United States. Children's privacy. Act
COPPAChildren's Online Privacy Protection Act of 1998 (15 U.S.C. §§ 6501–6506)
In force
§1Summary
- Synopsis
Requires operators of websites and online services directed to children under 13, or with actual knowledge they collect data from such children, to give notice and obtain verifiable parental consent. Also imposes data security, retention and parental access obligations.
- Key themes
- Unique features
Age threshold is 13 (lower than many state laws); approved industry self-regulatory safe harbor programs can certify compliance.
- SaaS relevance
Catches ed-tech and consumer SaaS directed at children, and general-audience services that have actual knowledge of under-13 users; school-authorised consent route is narrow.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- None (security obligation only)
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- $53,088 per violation (2025 inflation-adjusted)
§3Dates
- Key dates
- Adopted
- In force
- Rule first effective 2000-04-21; amended 2013-07-01; further amended Rule effective 2025-06-23 with compliance by 2026-04-22.
§4Text and authority
- Text
- Authoritative text uscode.house.gov
- Authority
- Federal Trade Commission (FTC) and state Attorneys General
§5Where it applies
- Domestic law of
- United States
- Also applies in
- Alabama
- Alaska
- Arizona
- Arkansas
- California
- Colorado
- Connecticut
- Delaware
- District of Columbia
- Florida
- Georgia
- Guam
- Hawaii
- Idaho
- Illinois
- Indiana
- Iowa
- Kansas
- Kentucky
- Louisiana
- Maine
- Maryland
- Massachusetts
- Michigan
- Minnesota
- Mississippi
- Missouri
- Montana
- Nebraska
- Nevada
- New Hampshire
- New Jersey
- New Mexico
- New York
- North Carolina
- North Dakota
- Ohio
- Oklahoma
- Oregon
- Pennsylvania
- Puerto Rico
- Rhode Island
- South Carolina
- South Dakota
- Tennessee
- Texas
- US Virgin Islands
- Utah
- Vermont
- Virginia
- Washington
- West Virginia
- Wisconsin
- Wyoming
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Applies to foreign-operated services directed to US children.