Say you’re building an app, a game, a forum, a fan site — something cool that kids might use. You add a signup form. Maybe you collect emails, usernames, or location data. Totally normal stuff for any website, right?
Here’s the thing: if any of those users are under 13, you just stepped into federal law territory.
The law is called COPPA — the Children’s Online Privacy Protection Rule. It’s enforced by the FTC (Federal Trade Commission), which is basically the government agency that keeps businesses from doing shady stuff to consumers. COPPA covers two types of sites: ones that are specifically aimed at kids under 13, and any other site where the operator actually knows they’re collecting personal info from someone under 13. So “my site isn’t for kids” doesn’t automatically let you off the hook if you know kids are using it.
The core rule is simple: before you collect any personal information from a child under 13, you need verifiable parental consent. Not just a checkbox that says “I’m over 13.” Actual, verifiable consent from a parent.
What counts as personal information? Things like names, email addresses, phone numbers, home addresses, photos, videos, audio recordings, geolocation data, and more. It’s a pretty wide net.
If you get it wrong — or just ignore it — the FTC can come after you. Civil penalties can reach up to $51,744 per violation (a figure that is periodically adjusted for inflation). And “per violation” can mean per user, per instance of data collection. That number adds up terrifyingly fast.
The FTC has a six-step compliance plan specifically written to help website operators figure out if COPPA applies to them and what to do about it. If you’re building something and there’s any chance kids under 13 will use it, that guide is worth reading before you launch — not after.
One practical option the FTC mentions: you can offer different features or experiences to users based on their age. So if someone says they’re under 13, you can give them a limited version of your site that doesn’t collect personal data, rather than collecting that data without parental consent. That’s a real, legal workaround that a lot of developers use.
Bottom line — this isn’t the kind of thing you can figure out later. Get it right before you collect a single piece of data.