← Global Privacy Laws Research Library
16 CFR Part 312; 15 U.S.C. 6501-6506
Children’s Online Privacy Protection Rule (COPPA Rule)
Prepared by Shubhank Suman · Last reviewed
Status not verified beyond supplied text
- Legal character
- Federal regulation
- Region
- North America
What it covers
Covered child-directed online services and actual-knowledge situations involving under-13 children’s personal information. Requires notices, verifiable parental consent, parent controls, collection limitation, security, purpose-limited retention and safe-harbour oversight.
Why it matters
The supplied rule includes the 2025 revisions, including biometric identifiers and stronger programme/retention requirements. It is not a universal under-18 privacy rule and does not make every online collection subject to identical consent rules.
Refer to it when
Research children’s apps, games, online identifiers, voice/biometric processing, parental consent, third-party disclosure or data retention.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: High
AI
HIGH RELEVANCE
Biometric recognition, voice data and personal-information use by AI tools can engage the rule; not a general AI law.
Privacy
VERY HIGH RELEVANCE
Under-13 online privacy and parent control.
Cybersecurity
HIGH RELEVANCE
Written security programme and provider safeguards.
Applicability
Operators and collections meeting the rule’s child-directed, mixed-audience, actual-knowledge and commercial coverage definitions and relevant exceptions.
Read first
§§ 312.2-.5 → .6-.8 → .10 → .11 where a safe harbour is used.
Provisions / sections covered
§§ 312.1-.4 - Coverage, definitions and notices
Child means under 13. Mixed-audience and actual-knowledge tests matter. Personal information includes persistent and biometric identifiers. Direct parent and online notices describe collection/use/disclosure and retention practices.
§ 312.5 - Verifiable parental consent
Prior consent is required subject to enumerated exceptions. Separate third-party disclosure consent is required unless disclosure is integral to the service. Read each verification method and narrowly defined exception rather than assuming a blanket exemption.
§§ 312.6-.7 - Parent control and minimisation
Parent review/deletion/refusal rights and identity safeguards; participation cannot require more personal information than reasonably necessary.
§§ 312.8 and 312.10 - Security and retention
Written security programme, responsibility, risk assessment/evaluation and provider assurances. Retention is limited to the specific collection purpose; indefinite retention is prohibited and secure deletion/retention policies are required.
§§ 312.9 and 312.11-.13 - Enforcement and safe harbours
Enforcement arrangements, approval/oversight of safe harbours, voluntary approval and severability. Safe-harbour deadlines are not universal operator compliance dates.
Subject-matter tags
- Consent
- Children's data
- Erasure and deletion
- Biometrics
- Retention
- Enforcement and penalties
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.