COPPA: when the visitor is under 13.
If a site is aimed at children, the Children’s Online Privacy Protection Act requires verifiable parental consent before collecting their data, and tracking carries elevated regulatory and reputational risk.
The law in brief.
Children’s Online Privacy Protection Act (15 U.S.C. §6501–6506) and the FTC’s COPPA Rule
The FTC and state attorneys general
No
Civil penalties of up to $53,088 per violation (FTC inflation-adjusted amount)
Verifiable parental consent before collecting data from children under 13
What creates the exposure.
Children’s-services widgets and frameworks
Advertising tracking on child-directed pages
Tracking & Advertising →
Collection without age screening
Signs the audience is young.
Report indicators
Risks tied to this law
- Children’s-services widget detected
- Advertising tracking on child-directed pages
Children’s-services widget detected
Example finding. Vendor names are withheld.
How to respond.
“Is any part of the site directed at children under 13?”
“How are visitors age-screened, and how is parental consent collected?”
“Confirm age screening and verifiable parental consent, or remove tracking from child-directed pages, verified by CyRisk rescan.”
Regulatory coverage terms; refer where the site is child-directed.
Keep exploring.
Exposure families behind this law
Other laws
Does a COPPA hit mean the site is child-directed?
Not necessarily. It means the scan found signs worth asking about before you indicate.
Who enforces COPPA?
The FTC and state attorneys general. There is no private right of action.
What about education platforms?
They often warrant the same questions, alongside student-privacy rules.
Ask the right questions about young audiences.
Send five past submissions you’ve already bound, conditioned or declined. We score them blind, then put our disposition next to the call you made.
Severity and placement shown are CyRisk defaults and can be tuned per account. A detected exposure indicates a fact pattern common to privacy litigation, not a confirmed violation. Litigation theories explain why a finding is tracked; they are not legal advice.