolescents from younger children may be warranted where younger children may not understand the safety and privacy issues created by the online collection of personal information.

    "Given the risks inherent in the disclosure of personal information for all ages, the FTC encourages website operators to offer teenagers privacy protections as well. Moreover, websites' information practices regarding teens and adults are subject to Section 5 of the FTC Act, which prohibits unfair or deceptive acts and practices. See Staff Opinion Letter to Center for Media Education (July 15, 1997) for guidance on how Section 5 applies to information practices involving teens. In addition, recent concern about the risks of child participation on social networking websites led the FTC to issue a set of safety tips for social networking. See "Social Networking Sites: A Parents' Guide" (September 2007), available at ; see also OnGuard OnlinePDF." - FTC COPPA FAQs

  • Note: Pursuant to Executive Memo M-00-13, all Federal agencies and their contractors must comply with COPPA.

    How does the FTC determine that a website targets children? The FTC has indicated that it will look at the following factors when making this determination:

  • "visual or audio content;
  • the age of models on the site;
  • language;
  • whether advertising one the Web site is directed at children;
  • information regarding the age of the actual or intended audience; and
  • whether a site uses animated characters or other child-oriented features."
  • If a service does not target children, then actual knowledge means actual knowledge. Some websites gather statistical information on visitors without any thought that some visitors may be children or intention to market or serve those visitors - if a site asks and knows, then it is under COPPA. Once the site has actual knowledge, then it is stuck with it. Conversely, what about lying kids. According to COPPA, if the kid visits a site and lies about his age, then the kid is not that site's problem. If nothing about a visitor’s presence informs a website that the visitor is a child, then the site lack s actual knowledge.

    One area of concern is monitored online communities such as email groups or chat rooms. If the community targets children or if the visitor reveals that the visitor is a child, then the operators of the community must comply with COPPA. One action the community monitor can take is to strip out all personal information from the messages prior to permitting them to be posted. This is sufficient and does not require further parental consent. Operators may elect, instead of stripping out such material, to gain the consent of parents for their children’s participation. These rules do not apply to unmonitored communities. This is likely to pose a significant challenge to monitored communities that do not target children and are not accustomed to COPPA who are suddenly confronted with a message that states, "Hi, my name is Tommy, I’m in the 6th grade and I am doing a research project..."


    At issue with COPPA is the collection of personal information.  Personal information means individually identifiable information and includes a first and last name, a physical address, an e-mail address, screen name, or other online identifier, a telephone number, a social security number, or a cookie or other persistent identifier. [COPPA Sec. 1302(8)] [See also CPNI, ECPA] It also means any additional information collected from the child in combination with any of the above items.  In other words, once a firm has collected personal information from a child, all additional information collected is likewise infected.  In order to fall under COPPA, this information must be collected online (if, for example, the visitor prints off a form and then mails in the information, it would not then fall under COPPA).

    Note that if the information a site wants to collect is not on the above list (and you are a website that does not target children), then that site can collect it without falling under the restrictions of COPPA. It is, for instance, possible to conduct surveys of visitors to a site and not fall under COPPA as long as no part of the survey asks for personally identifiable information.  The survey can even ask age as long as it does not ask, for example, for the visitors name or set a cookie.  If a site wants to set up some silly online poll of the masses asking who should win this years academy awards or who will be elected President, the site could do this and not fall under COPPA as long as that site is not asking personal questions.


    There are a number of exceptions to COPPA which permit online sites to interact with visitors without the consent of parents.  They are as follows: 

  • The online service can gather personal information for the purpose of contacting the child's parents in order to gain consent. [16 CFR § 312.5(c)] [COPPA Sec. 1303(b)(2)(B)]
  • The online service can respond on a one-time basis to an inquiry of the child if it does not use that personal information for any further purposes and deletes it from its databases. [COPPA Sec. 1303(b)(2)(A)&(C)]
  • The online service can collect personal information for the purpose of protecting the child's safety where that information is not used for any other purpose including contacting the child and that information is not disclosed anywhere on the online service.  [COPPA Sec. 1303(b)(2)(D)]
  • The online service can collect information where it is collected only for the purpose of maintaining the security or integrity of the system, or as required by law or judicial process. [COPPA Sec. 1303(b)(2)(E)]
  • There is another interesting "exception" known as safe harbors.  These are industry self regulation programs that are submitted to the FTC for approval.  If approved, then those members who are certified as complying with that program are deemed to be in compliance with COPPA.  The entity seeking FTC approval of their self regulation program will have to provide assurances to the FTC that the integrity of the program will be maintained. [COPPA Sec. 1304]


    I visited a webpage recently where it asked me for personal information.  My own personal privacy protection program is "garbage in, garbage out."  I love filling out these forms and always fill them with all types of rubbish.  Anyway, when it asked me what year I was born, I unthinkingly hit "1999."  The website, citing COPPA, refused to gather any further information from me.

    This is a viable option.  Age information is not defined by COPPA as personally identifiable information.  A site can ask the age of the visitor without having to comply with COPPA further. If the visitor is under the age of 13, a viable option is to refuse to collect any personally identifiable information.  If that information is necessary in order to provide your online service, the site may decide not to offer services to children under the age of 13.


    If a site is running online contests, there is a more specific rule, as this was one of the areas of greatest abuse.  An operator of an online contest targeted at children is permitted to gather only sufficient information from the visitor that is reasonably necessary for the visitor to participate in the activity.  In other words, no asking for mommy and daddy's salary in order to win a free t-shirt. [16 CFR § 312.7]

    © Cybertelecom ::