Does COPPA apply to my small business website?

The short version

• COPPA is a US federal rule enforced by the FTC. It protects children under 13.
• It applies if your site is aimed at children and collects their data. It also applies if you know you’re collecting a child’s data.
• Covered sites need a children’s privacy notice, a direct notice to parents and verifiable parental consent before collecting.
• The 2025 amendments added separate consent for sharing with third parties (unless the sharing is integral to the site or service) and a written retention policy. Most businesses had until April 22, 2026 to comply.
• Most small business sites aren’t aimed at children, but camps, tutors, kids’ sports, party venues and toy shops should check carefully.

This isn’t legal advice. COPPA penalties can be serious, so talk to a lawyer if your site may be covered.

How do I tell whether COPPA applies?

The FTC’s six-step compliance plan says COPPA applies when:

• your site or service is directed to children under 13 and collects personal information from them, or lets others collect it;
• your site is for a general audience, but you have actual knowledge you’re collecting personal information from a child under 13.

Is my site “directed to children”?

The FTC’s COPPA FAQ says it looks at many things. Examples are the subject, pictures, cartoon characters, music, the age of models and the language. It also looks at whether ads target children and who really uses the site. No single factor decides it. A kids’ coding camp site with cartoon characters and a sign-up form for children is very different from a plumber’s site.

What counts as personal information?

More than names. The FAQ lists a name, address, email and phone number. It also lists photos, video or audio of the child. And it lists “a persistent identifier that can be used to recognize a user over time and across different websites.” That last one includes many cookies. So ad trackers on a children’s site are a COPPA question too. The 2025 amendments, published in the Federal Register, also widened the definitions. They now cover mobile phone numbers, government ID numbers and biometric data.

What does a general-audience site have to do?

The FAQ says general-audience sites don’t have to investigate visitors’ ages. But say a parent tells you their child used your form. Now you have actual knowledge, and COPPA applies to that data.

What does a covered site have to do?

The FTC’s six steps, in short:

1. Decide whether you’re covered, as above.
2. Post a COPPA privacy policy that lists who collects children’s data on your site and what they collect. Explain how you use it, how long you keep it and parents’ rights. Link it on the home page and wherever you collect data.
3. Give parents direct notice before collecting.
4. Get verifiable parental consent before collecting, using a method reasonably designed to confirm it’s really the parent. Under the amended rule, parents must be able to consent to collection without agreeing to sharing with third parties. The FTC’s six-step plan says separate consent is needed for third-party disclosures “unless that disclosure is integral to your site or service.”
5. Honor parents’ rights to review the data, withdraw consent and have it deleted.
6. Protect the data and dispose of it. Keep reasonable security, check your service providers, and keep a written retention and deletion policy.

What changed in 2025?

The FTC announced the final amendments on January 16, 2025. The rule was published on April 22, 2025, took effect June 23, 2025, and most businesses had until April 22, 2026 to comply. Key changes:

• Separate consent before sharing children’s data with third parties, for example for targeted advertising. Sharing that’s integral to the site or service is the exception, and you must make it clear to parents.
• No keeping data indefinitely. Retain it only as long as needed for the purpose, under a written policy.
• Wider definitions, including mobile numbers, government IDs and biometric identifiers.

If your COPPA notice was written before 2025, review it against the current rule.

What if a child contacts me through a normal contact form?

The FAQ describes a narrow one-time response exception. You can collect only the child’s online contact information, such as an email address, and use it only to answer that one specific request, without a parent’s consent. You can’t use it to contact the child again or for anything else, and you can’t share it. Then “you must delete the child’s online contact information from your records promptly after you send your response.”

The exception doesn’t cover a form that also collects a child’s name, phone number, address or other details, or adds them to a mailing list. If you know a child has used a form like that, treat it as covered data and talk to your adviser. On a general business site, the practical step is: reply only if you need to, then delete the entry and the email copies.

The FTC’s FAQ notes the rule was amended in 2025 and tells readers to check the revised rule for current requirements. Some FAQ answers predate the amendments. Our guide to form data retention shows where those copies live.

Why does it matter?

COPPA applies whatever your size, and the FTC enforces it. Camps, lessons, kids’ sports, tutors and party venues often collect children’s details on sign-up forms. Many never think of COPPA.

What are the common mistakes?

• A sign-up form asking the child for their own email, when the form should be filled in by a parent.
• Ad pixels and remarketing on a children’s site.
• Keeping registration data for years.
• A general privacy policy with no section on children.
• Saying “not directed to children” when the site clearly is.

What if I think my site might be covered?

• Make the parent the person filling in forms, and collect only what you need from them.
• Remove ad tracking from pages aimed at children.
• Ask a lawyer to review your forms and policy against the amended rule.

How much does it cost, and how long does it take?

Reviewing forms and trackers takes an hour or two. If you’re covered, setting up parental notice and consent is a bigger job, and legal review is worth the cost. Prices vary, so ask for a quote.

How does E-3 handle this?

We don’t decide whether COPPA covers you. Under website care, we can change sign-up forms so a parent fills them in. We can remove ad tags from pages aimed at children and set retention on those forms. That happens once you and your adviser decide what’s needed. You decide which changes to make.

Related questions

• What should a small business privacy policy cover?
• How long should I keep form submissions?
• Which US state privacy laws apply to a small business?
• Can you set up online registration for my event?
• Back to the complete privacy and cookies guide

Sources

1. Children's Online Privacy Protection Rule: a six-step compliance plan for your business (FTC)
2. Complying with COPPA: frequently asked questions (FTC)
3. Children's Online Privacy Protection Rule, final amendments (Federal Register, April 22, 2025)
4. FTC finalizes changes to children's privacy rule (FTC press release, January 16, 2025)
5. Children's privacy (FTC business guidance)