COPPA: verifiable parental consent, child-directed design, and the FTC’s 2025–26 posture

COPPA regulates online collection of personal information from children under 13 by covered operators. Personal information is broader than many product teams expect: contact details, persistent identifiers used for tracking, geolocation, photos, audio, video, and other data can fall within the rule depending on context and use.

The rule turns on both actual knowledge and whether the service is directed to children. Visual design, subject matter, characters, music, advertising, audience composition, app-store categories, and user research can matter. A product cannot simply write 13+ in a terms page while building an experience obviously attractive to younger children.

Verifiable parental consent is the center of the operating model, but it is not the only duty. Teams also need clear notices, limits on collection, parental access and deletion rights, retention discipline, data-security controls, and vendor or SDK governance. In schools, COPPA may interact with FERPA and district contract terms.

The checklist cannot decide whether your product is child-directed. That requires a candid review of audience signals, marketing channels, in-product content, monetization, and actual usage. Games, educational tools, creator platforms, and family apps often sit in mixed-audience territory where product design choices matter.

It also cannot choose a consent method. Email plus additional steps, credit-card verification, government-ID checks, signed forms, video verification, or school-authorized consent may be more or less appropriate depending on risk, data sensitivity, jurisdictional posture, and user experience. The correct answer is not always the least-friction path.

The checklist cannot resolve business tradeoffs around data minimization. Product and growth teams may want behavioral analytics, personalization, social features, or ad measurement. COPPA asks whether that collection is allowed, disclosed, consented to where required, and retained only as long as necessary. Those are product strategy decisions.

One common pitfall is the 13+ listing that does not match the product. The app-store page, cartoon design, influencer campaigns, classroom adoption, or support tickets show younger users, but the compliance posture assumes adults and teens. Regulators and partners look at reality, not only age-gate copy.

SDKs are another recurring failure. Analytics, attribution, ads, social sharing, chat, and crash-reporting tools may load before age screening or parental consent. Even when the core database avoids child profiles, persistent identifiers sent to third parties can create a COPPA problem if the service is child-directed or has actual knowledge.

Parental rights and school contexts break late. Teams build account creation but forget parent access, deletion, consent withdrawal, and support routing. In edtech, schools may authorize collection for educational purposes, but FERPA, district agreements, and commercial-use limits still need to line up with the product and vendors.

Before using the checklist, assemble product, privacy, engineering, growth, support, and sales or education partnerships. Walk through the user journey from marketing click to account deletion. Identify every data collection point, SDK call, age signal, consent screen, parent communication, school deployment, and downstream vendor.

Use the checklist to test the operating model against evidence. A completed item should point to a notice, consent record, SDK configuration, data map, parent request workflow, retention setting, vendor review, or school-contract clause. If the team cannot show the artifact, mark the item incomplete even if the intent is good.

Repeat the checklist when the audience or monetization changes. Adding ads, opening a community feature, launching in schools, changing app-store categories, or expanding analytics can alter the COPPA profile. The guide supplies judgment about those changes; the checklist turns the judgment into repeatable work.