COPPA

What it is

The Children's Online Privacy Protection Rule, enforced by the FTC since 2000 and substantially updated in early 2025. Requires operators of child-directed services (or those with actual knowledge of users under 13) to post a clear privacy policy, provide notice and obtain verifiable parental consent before collecting personal information, and now opt-in parental consent specifically for third-party advertising and data sharing.

Why it matters

FTC penalties are up to $51,744 per violation (per child) and the agency has shown it will pursue eight- and nine-figure settlements (TikTok, YouTube, Epic). The 2025 rule expands 'personal information' to cover biometric and government-issued identifiers.

Who it applies to

U.S. sites directed at children under 13, and any general-audience site with actual knowledge it is collecting from children.

• Jurisdictions: United States

How WQI scores it

Web Quality Index considers this standard satisfied when all of the 3 supporting factors pass.

0 of 3 supporting factors are currently collected. Sites where the remaining 3 haven't been measured will show as partial or unknown on this standard until the data lands.

Related standards

See also

CCPA

Standards that share factors with this one

Auto-computed from overlapping factor tickets in satisfiedBy, excluding standards already listed under "See also" above. Strong overlap suggests these standards rise and fall together when sites are scored.

• Australian Privacy Act + APPs 3 shared factors Privacy Australia's federal privacy law, anchored on the 13 Australian Privacy Principles. The 2024 reforms added a statutory tort for serious privacy invasions and direct OAIC penalty powers.
• Colorado Privacy Act 3 shared factors Privacy Colorado's CCPA-shaped privacy law, with a hard requirement to honour Universal Opt-Out Mechanisms like Global Privacy Control as of July 2024.
• Connecticut Data Privacy Act 3 shared factors Privacy Connecticut's CCPA-shaped privacy law. Like Colorado, recognises Global Privacy Control as a valid opt-out signal — and the AG has been actively issuing cure notices since 2023.
• GDPR 3 shared factors Privacy If a single EU resident can see your site, GDPR can apply. Cookie consent, a real privacy policy, and not silently tracking by default are the visible signs of compliance.
• HIPAA 3 shared factors Privacy If your site collects, displays, or transmits protected health information, HIPAA applies. A privacy policy plus an explicit Notice of Privacy Practices and a clear consent flow are the minimum visible signals.

Other references

• regulation eCFR — 16 CFR Part 312
• guidance FTC — COPPA Six-Step Compliance Plan
• regulation Federal Register — 2025 COPPA Rule final amendments