Children’s Online Privacy Protection Act (“COPPA”):[1] COPPA and its related Rule protect the privacy of children under the age of 13 including by making it unlawful for websites and online services to collect personal information from children under 13 without first obtaining the verifiable consent of the child’s parent. COPPA governs the collection, access to, and use of a child’s personal information, including by imposing data security obligations.

Read the full text of COPPA and the COPPA Rule. 

Overview Children’s Online Privacy Protection Act (“COPPA”)

This overview is for informational purposes only and is not legal advice. Please consult your attorney if you have specific legal questions. Texas law prohibits the Office of the Attorney General from providing legal advice, opinions, or representation to private individuals.

Operators of commercial websites or online services that are directed to children under 13 or operators of sites and services who have actual knowledge that they are collecting or maintaining personal information from a child under 13 are covered by the COPPA and its related Rule and must:

  • Post a clear and comprehensive online privacy policy describing their information practices for personal information collected online from children and include in that policy: 
    • The name, address, telephone number, and email address of all operators collecting or maintaining personal information through the site or service (or, after listing all such operators, provide the contact information for one that will handle all inquiries from parents);
    • A description of what information the operator collects from children, including whether the operator enables children to make their personal information publicly available, how the operator uses such information, and the operator’s disclosure practices for such information; and
    • The procedure a parent can use to review or request deletion of the child’s personal information and refuse to permit its further collection or use. 
  • Provide direct notice to parents and obtain verifiable parental consent, with limited exceptions, before collecting personal information online from children;
  • Give parents the choice of consenting to the operator’s collection and internal use of a child’s information, but prohibiting the operator from disclosing that information to third parties; 
  • Provide parents access to their child's personal information to review and/or have the information deleted;
  • Give parents the opportunity to prevent further use or online collection of a child's personal information;
  • Maintain the confidentiality, security, and integrity of personal information they collect from children, including by taking reasonable steps to release such information only to parties capable of maintaining its confidentiality and security;
  • Retain personal information collected online from a child for only as long as is necessary to fulfill the purpose for which it was collected and delete the information using reasonable measures to protect against its unauthorized access or use; and
  • Not condition a child’s participation in an online activity on the child providing more information than is reasonably necessary to participate in that activity. 

Key Definitions

COPPA defines “Personal Information” to include:

  • First and last name;
  • A home or other physical address including street name and name of a city or town;
  • Online contact information;
  • A screen name or username that functions as online contact information;
  • A telephone number;
  • A Social Security number;
  • A persistent identifier that can be used to recognize a user over time and across different websites or online services;
  • A photograph, video, or audio file, where such file contains a child’s image or voice;
  • Geolocation information sufficient to identify street name and name of a city or town; or
  • Information concerning the child or the parents of that child that the operator collects online from the child and combines with an identifier described above.

Enforcement:

  • The Federal Trade Commission and State Attorneys General are authorized to enforce COPPA and its related Rules. State Attorneys General may seek injunctive relief and damages, restitution, or other compensation on behalf of residents of the state. 

File a complaint regarding children’s privacy with the Texas Attorney General.

[1] 15 U.S.C. §§ 6501–6505.