Here’s something a lot of young developers find out the hard way: building a free website doesn’t put you outside the law. If your site collects personal information from children under 13 — names, emails, usernames, location, literally anything — and you didn’t get verifiable parental consent first, you’re potentially looking at fines of up to $51,744 per violation under COPPA, the Children’s Online Privacy Protection Rule. (The FTC adjusts civil penalty amounts periodically for inflation, so check current figures at FTC.gov.)
Per violation. Not per website. Per individual instance.
COPPA applies to operators of websites or online services that are either directed to children under 13, or that have actual knowledge they are collecting personal information from children under 13. So even a general-audience site — one not specifically built for kids — can fall under COPPA the moment you know a user is under 13.
So what counts as “collecting data”? More than you’d think. Sign-up forms. Comment sections. Contact forms. Even just asking someone to create an account. If a kid under 13 fills it out and you stored that info without a parent’s sign-off, that’s a violation.
The FTC’s COPPA guidance does give you one partial out: if your site isn’t specifically aimed at kids and you use a neutral age-screening process (like asking users to enter their birthdate), you can generally rely on what users enter — even if some of them lie about their age. But here’s the catch: the moment you actually find out a user is under 13, COPPA kicks in immediately. You’re now required to notify parents and get their consent. You can’t just shrug and move on.
And it’s getting stricter. In January 2025, the FTC finalized new COPPA rule changes that go even further. Now covered operators need separate opt-in parental consent before sharing kids’ data with third parties for targeted advertising. There are also new limits on how long you can hold onto that data — you can only keep it as long as reasonably necessary for the specific reason you collected it in the first place.
This matters whether you’re building a school project, a hobby app, a small community forum, or something you’re hoping to turn into a business someday. “Non-commercial” is not a magic shield — though the FTC’s enforcement focus has historically centered on commercial operators, the law’s text does not carve out a blanket exemption for non-commercial sites, so don’t assume you’re safe.
The smart move is simple: if there’s any chance kids under 13 might use your site, either design it so it collects zero personal information, or build in a real age-verification step that keeps under-13 users out entirely. Don’t just slap a “you must be 13 to use this site” checkbox on a signup form and call it done — that’s not the same as a neutral age-screening system, and it won’t protect you if the FTC comes looking.