What Business Owners Need to Know About the Children’s Online Privacy Protection Act

By: Salma Benkabbou, Esq.

The Millennial Business Lawyer®


What Business Owners Need to Know About Children’s Online Privacy Protection Act (COPPA)

Keeping kids safe online is a priority for parents and business owners alike. This is why it is important to understand and follow the rules of the Children’s Online Privacy Protection Act (COPPA). 

In a time when the internet is available to 95% of US children marketers, companies, and advertisers need to rethink their approach to engaging with users online. 

The good news is that with the right tools and strategies in place, it’s possible to preserve the internet as a space where children can socialize, learn and play – all without having to worry about potentially age-inappropriate targeting activities from advertisers. 

In this article, I will explain COPPA and what you can do as a business owner to protect children’s private information.  

What is COPPA?

COPPA was enacted by the United States Congress in 1998 and is enforced by the Federal Trade Commission (FTC). COPPA gives parents control over what information websites can collect from their kids. It puts protections in place and streamlines procedures that companies covered by the rule need to follow.  

Why is COPPA Important?

Complying with COPPA protects your organization from legal risk and shows that you are dedicated to keeping kids safe online.  

Also, since COPPA came into effect, the fines for violating children’s privacy online have become greater and greater. For instance, WW International (previously Weight Watchers) paid $1.5 million to resolve claims from the FTC that it illegally gathered the data of underage users of its Kurbo program.  

A second notable case was against the operators of the social networking app Musical.ly, now known as TikTok, which was accused of illegally withholding information of children under 13. The FTC concluded TikTok was retaining this personal information without the previous consent of the children’s parents, thus violating COPPA. The data the app was withholding included the child’s email addresses, names, and schools. Since the children’s information was public on the app, adults using TikTok were able to contact the minors. In addition, until October 2016, the app included a feature that allowed users to view other users within a 50-mile radius of their location.

TikTok, agreed to pay $5.7 million to settle Federal Trade Commission allegations that the company illegally collected personal information from children. The settlement also required the app’s operators to comply with COPPA going forward and to take offline all videos made by children under the age of 13. This is to date the largest civil penalty ever obtained by the Commission in a children’s privacy case.  

Does COPPA Apply to Your Business?

The first step to complying with this rule is to determine whether COPPA applies to your business.  

 COPPA applies to operators of websites and online services that collect personal information from kids under 13. So, you must follow COPPA if your website or services meet any of the following conditions: 

  • Your website or online service is directed to children under 13 and you collect personal information from them. 
  • Your website or online service is directed to children under 13 and you let others collect personal information from them. 
  • Your website or online service is directed to a general audience, but you have actual knowledge that you collect personal information from children under 13. 
  • Your company runs an ad network or plug-in, for example, and you have actual knowledge that you collect personal information from users of a website or service directed to children under 13. 

What Can I Do to Comply with COPPA?

If your business does meet any of these conditions, these are the steps you must follow:  

Create and Post a Clear Privacy Policy that Complies with COPPA. 

 Your privacy policy must describe how your company handles personal information collected from children online. This policy needs to be specific and explain:

  • How the information is collected
  • What information is collected
  • How the information will be used
  • If it’s shared with third parties
  • A description of parental rights

Once you prepare a privacy policy you must place a link to your policy on your homepage. It should also be placed anywhere you collect personal information from children.   

 Notify Parents About Your Information Practices  

COPPA requires that you give parents “direct notice” of your information practices before collecting information from their kids. Also, if you make a change to the practices parents previously agreed to, you have to send an updated direct notice. 

Gain Parent Consent 

Before collecting, using, or disclosing personal information from a child, you must get their parent’s verifiable consent.  According to the FTC, acceptable methods include having the parent: 

  • Use a credit card or another online payment system that provides notification of each separate transaction to the account holder;
  • Connect to trained personnel via a video conference;
  • Provide a copy of a form of government-issued ID that you check against a database, as long as you delete the identification from your records when you finish the verification process;
  • Answer a series of knowledge-based challenge questions that would be difficult for someone other than the parent to answer; or
  • Verify a picture of a driver’s license or another photo ID submitted by the parent and then compare that photo to a second photo submitted by the parent, using facial recognition technology.

 Honor Parents’ Ongoing Rights  

Parents have a right to protected information even after consent is provided. So, if a parent asks, you must: 

  • Offer them a way to review the personal information collected from their child;
  • Give them a way to revoke their consent and refuse the further use or collection of personal information from their child; and
  • Delete their child’s personal information.

What Are the Next Steps in Protecting Children’s Online Privacy?


When COPPA was first drafted there was no YouTube, TikTok, etc. With the advancements in technology occurring at a rapid pace, it is important to make sure you stay up to date with all the changes regarding COPPA.  


In addition, it’s important to be aware of state-specific regulations. For example, according to The New York Times, California will soon adopt the California Age-Appropriate Design Code Act. This measure will require sites and apps to block features that pose a risk to children, such as chat. It will also require online services to turn on the highest privacy settings by default for children. 


The California measure could apply to a wide range of popular digital products that people under 18 are likely to use including social networks, game platforms, connected toys, voice assistants, and digital learning tools for schools. The California law will take effect in 2024. In addition, Congress is working to boost online safety for children. 


The Benkabbou Law Firm, PLLC, is a boutique law firm located in Tampa, Florida. Our firm focuses on business law, immigration law, business immigration law, and intellectual property law. At our firm, we treat our clients like family and treat their interests and dreams as our own.


At the Benkabbou Law Firm, PLLC, we value keeping our clients informed of all possible problems they may face. We provide proactive legal solutions to help our clients avoid the possibility of liability, which saves our clients money, time, and resources. In uncertain times like these, we are prioritizing the long-term interests of our clients and their livelihoods. We are also help you navigate reopening your business after COVID.

To receive updates just like this, please consider subscribing to our newsletter. We skip the legal jargon and send the need-to-know updates straight to your inbox. Join our newsletter here.

DISCLAIMER: Information communicated in, to, or through this blog post and your receipt or use thereof: (1) does not create an attorney-client relationship; (2) it is not intended as a solicitation; (3) is not intended to convey legal advice or constitute legal advice; (4) and it is not a substitute for obtaining legal advice from an attorney. You should not act upon any such information without first seeking qualified professional counsel on your specific matter.