Glossary
What is COPPA?
COPPA — the Children's Online Privacy Protection Act — is a US federal law imposing strict requirements on how apps and websites collect and handle personal data from children under 13.
What COPPA requires
Where a service is directed at children under 13, or where the operator has actual knowledge that it is collecting data from a child under 13, it must obtain verifiable parental consent before collection, disclose its practices clearly, and limit collection to what is reasonably necessary.
The two triggers matter equally. A general-audience app that becomes aware it has under-13 users acquires obligations, which is why 'we are not a kids app' is not by itself a defence.
What it means for advertising
- No behavioural advertising to children without verifiable parental consent, which is difficult enough to obtain that most services do not attempt it.
- Contextual advertising is generally permitted, since it uses no personal data.
- No persistent identifiers for advertising purposes without consent.
- SDK responsibility. An SDK collecting data in a children's app creates exposure for the app operator, which is why child-directed apps maintain restricted SDK lists.
Why enforcement matters here
COPPA has produced some of the largest privacy penalties in US history, and enforcement has repeatedly landed on services that considered themselves general-audience. The FTC has been explicit that platform-level knowledge of child users creates obligations regardless of how a service describes itself.
The practical posture for anyone operating a service with any plausible under-13 audience is to treat age signals seriously, restrict advertising to contextual where children may be present, and audit SDK behaviour rather than assuming it.
Common questions
Does COPPA apply outside the US?
COPPA is US law, and equivalent or stricter regimes exist elsewhere — the UK Age Appropriate Design Code and GDPR provisions on children's data among them. Services operating internationally generally design to the strictest applicable standard.
Can I show any advertising in a children's app?
Contextual advertising is generally permitted where it uses no personal data and does not employ persistent identifiers for advertising. Behavioural targeting is not, absent verifiable parental consent.
More in privacy and compliance
The identifiers, consent signals and rules that bound targeting.