What Is COPPA? A Parent's Guide to Kid-Safe Apps in 2026

COPPA is the Children's Online Privacy Protection Act, the 1998 federal law that bars apps and websites from collecting personal information from kids under 13 without verifiable parental consent. In 2026 the part that matters is this: the FTC's amended COPPA Rule took effect on June 23, 2025, and the compliance deadline for most of its new requirements passed on April 22, 2026 (Federal Register). Every app on your child's tablet should already be running under the stricter version.

What Is COPPA, and Who Does It Cover?

COPPA is enforced by the Federal Trade Commission under 16 CFR Part 312. It covers online services directed to children under 13, plus any general-audience service that has actual knowledge it is collecting personal information from a child under 13 (FTC).

The COPPA age 13 threshold is a data-collection line, not a maturity rating, so an app can be perfectly age-appropriate and still handle your child's data illegally. And COPPA regulates the company, not your kid: the law bars the operator from collecting without your permission, not the 10-year-old from playing.

What Changed in the 2025 COPPA Update

The FTC finalized these amendments on January 16, 2025, the first significant overhaul of children's online privacy rules since 2013 (FTC). Four changes matter most to families:

• Separate opt-in for targeted advertising, meaning operators need separate verifiable parental consent before disclosing a child's information to third parties for ad targeting.
• Hard limits on data retention: information may be kept only as long as reasonably necessary for its original purpose, and never indefinitely.
• A broader definition of personal information that now includes biometric identifiers and government-issued identifiers.
• Safe Harbor programs must publicly disclose their membership lists and report more to the agency.

What Verifiable Parental Consent Looks Like

Verifiable parental consent is not a checkbox that says "I am an adult." Any method must be reasonably calculated to ensure the person consenting is really the parent (FTC COPPA FAQ):

• A signed consent form returned by mail, fax, or electronic scan
• A credit or debit card tied to a transaction that notifies the account holder
• A call to a toll-free number staffed by trained personnel, or a video conference
• A government-issued ID checked against a database, then promptly deleted
• Knowledge-based challenge questions or facial recognition matching a photo ID to a second photo, where separately approved

A lighter option called "email plus" lets a parent reply to an email, then the operator takes a confirming step. It is permitted only when the company uses your child's data internally and never discloses it or makes it public. So if an app has public profiles or ad partners and only ever emailed you, something is wrong.

COPPA Red Flags and Green Flags in a Kids App

Run that table against whatever is already installed. A mainstream fantasy app like Yahoo or Sleeper lands in the red column on messaging and advertising before you finish scrolling; a kids product like our own LitZone should be checked against the green column just as skeptically, because a claim in the App Store description is not evidence.

How to Vet Kid-Safe Apps in Five Minutes

1. Search the privacy policy for "children" or "under 13." No children's section at all is your answer.
2. Find the consent step. If the app took your child's name, email, or photo and never contacted you, it is operating outside COPPA.
3. Check the chat defaults before your child opens the app. Communication settings left on by default were central to the FTC's largest COPPA case. If the app has no chat feature at all, as LitZone and a handful of other children's products do, there is no default to get wrong.
4. Match any certification claim to a Safe Harbor member list. The FTC approves six programs: CARU, the Entertainment Software Rating Board, iKeepSafe, kidSAFE, PRIVO, and TRUSTe (FTC). The 2025 rule requires those programs to disclose membership publicly, so a badge is now checkable.
5. Email the company and ask it to delete your child's data. COPPA gives you that right, and the reply is revealing.

Does the FTC Actually Enforce COPPA?

It does, and the penalties are not symbolic. In December 2022, Fortnite maker Epic Games agreed to a $275 million civil penalty for violating the COPPA Rule, which the FTC called the largest penalty ever obtained for violating an FTC rule; a separate order added $245 million in refunds for dark patterns, for $520 million total (FTC).

Earlier, the operators of Musical.ly, now TikTok, paid $5.7 million in February 2019 over allegations they collected names and email addresses from users under 13 without parental consent, a record at the time (FTC). Enforcement continues. Disney agreed in September 2025 to pay $10 million over mislabeled child-directed YouTube videos that let data be collected from under-13 viewers for targeted advertising (FTC).

The 2026 Age-Verification Wrinkle

On February 25, 2026, the FTC said it will not bring COPPA enforcement actions against general-audience and mixed-audience services that collect personal information solely to determine a user's age, provided they meet six conditions, including using the data only for age checks and deleting it promptly (FTC).

This is enforcement forbearance, not a rewrite of COPPA. It covers only the age-check data itself, leaves every other consent duty intact, and lasts until the Commission publishes final amendments or withdraws it. Expect more age gates this year. Age ratings are a separate signal, and what each app store rating actually means is worth knowing too.

What Good Looks Like in Practice

The strongest signal of real COPPA compliance is not a badge, it is an app designed so there is little to collect and no one to talk to. Our own platform, LitZone, is built that way for ages 8 to 13: no ads, no chat or direct messages, no comment sections, and a sign-up needing only a username plus a class code for school use. Every one of those is something you can check yourself. The same checks decide whether fantasy football is safe for kids on any sports platform.

Teachers should note that COPPA and FERPA are different laws: FERPA covers student education records held by schools, while COPPA covers commercial operators collecting data from children under 13.

Frequently Asked Questions

What is COPPA in simple terms?

COPPA is a federal law requiring apps and sites aimed at kids under 13 to get a parent's verifiable consent before collecting personal information such as names, email addresses, photos, or location. It also gives parents the right to review that data and demand its deletion. The FTC enforces it under 16 CFR Part 312.

What is the COPPA age 13 rule, and what happens when my child turns 13?

COPPA protections apply only to children under 13, which is why so many services set 13 as the minimum sign-up age. Once your child turns 13, those consent requirements no longer cover them and platforms can monetize their data far more freely. Treat that birthday as a prompt to review privacy settings, not a graduation.

How do I know if an app is COPPA compliant?

Check three things rather than trusting the printed phrase "COPPA compliant." Look for a children's section in the privacy policy, confirm the app actually asked you for consent through a real verification method, and match any certification claim against an FTC-approved Safe Harbor program, which must now disclose its membership.

Does COPPA apply to schools and classroom apps?

Yes, COPPA still applies to commercial operators used in classrooms, and FTC guidance lets schools consent on parents' behalf in limited circumstances tied to the educational purpose. The Commission considered ed-tech-specific requirements in the 2025 rulemaking and chose not to finalize them.

If your child is sports-obsessed and you would rather their screen time build reading and math skills than harvest their data, LitZone turns fantasy football into Common Core-aligned reading and math practice for grades 3 through 8, with basketball arriving in October 2026 and baseball in spring 2027. See how it works, what it collects, and how the free teacher portal handles class rosters at litzonesports.com.