COPPA (Children’s Online Privacy Protection Act)
The US law on collecting personal data from children under 13: sites and apps aimed at kids need verifiable parental consent first.
The FTC enforces it through the COPPA Rule. The amended rule took effect on June 23, 2025, with most obligations due by April 22, 2026: separate consent before sharing children’s data with third parties such as ad networks, a written security program and limits on how long data is kept. It applies to services directed at children and to general ones that know a user is under 13.
Related terms
- GDPR: The EU regulation on personal data: lawful basis, minimal data, user rights and breach reporting, for anyone handling EU residents’ data.
- Data processing agreement (DPA): The contract GDPR requires when a vendor processes personal data on your behalf: what, why, how it is protected, who else gets it.
- Session replay: A reconstruction of what a user saw and did on a site: clicks, scrolls, page changes and errors, played back like a video.
