# COPPA compliance assessment
> Source: https://legalcode.md/skills/legalcode-coppa-compliance-assessment | [HTML version](https://legalcode.md/skills/legalcode-coppa-compliance-assessment)

COPPA compliance assessment for operators of websites and online services directed to children or with actual knowledge of child users.

COPPA compliance assessment for operators of websites and online services directed to children or with actual knowledge of child users. Covers the Children's Online Privacy Protection Act (15 U.S.C. §§ 6501–6506) and the FTC's COPPA Rule (16 C.F.R. Part 312), including the 2025 amendments (effective June 23, 2025; compliance deadline April 22, 2026). Assesses all five operator obligation domains: (1) privacy notice requirements including new retention disclosure mandate; (2) direct notice to parents; (3) verifiable parental consent (VPC) including all 10 approved methods and new separate consent for third-party sharing, targeted advertising, and AI training; (4) parental access and deletion rights; and (5) children's data security including the new written information security program requirement. Covers operator applicability determination (directed-to- children multi-factor test + actual knowledge standard + mixed-audience platform rules), expanded PII definitions (biometric identifiers, government-issued identifiers, mobile phone numbers), data minimization and retention limits, safe harbor programs (CARU, kidSAFE, ESRB, iKeepSafe, TRUSTe, PRIVO), third-party SDK and vendor liability, and state children's privacy law overlay (California AADC, Texas SCOPE Act, Utah CSPA, Colorado, Connecticut, Maryland Kids Code). Produces COMPLIANT/PARTIAL/NON-COMPLIANT/ CRITICAL DEFICIENCY assessments with remediation roadmaps, FTC enforcement exposure estimates, and Glass Box audit trail. Use when a website operator, app developer, EdTech platform, gaming company, streaming service, or AdTech provider needs to determine COPPA compliance posture, prepare for FTC inquiry, assess a product or feature for child- audience risk, build a COPPA compliance program from scratch, respond to a parental complaint, or evaluate compliance with the 2025 amendments ahead of the April 2026 deadline.

This skill assesses an operator's compliance posture under COPPA and the 2025 amended COPPA Rule, from initial applicability determination through remediation planning. **Covers:** - Operator applicability determination (directed-to-children test, actual knowledge standard, mixed-audience platform analysis) - Expanded personal information definitions under the 2025 amendments (biometric identifiers, government-issued identifiers, mobile phone numbers for VPC) - Privacy notice requirements: home-page posting, per-collection-point notice, new retention timeline disclosure, third-party categories disclosure - Direct notice to parents before data collection - Verifiable parental consent (VPC): all 10 approved methods, method adequacy for use case, neutral age-screen requirements, separate consent for third-party sharing / targeted advertising / AI training - Data minimization and written retention policy requirements (new 2025) - Written children's data security program requirements (new 2025) - Parental access and deletion rights: review, correction, deletion, opt-out workflow - Third-party SDK, analytics, and ad network liability exposure - Safe harbor programs: CARU, kidSAFE, ESRB, iKeepSafe, TRUSTe, PRIVO — benefits and certification workflow - State children's privacy law overlay: California AADC, Texas SCOPE Act, Utah CSPA, Colorado, Connecticut, Maryland Kids Code, Nebraska, Vermont - FTC civil penalty exposure modeling (current maximum: $53,088 per violation per day) - Remediation roadmap with IMMEDIATE / NEAR-TERM / BACKGROUND ...

## Jurisdictions

Global



---
*Legalcode -- legalcode.md*