If children under 13 use your app, play your game, or visit your website — even if you never designed it for them — federal law may already treat you like a children's company. And since the first major update to that law in over a decade took full effect this year, the obligations are stricter than most small operators realize.
The law is the Children's Online Privacy Protection Act, or COPPA. It has been around since 2000, but the Federal Trade Commission's overhaul of the COPPA Rule — finalized in January 2025 with operator compliance required by April 2026 — rewrote the practical playbook: separate parental permission before you share a child's data with anyone, hard limits on how long you keep it, and a written security program to protect it. Civil penalties run to more than $50,000 per violation, adjusted upward for inflation every year.
This guide explains who COPPA actually covers, what the updated rule demands, and the concrete checklist a small team can work through without hiring a privacy department.
Who COPPA Covers: It's Not Just Kids' Sites
The single most expensive misunderstanding about COPPA is the belief that it applies only to products "made for children." The FTC says otherwise, explicitly: the rule is not just for kids' sites.
Websites and services "directed to children"
A site or app is considered directed to children when, looking at the whole picture, it appeals to kids under 13. The FTC weighs factors such as subject matter, visual style and characters, music, language, evidence of actual use by children, and advertising aimed at children. A brightly animated game, a cartoon avatar maker, or a product unboxing channel with a young audience can all qualify — regardless of what your marketing plan says your target demographic is.
"Actual knowledge" catches everyone else
Even a general-audience service becomes covered the moment its operator has actual knowledge that it is collecting personal information from a child under 13. That knowledge can arrive through a support email mentioning a user's age, a birthday field in your signup form, a parent's complaint, or analytics showing a young user base you chose not to examine. Once you know, you cannot un-know: from that point, COPPA's consent and data-handling duties apply to that child's information.
Mixed-audience services get a middle path
If your audience genuinely spans children and adults, the rule lets you age-screen and apply COPPA protections only to the under-13 users you identify — but the screen has to be neutral and effective. A self-declared birthdate gate that quietly lets a user change their answer until they are "old enough," or that defaults to an adult year, will not protect you. Design the gate so it cannot be gamed in one click, and treat anyone identified as under 13 as fully covered.
What the 2025 Update Changed
The amendments that operators had to comply with starting April 2026 are the first significant revision since 2013, and they concentrate on three themes: parents must specifically approve sharing and monetization, children's data cannot be stockpiled, and security must be documented rather than assumed.
Separate consent before sharing or targeting ads
Previously, a single parental consent could cover collection, use, and disclosure together. Now you must obtain a distinct, opt-in consent before disclosing a child's personal information to third parties — including for targeted advertising. In practice, this means your onboarding flow needs two separate, clearly described asks: one to collect and use the child's information for the service itself, and another before any of it flows to ad networks, analytics vendors, or other third parties. Pre-checked boxes and bundled "accept everything" buttons do not satisfy the standard.
Keep children's data only as long as you need it — then delete it
The updated rule keeps the "reasonably necessary" retention standard but adds an explicit ban on keeping children's personal information indefinitely. You must publish a data-retention policy for children's information and maintain an internal schedule for deleting it. Concretely: define, for each category of data you hold (accounts, chat logs, support tickets, backups), how long you keep it and why, then delete on that schedule. "We might need it someday" is no longer a lawful retention reason.
A written security program is mandatory
Operators must now establish, implement, and maintain a written children's personal information security program with safeguards appropriate to the sensitivity of the data. For a small team, this does not require enterprise tooling — but it does require writing down who can access children's data, how it is encrypted in transit and at rest, how you vet vendors with access, and how you respond to an incident — and then actually following the document.
Broader definitions and sharper notices
The update adds biometric identifiers to the definition of personal information, so voiceprints, face geometry, or fingerprints collected from children are fully covered. Your direct notice to parents must also be more granular: spell out what you collect, how you use it, and specifically which third parties receive it and for what purposes. A generic "we may share data with partners" paragraph no longer suffices.
Verifiable Parental Consent, Practically Speaking
COPPA consent must be "verifiable" — you need a method reasonably calculated to confirm the person consenting is actually the child's parent, not the child. The FTC recognizes several approaches, and the right one depends on what you do with the data:
- Payment verification. A small charge or card verification step confirms an adult holds the payment instrument. Common for subscriptions and paid apps.
- Signed consent forms. A parent signs and returns a form by mail, fax, or scanned upload. Low-tech and reliable for schools, camps, and programs with offline enrollment.
- Video conference. A live video check with trained staff. Strong assurance, but labor-intensive at scale.
- Government ID verification. Checking a driver's license or other ID against a database. Effective, but you then hold sensitive parent documents that need their own protection and deletion schedule.
- Knowledge-based authentication. Challenge questions drawn from records only the parent would likely know. The FTC has approved specific implementations of this method.
- Email-plus — internal use only. For data you collect and use solely within your own operation (never disclosed to third parties), you may use the lighter "email plus" method: an email from the parent followed by a delayed confirmation through a second channel. The moment any third party receives the data, email-plus stops being enough.
Whatever method you choose, keep records of the consent: when it was given, what it covered, and how it was verified. Consent records are both a legal shield and ordinary business documentation.
Your Compliance Checklist
Work through these steps in order. Each one builds on the last, and together they cover the duties the FTC's own six-step compliance plan emphasizes.
1. Map what you collect and from whom
Inventory every data field your product touches: signup forms, analytics SDKs, crash reporters, ad modules, chat features, support tools, newsletters. For each, note whether it could come from a user under 13 and which vendors receive it. Most small teams discover at least one SDK quietly transmitting device identifiers or location data they never consciously chose to collect.
2. Decide your audience posture
Are you child-directed, mixed-audience, or general-audience? Document the reasoning. If mixed-audience, build the neutral age screen described above. If general-audience, decide in advance how you will respond when you gain actual knowledge of a young user — who reviews the flag, how fast data collection stops, and when deletion happens.
3. Rewrite your privacy policy and parent notice
Post a clear, complete policy: what children's information you collect, how you use it, whom you share it with and why, your retention periods, parents' rights to review, correct, and delete their child's data, and how to contact you. Then write the direct notice to parents in plain language — it must name the specific third parties and purposes, not hide behind generalities.
4. Build the two-track consent flow
Separate the consent for operating your service from the consent for sharing data with third parties or serving targeted ads. Log both. Make withdrawing consent as easy as giving it, and make withdrawal actually stop the downstream flows — including telling vendors to delete what you sent them.
5. Lock down vendors with contracts
List every service provider, ad network, analytics tool, and platform that touches children's data. Your contracts must limit their use of the data to your stated purposes, bar them from independent reuse or monetization, and require deletion on request. A vendor whose terms permit it to keep or resell data for its own purposes is a COPPA liability sitting inside your stack.
6. Publish the retention schedule and run it
Write the retention policy the rule now requires: data categories, purposes, time limits, deletion method, and who is responsible. Put recurring deletion on a calendar — quarterly purges of expired support tickets, aged-out logs, and stale backups. Remember that deletion must reach backups and vendor copies within a reasonable time.
7. Write the security program
Document access controls, encryption, employee training, vendor vetting, and incident response for children's data specifically. Review it at least annually and after any incident or major product change.
Mistakes That Keep Showing Up
- Treating an app-store age rating as compliance. Store ratings and COPPA are separate systems. A "4+" or "Everyone" label neither satisfies nor excuses the rule's duties.
- Forgetting the SDKs. Analytics, attribution, and ad mediation kits are the most common source of undisclosed collection. Audit them with each app update, not once at launch.
- Assuming "we don't target kids" ends the inquiry. Actual knowledge and mixed-audience use pull general-audience products into scope regardless of intent.
- One checkbox for everything. Bundled consent fails the separate-opt-in requirement for disclosure and targeted advertising.
- Keeping data "just in case." Indefinite retention is now expressly prohibited. If you cannot name the purpose, delete the data.
- Ignoring state laws. Several states have enacted their own children's and teen privacy statutes with design-code duties that go beyond COPPA. Federal compliance is the floor, not the ceiling — check the states where your users live.
What Non-Compliance Costs
COPPA violations are treated as unfair or deceptive practices, and courts can impose civil penalties exceeding $50,000 per violation — with each affected child, and each distinct violation, potentially counting separately. That arithmetic is how enforcement actions have reached the tens and hundreds of millions of dollars against large platforms. Small operators rarely face headline-scale fines, but the FTC has repeatedly pursued small app developers and startups, and state attorneys general can bring their own actions. Beyond penalties, orders typically require deletion of unlawfully collected data — including any models or profiles built from it — plus years of compliance monitoring. The remediation usually costs far more than the compliance would have.
Track Compliance Like the Business Expense It Is
Every item on the checklist above costs something: consent-verification services, contract reviews, SDK audits, deletion tooling, staff time. Treat these as ordinary cost centers in your books rather than one-off surprises. Tag vendor contracts that touch children's data so renewals trigger a fresh data-use review. Log retention-schedule runs the way you log backups — a dated record that deletions happened is itself evidence of compliance. And when you budget the next feature that collects user data, price in the consent flow, the notice update, and the storage lifecycle up front, the same way you would price hosting. Privacy work that lives in your chart of accounts gets funded; privacy work that lives in good intentions gets forgotten.
Simplify Your Financial Management
As you build consent flows, retention schedules, and vendor reviews into your operations, maintaining clear financial records of that compliance spend is essential. Beancount.io provides plain-text accounting that gives you complete transparency and control over your financial data — no black boxes, no vendor lock-in. Get started for free and see why developers and finance professionals are switching to plain-text accounting.
