COPPA compliance for ecommerce: protecting children's privacy online

The Children's Online Privacy Protection Act has been federal law since 1998. For most of its life it was enforced lightly. That changed. In December 2022 the FTC fined Epic Games $520 million for COPPA violations related to Fortnite, the largest privacy enforcement action in FTC history. A separate $275 million fine covered dark patterns used to trick players into purchases. Together they sent a message to every company that touches children online: the FTC is serious.

Ecommerce stores in categories like children's clothing, toys, educational products, family gear and youth sports equipment have significant COPPA exposure. Many operators do not realize the law applies to them or underestimate what it requires. This guide covers the key requirements, the 2024 rule updates and the practical steps stores need to take.

What COPPA requires

COPPA applies to operators of websites or online services directed to children under 13, and to operators of general audience sites that have actual knowledge they are collecting personal information from children under 13. Stores operating across multiple US state privacy jurisdictionsface additional children's data obligations beyond federal COPPA. For covered operators, COPPA requires:

• Verifiable parental consent. Before collecting, using or disclosing personal information from a child under 13, the operator must obtain verifiable parental consent. Not just a checkbox. Actual verification that a parent has authorized the collection.
• Clear privacy notice. A prominent privacy policy describing what information is collected from children, how it is used and whether it is disclosed to third parties.
• Direct notice to parents. Before collecting a child's data, direct notice to parents of the specific information collected and how it will be used.
• Right to review and delete. Parents must be able to review their child's personal information and request its deletion at any time.
• Data minimization. Operators may only collect what is reasonably necessary for the child to participate in the activity.
• Reasonable data security. Personal information collected from children must be protected with reasonable data security procedures.

Which ecommerce stores are affected

The threshold question is whether your site is "directed to children." The FTC applies a totality of the circumstances test. Factors include:

• Subject matter: does your product category inherently attract children?
• Visual content: do you use animated characters, bright primary colors or imagery that appeals to children?
• Music or audio: do you use music or audio content that appeals to children?
• Animated characters or child celebrities: are these featured prominently?
• Advertising directed to children: does your advertising on third-party platforms target children?
• Actual audience composition: what share of your actual visitors or customers are under 13?

A toy store clearly sells products to children. A children's clothing brand targets parents, but children may be the end user and the visual design may appeal to children directly. A school supplies store straddles the line. There is no bright-line rule. When in doubt, the FTC expects you to apply COPPA protections.

The "actual knowledge" standard also catches general audience stores. If a child under 13 provides information indicating their age during account creation or checkout, and your store proceeds to collect their data, you now have actual knowledge. At that point COPPA obligations attach.

What counts as personal information under COPPA

COPPA's definition of personal information is broader than many operators expect:

• First and last name
• Home or physical address, including street and city or town
• Online contact information including email address
• Telephone number
• Social security number
• Persistent identifier that can be used to recognize a user over time and across different sites or online services (this includes cookies, device fingerprints and IP addresses in many contexts)
• Photograph, video or audio file containing a child's image or voice
• Geolocation information precise enough to identify street name and city
• Information about the parent or other person about the child

The persistent identifier definition is important for ecommerce analytics. A tracking cookie that identifies a returning visitor across sessions is a persistent identifier. If your site uses analytics cookies and is directed to children, those cookies constitute personal information collection from children under COPPA. The same risk applies to email marketing platforms that set persistent identifiers when children interact with signup forms or order confirmation flows.

The 2024 FTC rule changes

The FTC finalized significant amendments to the COPPA Rule in 2024. These updates reflect the way online services have evolved since the original 2013 rule revision. Key changes:

• Stricter data retention limits. Operators can only retain children's personal information for as long as reasonably necessary to fulfill the specific purpose for which it was collected. The rule now explicitly prohibits retaining data to support indefinite future uses.
• Stronger data security requirements. The rule now requires specific security practices and ongoing review of data security procedures.
• Education technology restrictions. Schools can authorize operators to collect children's data for educational purposes only, with restrictions on commercial use.
• Push notification consent. Explicit parental consent is now required before using persistent identifiers to serve targeted advertising to children. This directly affects retargeting and behavioral advertising on children's platforms.
• Internal use restrictions. Even for internal analytics and product improvement, operators must clearly disclose how they use children's data and cannot use it for purposes beyond those disclosed.

Actual knowledge vs constructive knowledge

The distinction matters for general audience stores. Actual knowledge is clear: a child tells you their age is 10 during checkout. Constructive knowledge is more contested: your store sells only children's clothing in sizes 4-12, so you should know your customers include children.

Courts and the FTC have generally not imposed COPPA liability based purely on constructive knowledge. The standard is actual knowledge for general audience sites. But "actual knowledge" can be triggered in subtle ways. If your checkout form allows any age to be entered and a child enters theirs, and you do not screen for it, you have created a mechanism for acquiring actual knowledge.

The safer approach for stores in child-adjacent categories is to implement age screening before data collection begins, rather than relying on not having actual knowledge.

Age screening mechanisms

Age screens are the most common mechanism stores use to manage COPPA risk. The FTC has provided guidance on what constitutes an adequate age screen:

• Age gate. Ask for date of birth before account creation or checkout. If the user enters a date indicating they are under 13, redirect them and do not collect their data. Do not allow re-entry of a different age on the same session.
• Age-appropriate privacy flow. For users who indicate they are under 13, collect only what is necessary, obtain parental consent before proceeding and do not set tracking cookies.
• Neutral age screen. The screen should not signal which answer is the "right" one. Do not pre-fill a date indicating an adult age. Do not use design elements that encourage users to enter a false age.

A birthday field that defaults to a date making the user appear 25 years old is not a neutral age screen. The FTC has called out this pattern specifically.

Verifiable parental consent methods

COPPA requires verifiable parental consent, not just a checkbox from the child. Acceptable methods under the FTC rule include:

• Signed consent form delivered by postal mail, fax or electronic scan
• Credit or debit card transaction (used for verification, not just payment)
• Phone call with a trained staff member
• Video conference with a trained staff member
• Government-issued ID verification checked against a database
• Email from the parent followed by a confirmation step that verifies it came from the parent

For ecommerce contexts, the credit card verification method is most practical. A small charge to the parent's card (which is then refunded) is an acceptable verification mechanism. The logic is that children generally do not have their own credit cards with billing authority.

Note that a simple "I am a parent and I consent" checkbox is not sufficient. The FTC requires actual verification.

COPPA safe harbor programs

The FTC approves industry self-regulatory programs that provide operators with a COPPA safe harbor. Operators that adhere to an approved program's guidelines are deemed compliant with COPPA. Approved programs include kidSAFE, PRIVO and TRUSTe (now TrustArc).

Safe harbor membership provides two benefits. First, it provides a compliance framework with detailed implementation guidance. Second, it provides enforcement protection: the FTC will generally defer to the safe harbor program's oversight rather than bringing direct enforcement actions against compliant members.

For ecommerce stores with significant children's audiences, safe harbor program membership is worth considering. Annual fees typically run $1,000 to $10,000 depending on revenue size. That is inexpensive insurance against FTC enforcement.

FTC enforcement examples

The Epic Games settlement in December 2022 is the most prominent example. The FTC found that Epic had collected personal information from children under 13 who played Fortnite without verifiable parental consent. It also found that Epic used dark patterns to trick children and teens into making unintended purchases. The $520 million settlement included $275 million for the dark patterns violations and $245 million in refunds.

Other significant COPPA actions include:

• Musical.ly (TikTok), 2019: $5.7 million for collecting personal information from children without parental consent. At the time the largest COPPA fine in FTC history.
• YouTube, 2019: $170 million to settle allegations that YouTube collected personal data from children watching child-directed channels without parental consent.
• Idol Kids, 2021: $1 million for a children's app that collected precise geolocation data without parental consent.
• OpenX Technologies, 2021: $2 million for a real-time bidding platform that collected personal information from children without parental consent via child-directed apps.

The trend is clear: fines are increasing and the FTC is willing to pursue companies of all sizes.

Practical steps for ecommerce stores selling children's products

• Assess your COPPA exposure. Review your product categories, site design and actual audience composition. If children under 13 are likely visitors or users, assume COPPA applies.
• Implement a neutral age screen. Place it before account creation and, if your product category warrants it, before checkout. Do not pre-fill ages or signal the expected answer.
• Audit your tracking. Identify every cookie, pixel and tracking script that fires on your site. Ensure none collect persistent identifiers from children without parental consent. Consider blocking all non-essential tracking for users who indicate they are under 13.
• Update your privacy policy. Add a children's privacy section specifically addressing COPPA. See our guide on ecommerce privacy policies for what else to include. Describe what data you collect from children, how you use it and how parents can review or delete it.
• Build a parental consent flow. If your site allows children to create accounts or participate in activities, implement a verifiable consent mechanism before data collection.
• Limit data retention. Define and document how long you retain data collected from children. Do not retain it beyond what is necessary for the specific collection purpose.
• Train customer service staff. Staff should know how to handle parental requests to review, correct or delete their child's data. Responses must happen within a reasonable time.
• Consider safe harbor membership. For stores with significant children's audiences, formal safe harbor participation provides compliance structure and enforcement protection.

COPPA vs GDPR for children

GDPR Article 8 sets the age of digital consent at 16, with member states allowed to lower it to 13. The UK GDPR sets it at 13. For services directed at children below the age of digital consent, controllers must obtain consent from the child's parent or legal guardian.

GDPR's children's data protections are in some ways broader than COPPA. The UK's Age Appropriate Design Code (Children's Code) goes further still, requiring that online services used by children be designed with children's best interests as a primary consideration. EU member states are implementing similar frameworks.

Ecommerce stores with both US and EU customers need to satisfy both COPPA and GDPR requirements for children. Building a single robust children's privacy framework that meets the more demanding GDPR standards will generally satisfy COPPA requirements as well. Your ecommerce privacy policyshould include a dedicated children's data section covering both regimes.

Frequently asked questions

Does COPPA apply to ecommerce stores selling children's products?

Yes, if your site is directed to children under 13 based on subject matter, visual design, advertising targeting or actual audience composition. Toy stores, children's clothing brands and educational product retailers have significant COPPA exposure.

What is verifiable parental consent under COPPA?

It is actual verification that a parent has authorized data collection from their child. Acceptable methods include credit card verification, phone call with trained staff, video conference, government ID check or a signed consent form. A simple checkbox is not sufficient.

Do analytics cookies on a children's site violate COPPA?

Yes, if the cookies are persistent identifiers that recognize users across sessions. Under COPPA, persistent identifiers including tracking cookies and device fingerprints constitute personal information when collected from children under 13.

What are the penalties for COPPA violations?

The FTC can impose fines of up to $50,120 per violation. The largest COPPA action was the $520 million Epic Games settlement in 2022. YouTube was fined $170 million and TikTok $5.7 million for COPPA violations.