Governance, risk & compliance

Children's Online Privacy Protection Rule (COPPA) 16 CFR 312, amended 2025

Children's Online Privacy Protection Rule (COPPA Rule), 16 CFR Part 312, enforced by the US Federal Trade Commission.

It applies to operators of websites, apps and online services directed to children under 13, mixed audience services, and any operator with actual knowledge that it collects personal information from a child under 13, including operators outside the United States whose services are directed to children in the United States. The rule as amended on 22 April 2025 (90 FR 16918) took effect 23 June 2025, and compliance with the amendments was required by 22 April 2026.

The amendments added biometric identifiers to personal information, a definition of mixed audience services, separate parental consent for disclosures to third parties, a written information security program, a written data retention policy published in the privacy notice, new consent methods, and safe harbor reporting. Civil penalties are up to $53,088 per violation (the FTC kept its 2025 levels for 2026).

On 25 February 2026 the FTC said it will not bring COPPA cases over data collected only to verify age, if that data is used for nothing else and deleted promptly. Requirements map to the shared control library, so security work already credited to other frameworks counts here where the control is the same.

Status read 24 October 2026: the amended Rule (16 CFR Part 312, published 22 April 2025 at 90 FR 16918, effective 23 June 2025) has a full compliance date of 22 April 2026. The amendments add a separate parental consent for disclosure to third parties (312.

5(a)(2)), a written information security program (312. 8(b)), a written data retention policy that is published in the online notice (312.

10 and 312. 4(d)), biometric and government identifiers as personal information (312.

2), and new consent methods (312. 5(b)(2)(vii) to (ix)).

On 25 February 2026 the FTC issued a policy statement saying it will not enforce the Rule against certain general and mixed audience operators that collect, use or disclose personal information only to work out whether a user is a child, if six conditions are met; it stays in effect until final amendments or withdrawal. The Rule has no school authorization exception: it is separate from FERPA (see US_FERPA).

Requirements added by the amendments are mapped in the COPPA25 domain. General information, not legal advice.

How Lavawall® helps you get to Children's Online Privacy Protection Rule (COPPA) compliance

Most of Children's Online Privacy Protection Rule (COPPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Children's Online Privacy Protection Rule (COPPA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Children's Online Privacy Protection Rule (COPPA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Training courses for COPPA children's privacy

The Lavawall® training catalogue has 2 courses that cover it. Assign them to the people they apply to and keep the completion records with the rest of your compliance evidence.

• COPPA: protecting children's data online (33 min)
• Children, Students and Technology (Canada and United States) (25 min)

See these courses in the training catalogue →

Related

Lavawall® supports Children's Online Privacy Protection Rule (COPPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.