COPPA
The US Children's Online Privacy Protection Act and the FTC's COPPA Rule (16 CFR Part 312) as amended in 2025, in force since June 23, 2025 with compliance required by April 22, 2026: for operators of child-directed services, or those that know they collect from children under 13, the duties of notice, verifiable parental consent (with separate consent for third-party disclosure), parental review and deletion, data minimisation, a written information security program, a written retention policy, and the obligations of FTC-approved safe harbor programs. Built from the eCFR text and the statute.
COPPA is a compliance framework from United States (federal; FTC and state attorneys general) with 5 domains and 17 controls that map to 7 other frameworks. The largest domains are Parental rights, security and retention (312.6 to 312.10) – COPPA (5 controls), Notice (312.4) – COPPA (4 controls), Verifiable parental consent (312.5) – COPPA (4 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (5)
Notice (312.4) – COPPA
| Code | Title |
|---|---|
| coppa::312.4(a) | § 312.4(a) General principles of notice |
| coppa::312.4(b) | § 312.4(b) Direct notice to the parent |
| coppa::312.4(c) | § 312.4(c) Content of the direct notice |
| coppa::312.4(d) | § 312.4(d) Notice on the website or online service |
Operator coverage and audience determination – COPPA
| Code | Title |
|---|---|
| coppa::312.2-mixed | § 312.2 Mixed audience services: neutral age screening before collection |
Parental rights, security and retention (312.6 to 312.10) – COPPA
| Code | Title |
|---|---|
| coppa::312.10 | § 312.10 Data retention and deletion |
| coppa::312.6 | § 312.6 Right of parent to review personal information provided by a child |
| coppa::312.7 | § 312.7 Prohibition against conditioning participation |
| coppa::312.8(a)-(b) | § 312.8(a) and (b) Reasonable security and a written information security program |
| coppa::312.8(c) | § 312.8(c) Service providers and third parties |
Safe harbor programs (312.11) – COPPA
| Code | Title |
|---|---|
| coppa::312.11(b)-(c) | § 312.11(b) and (c) Criteria and application for safe harbor approval |
| coppa::312.11(d) | § 312.11(d) Safe harbor reporting, recordkeeping and public member list |
| coppa::312.11(e)-(g) | § 312.11(e) to (g) Guideline modifications, triennial review and the 2025 conformity deadline |
Verifiable parental consent (312.5) – COPPA
| Code | Title |
|---|---|
| coppa::312.5(a)(1) | § 312.5(a)(1) Verifiable parental consent before collection, use or disclosure |
| coppa::312.5(a)(2) | § 312.5(a)(2) Separate consent for disclosure to third parties |
| coppa::312.5(b) | § 312.5(b) Methods for verifiable parental consent |
| coppa::312.5(c) | § 312.5(c) Exceptions to prior parental consent |
Your Compliance Coverage
If you comply with COPPA, you already cover:
ESRB Privacy Certified
29%
11 controls mapped
Compare →GDPR
16%
6 controls mapped
Compare →CCPA/CPRA
8%
3 controls mapped
Compare →+ 4 more: Connecticut Data Privacy Act (CTDPA) (5%), ISO 13485:2016 (3%)
See all 7 mapped frameworks ↓Maps to 7 other frameworks
Coverage is not the same as your position
This page shows what COPPA overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is COPPA and who does it apply to?
COPPA is a compliance framework from United States (federal; FTC and state attorneys general) with 5 domains and 17 controls. The US Children's Online Privacy Protection Act and the FTC's COPPA Rule (16 CFR Part 312) as amended in 2025, in force since June 23, 2025 with compliance required by April 22, 2026: for operators of child-directed services, or those that know they collect from children under 13, the duties of notice, verifiable parental consent (with separate consent for third-party disclosure), parental review and deletion, data minimisation, a written information security program, a written retention policy, and the obligations of FTC-approved safe harbor programs. Built from the eCFR text and the statute. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does COPPA actually require?
COPPA has 17 controls organised across 5 domains. The largest domains are Parental rights, security and retention (312.6 to 312.10) – COPPA (5 controls), Notice (312.4) – COPPA (4 controls), Verifiable parental consent (312.5) – COPPA (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of COPPA do I already cover?
COPPA maps to 7 other compliance frameworks. The top mapping partners are ESRB Privacy Certified (29% coverage), GDPR (16% coverage), CCPA/CPRA (8% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement COPPA?
Start your COPPA compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about COPPA requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 17 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required