COPPA (Children's Online Privacy Protection Act)

The Children's Online Privacy Protection Act (COPPA), 15 U.S.C. 6501 to 6505, and the FTC's COPPA Rule set privacy requirements for online services and children. COPPA applies to operators of websites or online services directed to children under 13, and to other operators that have actual knowledge they are collecting personal information from a child under 13. Those operators must post a clear privacy policy, give parents direct notice, obtain verifiable parental consent before collecting a child's data, let parents review and delete it, and keep it secure.

Personal information under COPPA is broad. It includes names and contact details, but also photos, voice recordings, geolocation, and persistent identifiers such as device IDs used to track a child across services. That is why apps and games that serve targeted ads to children often run into problems.

COPPA itself does not give parents a private right to sue; enforcement comes from the FTC and state attorneys general, and the civil penalties can be large. In December 2022, Epic Games agreed to pay a $275 million penalty for violating COPPA with Fortnite, part of a settlement package with the FTC that also included $245 million in refunds. Private class actions over children's data are usually brought under state privacy and consumer laws instead, often citing COPPA's standards.

See our pages on the Fortnite FTC refunds, the Google Play children's privacy settlement, and the Roblox lawsuit.