The Children's Online Privacy Protection Act (COPPA) is a United States federal law, in effect since 2000, that governs how websites, apps, and online services collect personal information from children under 13. It is enforced by the Federal Trade Commission (FTC) through the COPPA Rule, which spells out the practical obligations: getting verifiable parental consent before collecting a child's data, posting clear privacy notices, and giving parents ongoing control over what happens to their child's information.
It is important to be upfront about what COPPA is and is not. COPPA is a privacy and data-protection law, not an accessibility law. It says nothing about screen readers, keyboard navigation, or WCAG conformance. But if your site serves children or families, the two worlds meet in practice: privacy notices, consent flows, and parental dashboards are only meaningful if the people using them — including parents and children with disabilities — can actually perceive and operate them.
This guide walks through who COPPA applies to, what it requires, how it is enforced, and where accessibility fits into a compliant children's privacy program.
Applies to under-13 data collection
COPPA covers operators of websites and online services that are directed to children under 13, or that knowingly collect personal information from children under 13 — including many that never thought of themselves as "kids' sites."
Verifiable parental consent
Before collecting, using, or disclosing a child's personal information, operators generally must obtain verifiable consent from a parent — not just a checkbox from the child.
FTC enforcement with real penalties
The FTC (and state attorneys general) enforce COPPA, and civil penalties can reach into the tens of thousands of dollars per violation, which adds up quickly across many affected children.
Privacy law, accessibility overlap
COPPA does not mandate WCAG, but consent flows and privacy notices that are unreadable by assistive technology undermine the informed, meaningful consent the law is built around.
What COPPA is and why it exists
Congress passed COPPA in 1998 in response to early-web practices of collecting names, addresses, and preferences from children through games, contests, and registration forms — often without parents ever knowing. The law took effect in 2000, and the FTC's implementing COPPA Rule has been updated since to keep pace with technology, including a significant 2013 revision that expanded the definition of personal information to cover things like persistent identifiers (cookies and device IDs used for tracking), geolocation data, photos, videos, and audio recordings of a child.
The core idea is simple: children under 13 cannot meaningfully consent to data collection, so the law puts parents in charge. Operators must tell parents what they collect and why, get consent before collecting it, and honor parents' requests to review or delete their child's information.
Who must comply
COPPA applies to operators of commercial websites and online services — including mobile apps, connected toys, and third-party services like ad networks and analytics plugins — in two situations. First, if the site or service is directed to children under 13, judged by factors such as subject matter, visual style, use of animated characters or child celebrities, music, and audience evidence. Second, if a general-audience site has actual knowledge that it is collecting personal information from a child under 13 — for example, a user enters a birthdate showing they are 9.
The law reaches beyond U.S. borders in practice: foreign-based sites and services directed to children in the United States, or knowingly collecting data from U.S. children, are expected to comply. Nonprofits are largely outside the FTC's jurisdiction under COPPA, but schools and ed-tech vendors occupy a special space — ed-tech providers frequently rely on schools to authorize collection strictly for educational purposes, and they also face FERPA obligations.
Core requirements for websites and apps
If COPPA applies to you, the COPPA Rule sets out a fairly concrete checklist of obligations:
- Post a clear, comprehensive online privacy policy describing what personal information you collect from children, how you use it, and your disclosure practices.
- Provide direct notice to parents and obtain verifiable parental consent before collecting personal information from a child, with limited exceptions (such as one-time responses to a child's request).
- Give parents the ability to review the personal information collected from their child, revoke consent, and have the information deleted.
- Do not condition a child's participation in a game, prize, or activity on disclosing more personal information than is reasonably necessary for that activity.
- Maintain the confidentiality, security, and integrity of children's data, and retain it only as long as reasonably necessary before securely deleting it.
- Vet third parties: plugins, SDKs, ad networks, and analytics tools embedded in a child-directed service can create COPPA liability for the operator hosting them.
Enforcement and penalties
The FTC is the primary enforcer, and state attorneys general can also bring actions. COPPA violations are treated as unfair or deceptive practices, and civil penalties are assessed per violation — which the FTC can count per affected child — so exposure scales fast for popular services. Penalties can reach into the tens of thousands of dollars per violation, and the FTC has secured multimillion-dollar settlements against major platforms and app developers, including cases involving video platforms, games, and ed-tech products.
Beyond fines, enforcement actions typically impose long-running compliance obligations: deleting improperly collected data, restructuring consent flows, and submitting to years of monitoring. The reputational cost of a public children's-privacy action is often the most painful part.
Practical steps toward compliance
A workable COPPA program usually starts with an honest audit of your audience and your data flows, then closes the gaps:
- Decide whether any part of your service is child-directed or likely to attract under-13 users, and document the reasoning.
- Map every point where personal information is collected — forms, chat, uploads, cookies, SDKs, and embedded third parties.
- If children are in scope, implement an age screen that does not encourage falsification, and a verifiable parental consent mechanism proportionate to how you use the data.
- Rewrite your privacy notice in plain language, and provide the direct-notice email or message parents actually receive.
- Build parent-facing controls for reviewing and deleting a child's data, and set retention limits with automated deletion.
- Review contracts and configurations for ad networks and analytics so child-directed sections do not serve behavioral advertising.
Where accessibility and WCAG fit in
COPPA never mentions WCAG, and installing an accessibility tool will not make an unlawful data practice lawful. But the law's machinery — notices, consent flows, and parental controls — is fundamentally about communication, and communication that excludes people with disabilities is a real compliance weakness. A consent form that a blind parent cannot complete with a screen reader, or a privacy notice rendered as low-contrast text in an unlabeled modal, undercuts the informed parental consent COPPA is designed to produce. Separately, if your organization is covered by the ADA or Section 508, those accessibility obligations apply to your privacy pages just like every other page.
In practice, that means building privacy notices and consent forms to WCAG 2.1 AA: proper headings and labels, keyboard operability, visible focus, sufficient contrast, and error messages that assistive technology announces. Age gates and parental dashboards deserve the same treatment. Tools like AccessWiser can help you find and fix accessibility barriers in these flows and move your site toward WCAG conformance — though no widget, on its own, can guarantee legal compliance with COPPA or any other law. Pair accessibility improvements with genuine privacy practices and, where the stakes are high, advice from qualified counsel.
Frequently asked questions
Does COPPA apply to my site if it is not made for kids?
Possibly. General-audience sites are covered when they have actual knowledge they are collecting personal information from a child under 13 — for example, through a birthdate field or user reports. If children realistically use your service, plan for it rather than ignoring it.
Is COPPA an accessibility law?
No. COPPA is a privacy and data-protection law focused on children under 13. Accessibility requirements come from laws like the ADA and Section 508 and standards like WCAG. They intersect where privacy notices, consent flows, and parental controls need to be usable by people with disabilities.
What counts as personal information under COPPA?
More than you might expect: names, contact details, and screen names, but also persistent identifiers like cookies and device IDs used to track a child over time, precise geolocation, and photos, videos, or audio recordings containing a child's image or voice.
What is verifiable parental consent?
A method reasonably designed to ensure the person consenting is actually the parent. Accepted approaches have included signed consent forms, credit-card or government-ID verification, video calls, and knowledge-based questions. The rigor expected scales with how the data will be used.
Does an accessibility widget make me COPPA compliant?
No. COPPA compliance depends on your data practices — notice, consent, parental controls, security, and retention. Accessibility tools help make those flows perceivable and operable for everyone, which supports compliance, but they cannot substitute for lawful privacy practices.
This article is provided for general information about accessibility regulations and standards. It is not legal advice — consult a qualified professional about your specific compliance obligations.