COPPA applies to operators of websites and online services that collect personal information from children under 13. The FTC lays out six steps: decide if you are covered, post a privacy policy, notify parents, get verifiable parental consent, honor parental rights, and secure the data with a retention rule.
Who is covered
The FTC says you are covered if your site or service is directed to children under 13 and you collect their personal information, or let others collect it. You are also covered if your site is general audience but you have actual knowledge that you collect personal information from children under 13.
Covered services include mobile apps, gaming platforms, plug-ins, ad networks, location services, VoIP services and connected toys.
Whether a nonprofit is covered is not answered on the FTC page we read. It defines coverage by what the service does and how it collects data. Ask the FTC at its COPPA hotline, or ask counsel, if you run a youth nonprofit and are unsure. Schools have their own rules too, so do not treat this post as a ruling for them.
The six steps
- Determine coverage. Do you run something directed to children under 13 that collects personal information?
- Post a privacy policy. Link it prominently from your homepage and wherever you collect information. List the operators collecting data, what is collected, how it is used, disclosures, a retention timeframe and parental rights.
- Notify parents directly before collecting a child's information, and again if practices materially change.
- Get verifiable parental consent before collecting, using or disclosing. Accepted methods include signed forms, payment transactions, toll-free calls with trained staff, video conferences and knowledge-based questions. Limited exceptions exist.
- Honor parental rights. Parents can review the information, revoke consent and have it deleted.
- Secure data and set retention. Keep a written security program, use providers that can protect the data with written assurances, and keep a written retention and deletion policy.
A practical angle for youth programs
Look at every form. A camp registration form, a game on your website, an app that records a child's name or voice: each is a collection point. Remove fields you do not need.
Photos and videos of children are personal information issues too. Check your consent language.
The security step is the one most missed
Step six says to keep a written security program and use only providers that can protect the data. Your vendor list and data inventory serve here. See building a data inventory.
Quick check
Is a signed paper form valid parental consent?
The FTC lists signed forms among accepted verifiable consent methods, along with payment transactions, calls with trained staff, video conferences and knowledge-based questions.
Sources
Last reviewed: 19 October 2026.
