COPPA Compliance Checklist Template

Yes. However, the FTC allows schools to provide consent on behalf of parents when the personal information is used for educational purposes. Schools must be informed about data practices and must provide written authorization. This "school consent" does not extend to commercial purposes. If you use student data for advertising, marketing, or any non-educational purpose, separate parental consent is required.

COPPA defines personal information broadly. It includes obvious identifiers (name, address, email, phone) but also photos, videos, audio files containing a child's voice, geolocation data, and persistent identifiers like cookies and device IDs when used for purposes other than internal operations. Screen names that allow direct contact also qualify. Product teams often miss that analytics cookies and device fingerprints are personal information under COPPA.

Age-gating alone does not exempt you from COPPA if your product is "directed to children" based on its content, design, and audience. If the product's subject matter, characters, activities, and design clearly appeal to children, COPPA applies regardless of an age gate. For general-audience products (like social media), age-gating creates a "mixed audience" classification. You must still apply COPPA protections to users you identify as under 13. For guidance on designing age-appropriate product features, the [glossary entry on product requirements](/glossary/acceptance-criteria) covers how to document audience-specific constraints.

The FTC allows industry groups to create self-regulatory "Safe Harbor" programs. Participants in approved programs (kidSAFE Seal, CARU COPPA Safe Harbor, iKeepSafe, ESRB Privacy Certified, TRUSTe/TrustArc COPPA) follow the program's guidelines, which must be at least as protective as the COPPA Rule. Safe Harbor membership provides some liability protection (the Safe Harbor program is the first point of enforcement, not the FTC directly). It is not a guarantee against FTC action, but it demonstrates good faith.

The FTC proposed updates in 2024 that would eliminate most uses of targeted advertising to children, require separate opt-in consent for disclosing data to third parties, limit data retention to what is necessary, and require COPPA compliance from ed-tech companies even when operating under school consent. While not yet finalized, product teams should plan for these stricter requirements now rather than scrambling to comply after the final rule is published. ---