COPPA

The Children’s Online Privacy Protection Act (COPPA) is a U.S. federal law enacted in 1998 and enforced by the Federal Trade Commission (FTC) that protects the privacy of children under 13 years old by imposing strict requirements on mobile apps, websites, and online services that target young audiences. COPPA applies to apps directed at children, apps with actual knowledge they’re collecting data from children, or general-audience apps that include child-directed sections, requiring these services to obtain verifiable parental consent before collecting, using, or disclosing personal information from young users.

Mobile app developers must implement comprehensive COPPA compliance measures including posting clear privacy policies describing data collection practices, obtaining verifiable parental consent through approved methods (such as credit card verification, video conference, or government-issued ID checks), providing parents with means to review and delete their children’s information, maintaining reasonable data security measures, collecting only necessary information (data minimization), and deleting children’s data when no longer needed. Both Apple and Google have specific app store policies requiring COPPA compliance declarations, with dedicated “Kids” categories that restrict certain features like advertising and in-app purchases.

COPPA differs from GDPR and CCPA in its specific focus on protecting children rather than general data privacy: while GDPR and CCPA apply to all users (though GDPR requires parental consent for children under 16), COPPA exclusively addresses the unique vulnerabilities of children under 13 with more stringent parental consent requirements. Many apps avoid COPPA requirements by restricting access to users 13 and older through age gates, though this strategy requires robust age verification.