COPPA
The U.S. law that makes many child-directed services get a parent's permission before collecting data from a child under 13.
What it is
COPPA is the U.S. children's privacy law behind the parental-consent flow in products for kids under 13. Its Rule covers operators of commercial websites and online services directed to children, plus general-audience services that have actual knowledge they are collecting personal information from a child under 13. Personal information reaches past names and email addresses to persistent identifiers, precise geolocation, photos, videos, and audio containing a child's image or voice.
Reach for a COPPA review before launching a child-directed feature or whenever your service learns that a user is under 13. The core work is a clear children's privacy notice, direct notice to the parent, verifiable parental consent before collection unless a narrow exception applies, reasonable security, parental access and deletion, and a retention limit.
Gotcha: an 'I am 13' checkbox is not a parental-consent system. A neutral age screen can help route users, but collecting a child's email, device identifier, or voice before the consent gate may already be collection. Advertising and analytics SDKs count too; their identifiers do not become harmless because a third party receives them. That was the heart of the FTC and New York Attorney General case Google and YouTube settled for $170 million in 2019 over persistent identifiers served on child-directed channels.
Ask AI for it
Build a COPPA intake and verifiable-parental-consent flow for the product below against the FTC COPPA Rule in 16 CFR Part 312. Start with a neutral age screen, block every optional SDK and persistent identifier for users under 13, send the required direct notice to the parent, and collect only the parent's contact information until consent is complete. Implement a small refundable card transaction with the Stripe PaymentIntent API as one consent method, store the notice version, method, timestamp, parent identity evidence, and exact data uses approved, and give the parent authenticated access to review, revoke, and delete the child's data. Add failure states, retention limits, an SDK inventory, and tests proving no analytics or ad request fires before consent.