COPPA Basics (US)

What is COPPA?

The Children's Online Privacy Protection Act (COPPA) is a US federal law administered by the FTC. It places obligations on operators of online services directed to children under 13, and on operators who have actual knowledge that they are collecting personal information from children under 13.

This is a starter overview. COPPA compliance requires qualified US legal counsel. The FTC has issued detailed guidance and rules. Fines for non-compliance can be significant.

When COPPA Applies

COPPA applies to your OTT platform if:

1. Directed to children: The service is targeted at children under 13 (based on subject matter, visual content, use of animated characters, music, celebrities popular with children, age of models, language, advertising, etc.)

2. Actual knowledge: You have actual knowledge that you are collecting personal information from a child under 13, even if the service is not primarily directed at children.

COPPA can apply to non-US companies if they target or collect data from US users.

Key COPPA Requirements

Parental Notice and Verifiable Consent

• Post a clear and comprehensive privacy notice describing what personal information is collected from children, how it is used, and how it is disclosed
• Obtain verifiable parental consent before collecting, using, or disclosing personal information from children under 13
• Methods for verifiable parental consent must provide reasonable assurance that the person consenting is the parent

Data Minimisation and Use Limitations

• Collect only the personal information necessary for participation in the activity
• Do not condition participation on disclosing more information than reasonably necessary
• Do not use personal information from children for behavioural advertising

Parental Rights

• Give parents the ability to review personal information collected from their child
• Give parents the ability to request deletion of their child's personal information
• Give parents the ability to refuse further collection or use

Data Retention

• Retain personal information from children only as long as reasonably necessary to fulfil the purpose for which it was collected
• Delete the information using reasonable measures to protect against unauthorised access

Mixed Audience Platforms

If your OTT platform has both adult and children's content, you may need to:

• Implement age gating before children's content sections
• Apply COPPA requirements to users who are verified or believed to be under 13
• Consult the FTC's "mixed audience" guidance for your specific situation

COPPA + Streaming / CTV Specifics

• Connected TV apps that are "directed to children" are subject to COPPA
• Advertising SDKs and analytics SDKs that access device identifiers may constitute "collection of personal information"
• Third-party ad delivery in children's programming must comply with COPPA's operator responsibility provisions

For authoritative guidance, see the FTC's COPPA FAQ and consult a US attorney experienced in children's privacy law.