There’s a federal law called COPPA — the Children’s Online Privacy Protection Act — and it’s specifically designed to protect kids under 13 online. The Federal Trade Commission (FTC), which is the government agency that polices unfair business practices, enforces it.
COPPA applies in two situations: when a website or app is directed at children under 13, or when a company has actual knowledge that it’s dealing with a child under 13. In either case, the company generally cannot collect that child’s personal information without first getting verifiable parental consent. That means a real, confirmed yes from a parent — not just clicking through some terms of service. There are some limited exceptions spelled out in the law, but the default rule is: no collection without parental consent.
Here’s why that matters: ‘personal information’ includes things like your name, your location, your email address, photos, and more. Companies collect this stuff all the time to build profiles, run ads, and — as the FTC put it directly — monetize kids’ data. COPPA puts a wall in front of that. If a company is covered by COPPA and skips the parental consent step, they’re breaking federal law.
Parents also have ongoing rights under this law — not just a one-time checkbox. According to the FTC, parents have the right to review what personal information has been collected from their child, and they have the right to require operators (meaning the companies running the websites or apps) to delete that personal information. So it’s not just about blocking collection upfront — parents can go back and demand a cleanup.
If you’re under 13 and a site seems to be collecting your info without your parent knowing, that’s worth flagging to a parent or trusted adult. And if you’re a parent reading this — you have real legal power here. You can contact the company directly and exercise your right to have your child’s data deleted. The FTC is also the place to report companies that aren’t following the rules at ftc.gov.