ESRB Privacy Certified
ESRB Privacy Certified is the Entertainment Software Rating Board's children's privacy certification program and an FTC-approved COPPA safe harbor (16 CFR 312.11), whose members are deemed to comply with the COPPA Rule when they meet its requirements. Built from the program's own requirements, published as Exhibit A to the FTC's 2018 approval letter: compliance reports and monitoring, the site coordinator, notice of changes, complaint handling and dispute resolution, the general and children's privacy statement disclosures and seal placement, direct notice and verifiable parental consent with its exceptions, parental access and deletion, and data collection, security and accuracy. A second layer sets out what the amended COPPA Rule (2025) now requires the program to carry: separate consent for third-party disclosure, a written information security program, a written retention policy and an expanded online notice.
ESRB Privacy Certified is a compliance framework from United States (COPPA safe harbor; participants worldwide) with 7 domains and 27 controls that map to 4 other frameworks. The largest domains are Data collection and security (section VII) – ESRB Privacy Certified (6 controls), Direct notice and verifiable parental consent (section V) – ESRB Privacy Certified (6 controls), Continuing obligations of the participant (section III) – ESRB Privacy Certified (5 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (7)
Amended COPPA Rule (2025): requirements the program must now carry – ESRB Privacy Certified
| Code | Title |
|---|---|
| esrb-privacy-certified::C25-312.10 | Written data retention policy published in the online notice (312.10) |
| esrb-privacy-certified::C25-312.4d | Expanded online notice content (312.4(d)) |
| esrb-privacy-certified::C25-312.5a2 | Separate verifiable parental consent for disclosure to third parties (312.5(a)(2) and 312.4(c)(1)(iv)) |
| esrb-privacy-certified::C25-312.8b | Written children's information security program (312.8(b) and (c)) |
Continuing obligations of the participant (section III) – ESRB Privacy Certified
| Code | Title |
|---|---|
| esrb-privacy-certified::III.A | III.A Site Coordinator |
| esrb-privacy-certified::III.B | III.B Notifying ESRB of material changes; prior approval of Privacy Statement changes; self-assessment |
| esrb-privacy-certified::III.C | III.C Notifying users of material changes |
| esrb-privacy-certified::III.D | III.D Consumer complaints and ESRB dispute resolution |
| esrb-privacy-certified::III.E | III.E Thirty-day notice of name, control or domain changes |
Data collection and security (section VII) – ESRB Privacy Certified
| Code | Title |
|---|---|
| esrb-privacy-certified::VII.A | VII.A Collect only PID that is used |
| esrb-privacy-certified::VII.B | VII.B Confidentiality, security and integrity of PID |
| esrb-privacy-certified::VII.C | VII.C Release of children's PID only to capable recipients |
| esrb-privacy-certified::VII.D | VII.D Accuracy of PID |
| esrb-privacy-certified::VII.E | VII.E User correction of material inaccuracies |
| esrb-privacy-certified::VII.F | VII.F Exit messages on links to third-party sites and apps |
Direct notice and verifiable parental consent (section V) – ESRB Privacy Certified
| Code | Title |
|---|---|
| esrb-privacy-certified::V.A | V.A Direct notice to parents before collection |
| esrb-privacy-certified::V.B | V.B Verifiable parental consent mechanisms |
| esrb-privacy-certified::V.C | V.C Email plus for internal use only |
| esrb-privacy-certified::V.D.1 | V.D.1 Exceptions: consent, one-time and multiple responses, child safety, protecting others |
| esrb-privacy-certified::V.D.2 | V.D.2 Exception: audio as a replacement for text |
| esrb-privacy-certified::V.D.3 | V.D.3 Exception: persistent identifier for internal operations only |
Parental access and control (section VI) – ESRB Privacy Certified
| Code | Title |
|---|---|
| esrb-privacy-certified::VI | VI Parental access, refusal and deletion |
Privacy statement (section IV) – ESRB Privacy Certified
| Code | Title |
|---|---|
| esrb-privacy-certified::IV.A | IV.A General Privacy Statement: the fourteen required disclosures |
| esrb-privacy-certified::IV.B | IV.B Kids Privacy Statement: the eight additional disclosures |
| esrb-privacy-certified::IV.C | IV.C Placement of the Kids Privacy Statement and the program marks |
Program documents and procedures (section II) – ESRB Privacy Certified
| Code | Title |
|---|---|
| esrb-privacy-certified::II.A | II.A Initial compliance report: implement required changes and attest |
| esrb-privacy-certified::II.B | II.B Biannual monitoring: three weeks to implement, full product access |
Your Compliance Coverage
If you comply with ESRB Privacy Certified, you already cover:
COPPA
23%
11 controls mapped
Compare →GDPR
11%
5 controls mapped
Compare →UK Age Appropriate Design Code (Children's Code)
6%
3 controls mapped
Compare →+ 1 more: PEGI - Pan European Game Information Age Rating System (4%)
See all 4 mapped frameworks ↓Maps to 4 other frameworks
Coverage is not the same as your position
This page shows what ESRB Privacy Certified overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is ESRB Privacy Certified and who does it apply to?
ESRB Privacy Certified is a compliance framework from United States (COPPA safe harbor; participants worldwide) with 7 domains and 27 controls. ESRB Privacy Certified is the Entertainment Software Rating Board's children's privacy certification program and an FTC-approved COPPA safe harbor (16 CFR 312.11), whose members are deemed to comply with the COPPA Rule when they meet its requirements. Built from the program's own requirements, published as Exhibit A to the FTC's 2018 approval letter: compliance reports and monitoring, the site coordinator, notice of changes, complaint handling and dispute resolution, the general and children's privacy statement disclosures and seal placement, direct notice and verifiable parental consent with its exceptions, parental access and deletion, and data collection, security and accuracy. A second layer sets out what the amended COPPA Rule (2025) now requires the program to carry: separate consent for third-party disclosure, a written information security program, a written retention policy and an expanded online notice. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does ESRB Privacy Certified actually require?
ESRB Privacy Certified has 27 controls organised across 7 domains. The largest domains are Data collection and security (section VII) – ESRB Privacy Certified (6 controls), Direct notice and verifiable parental consent (section V) – ESRB Privacy Certified (6 controls), Continuing obligations of the participant (section III) – ESRB Privacy Certified (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of ESRB Privacy Certified do I already cover?
ESRB Privacy Certified maps to 4 other compliance frameworks. The top mapping partners are COPPA (23% coverage), GDPR (11% coverage), UK Age Appropriate Design Code (Children's Code) (6% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement ESRB Privacy Certified?
Start your ESRB Privacy Certified compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ESRB Privacy Certified requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 27 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.
Get Started Free →Free forever, no credit card required