COPPA & Children's Privacy in Marketing
A different rulebook once children are the audience
The Children's Online Privacy Protection Act (COPPA) applies in the US to operators of websites or online services that are either directed at children under 13 or that have actual knowledge they're collecting personal information from children under 13 — and it imposes obligations well beyond what general marketing compliance (CAN-SPAM, standard cookie consent) requires. If a product, app, or marketing campaign's audience includes or is likely to include children under 13, the general ecommerce/email/ad-tech playbook covered elsewhere in this track does not simply apply with minor tweaks; it needs a separate compliance review, because the consent model, data collection limits, and advertising restrictions are all substantially stricter. This module describes the concepts involved; treat specific obligations, thresholds, and enforcement details as something to verify against current FTC guidance or counsel before launching anything aimed at or likely to reach children.
General marketing compliance vs. COPPA-covered services
| Dimension | General marketing (adult audience) | COPPA-covered (under-13 audience) |
|---|---|---|
| Consent model | Varies by law (opt-in or opt-out) | Verifiable parental consent generally required before collection |
| Behavioral ad targeting | Permitted with appropriate consent/disclosure | Restricted — targeted advertising to children under 13 is a major compliance risk area |
| Data minimization expectation | Best practice, varies by law | Core requirement — collect only what's reasonably necessary |
| Who must consent | The individual themselves | A parent or guardian, verified through an approved method |
| Retention expectation | Policy-driven | Delete when no longer reasonably needed for the stated purpose |
What "directed at children" actually covers
COPPA's scope isn't limited to products explicitly labeled for kids — regulators look at factors like subject matter, visual design, use of child-oriented characters or language, and audience composition data a service may already have, to determine whether a site or app is "directed at children" even if its terms of service say it's for adults. A general-audience platform that turns out to have actual knowledge a meaningful portion of its users are under 13 (through self-reported age data, for instance) can also trigger COPPA obligations for that portion of its user base, separate from whether the whole platform was designed with children in mind. This is a fact-specific determination, not a simple labeling exercise, and it's a frequent point of enforcement action against platforms that assumed a general audience meant no obligation existed.
Age-gating alone is not a compliance strategy
Before launching a product, app, or campaign with any plausible
reach to under-13 users:
[ ] Review audience: is the product/content directed at children,
even partially, by subject matter, design, or characters?
[ ] Check existing user data: any signal a meaningful share of
users are under 13?
[ ] If yes to either: route to legal/compliance review BEFORE
launch, not after
[ ] Data collection limited to what's reasonably necessary for
the stated activity, nothing speculative "for later use"
[ ] No behavioral/targeted advertising directed at identified
under-13 users
[ ] Verifiable parental consent mechanism in place before any
personal information is collected from a child
[ ] Clear, parent-facing privacy disclosure describing exactly
what is collected and why
[ ] Defined deletion process once data is no longer neededVerifiable parental consent, conceptually
The core mechanism COPPA relies on is that a parent, not the child, has to affirmatively consent before most personal information is collected, and that consent has to be obtained through a method reasonably designed to confirm the person consenting actually is the parent (approaches used in practice have included things like verified payment methods, signed consent forms, or video-call verification, among others recognized over time). Exactly which methods qualify, and what's required for lower-risk uses like internal operations versus third-party disclosure, has been refined by regulators over the years — this is a core area to confirm against current guidance rather than assume, since getting the consent mechanism wrong undermines the entire compliance structure built on top of it.
Illustrative data-practice risk tiers (concept, not a legal ruling)
| Practice | Relative risk level | Why |
|---|---|---|
| Collecting only what's needed for a stated activity, deleted after | Lower | Aligns with data minimization expectations |
| Collecting broad profile data for undefined future use | Higher | Exceeds reasonably necessary scope |
| No behavioral ad targeting to child users | Lower | Avoids a frequently scrutinized practice |
| Third-party ad SDKs collecting data without clear consent flow | Higher | A common source of enforcement — operator is responsible for third-party conduct on its platform |
Third-party tools are the operator's responsibility too
What's next
Children's privacy is one audience-specific compliance layer; accessibility is another dimension that touches nearly every marketing surface a brand builds. Next: WCAG Accessibility for Marketing Sites →
I build these systems professionally.
Whether it's a RAG pipeline, analytics migration, or AI workflow — let's talk.