TL; DR

Introduction

Since its inception, COPPA has dictated the way kids' publishers and advertisers can run their businesses.
Failure to comply with COPPA can lead to steep penalties, even more so with the Senate's passing of COPPA 2.0 in July 2024. While not in law yet, the Senate passing of this updated legislation takes it one step closer. Here's what that could mean.
While tools and platforms to enable digital advertising within COPPA requirements are rare, rather than giving up on publishing or advertising in the kids' space, publishers and advertisers who can lean into COPPA compliance will find untapped revenue opportunities.

For years, the Children's Online Privacy Protection Act (COPPA) has been a major point of concern for both advertisers and publishers. The law serves a very real and growing need to keep kids safe from predatory tracking and advertising practices online, but in some ways, it has also limited those in digital advertising.

Facing the threat of steep penalties and a mess of rules and guidelines, many publishers and advertisers have made the decision to avoid the kids' vertical entirely. And advertising technology - a field known for innovating to meet ever-changing needs - has often fallen short in providing real, useful solutions.

But publishers, advertisers, and ad tech innovators are not known for shrugging their shoulders and giving up. And in this case, they shouldn't. We're here to tell you that there is a way to monetize with advertising in the kids' publishing space. It's all about staying informed and working with the right provider.

This guide is going to help you with all of that. Read on to learn everything you need to know about COPPA today.

Playwire has devoted years to building a COPPA-safe revenue amplification platform meant for publishers and advertisers who want to do COPPA compliance the right way while still achieving their business goals. Join the many publishers and advertisers who have built their businesses with us. Contact Playwire today.

What is COPPA?

COPPA (Children's Online Privacy Protection Act) is a federal law enacted by the United States government in 1998. Its focus is on protecting the personal information and privacy of children who are 13 years old or younger.

Most of its requirements are directed toward the owners of web properties - websites, apps, and the like - that are directed at young children, although it can also apply to web properties that reach general audiences in some cases.

Over the decades, COPPA has undergone several amendments. That's largely because the first version of the law was enacted in what could be referred to as the Stone Age of the internet - well before Google had reached peak dominance and before YouTube, Facebook and similar giants had taken their first breaths.

Although the law has its critics, some of whom have made valid points, the need for COPPA is clear. The internet is a vast and largely unregulated world in which our children will inevitably be involved. Laws like COPPA are meant to protect them, and that is at its core a noble pursuit.

However, COPPA has also had a limiting effect on both publishers and advertisers who actually have good intentions. Posing the threat of steep fines and other penalties, COPPA has convinced some players that entering the kids' space is more trouble than it is worth.

Since the early days of COPPA legislation, Playwire has invested heavily in building solutions meant to prevent that from happening. We believe that publishers and advertisers can exist in the kids' vertical and remain profitable and effective - it just takes a little innovation. We've been showing publishers and advertisers how to make that a reality for years.

By the 1990s, the internet had reached a level of ability and capacity that enabled digital commerce. That was when things like online advertising suddenly became important to the market, and it was roughly then that data collection became an important aspect of operating as a publisher or advertiser online.

From the very beginning, user data has been gold to advertisers, and publishers have long recognized that fact. Monetizing data by creating audience segments and enabling targeted advertising has been a key revenue stream for publishers for years, and advertisers have come to rely on this access to data.

But the rise in online data collection sparked conversations about privacy online - particularly privacy as it pertains to children. Through vocal actors and active petitions, these conversations eventually reached the federal level.

In the mid-1990s, the Center for Media Education asked the Federal Trade Commission (FTC) to investigate the data collection practices of KidsCom, an early "virtual world" website geared toward young children. This was before COPPA or any similar legislation existed, but the concern was whether the website was violating a provision of the FTC code prohibiting "unfair and deceptive" trade practices.

After it completed the investigation, the FTC released what would become known as the "KidsCom letter" to say that the data collection and use practices of the website were "subject to legal action."

That's how COPPA was born. Shortly thereafter, COPPA was drafted and enacted into law in 1998, taking effect in 2000.

The basic shape of COPPA has remained the same for the two-plus decades since it became law, but it has undergone some renovations during that time. Most notably, the law was expanded in 2013 to provide additional requirements more pertinent to the internet in its modern form and add context for some of its earlier guidelines.

Parental Consent

Before you can collect, use or share the data of any child who is 13 years old or younger, you have to obtain the express consent of the child's parent to do so. Once you have that consent, you are required to notify the parent who gave the consent of any changes to the way in which you collect or use the data.

Additionally, you have to give parents the ability to agree to have their children's data collected and used but not disclosed to others.

One keyword in COPPA's language about consent is "verifiable." The law required "verifiable" consent from parents, and that has often resulted in publishers requiring the use of a credit card. The credit card signals that the cardholder is, in fact, an adult. The parent gives their consent and has a small charge placed on the card, and the publisher refunds the small fee.

That's not the only way verifiable parental consent is obtained, but it is a common method among publishers.

Right to Review

Under COPPA, parents also have a right to see and review the personal information their children have provided to websites, apps, and other web properties, regardless of whether consent was given.

This right to review comes with additional provisions regarding the web property owner's efforts to get this information to parents quickly and without much hassle, as well as the requirement to reasonably ensure that the person requesting to review the child's personal information is actually the parent or legal guardian of the child.

An additional note to add to this COPPA-ensured right for parents: At any point during or after their review of the information the web property has about their children, parents can opt out of all data collection on behalf of their children, regardless of whether they gave prior consent.

Privacy Policy

COPPA also requires the operators of web properties to describe in detail the ways in which they collect, use and disclose the data of children who are 13 years old or younger. This description has to be clear and easily accessible in a prominent place on or in the web property.

The most common way to meet that requirement is to publish a privacy policy. These have become a common, almost universal, feature of websites in the age of COPPA.

Reasonable Data Only

The law has also accounted for publishers who might try to get around the requirements of COPPA by requiring children who are 13 years old or younger to enter additional personal information in order to fully participate in a website or app.

That is explicitly forbidden under COPPA law. The only information publishers can require (given that proper consent has been obtained) of young children is that which is "reasonably necessary" to participate in the activity at hand, whether it's a game or something else.

Like any law, COPPA has a lot of languages that have been the subject of fierce debate. One key example is the language that says the rules contained within the law apply to web properties directed toward children younger than 13.

How do you know? For example, if you are an app publisher who builds mobile games, are you creating apps "directed" toward children even though many of your users are full-grown adults?

To clarify this issue, the FTC has defined some parameters that can help you understand whether your web property would be considered to be directed toward young children, making you subject to the requirements of COPPA:

Subject matter. Is the subject matter known to be of interest to young kids?
Visual content. Is the visual content clearly designed to appeal to children?
Use of animated characters. Animation suggests an intention to reach an audience of children.
Child-oriented activities. Are the activities within the web property clearly intended for children?
Child-oriented incentives. Offering a prize that is a child's toy would be considered a child-oriented incentive.
Music or other audio content. Are the songs or other pieces of audio obviously intended for young children?
Age of models. If the models used within the web property are young children themselves, then the property appears to be intended for that age group.
Celebrities who appeal to kids. For example, an endorsement or sponsorship of a celebrity who appeals to children, such as the host of a kids' TV show.
Child celebs. The involvement of celebrities who are children suggests that your intended audience is young children.
Kid-friendly/directed language. Directly appealing to children with verbiage like "Hey, kids" and similar is a clear indicator.
Advertising for the site directed to children. Are your web property's own advertising initiatives meant for children?
Advertising on the site directed to kids. Are the ads you are running on the web property meant for an audience of young children?
Competent and reliable empirical evidence about audience composition. Do you have strong data that shows that children make up a portion of your web property's audience?
Evidence about your intended audience. Is there a document or data source that shows that you intend to reach children who are younger than 13?

Of course, even if your site meets few or none of these requirements, if you collect data from children whom you know are younger than 13 in the United States, you are subject to COPPA.

When COPPA was first enacted, it applied only to websites. That's because apps didn't exist yet.

This does not mean that app publishers are excluded from the requirements of COPPA. In fact, even from its earliest days, COPPA has made clear that its rules and regulations apply to web-based properties that use the internet to reach their audiences.

Both mobile and desktop apps fall squarely into that group. So, app publishers, all of this COPPA information applies to you, too. In fact, it is just as important for you to remain in compliance with COPPA as it is for the owner of any website.

Don't make the mistake of thinking that you can get away with not complying with COPPA as a publisher or advertiser who falls under the regulated bodies of COPPA. Not only does the FTC monitor for violators, but so do other federal agencies, state attorneys general, and other state-level agencies.

That's not to mention the fact that the FTC provides an avenue for anyone to report COPPA violators. That means you have potentially millions of concerned parents and your competitors just waiting for an opportunity to report you and get you under investigation by the FTC.

In other words, compliance with COPPA is not optional. But what are you risking if you fall out of compliance, whether intentionally or unintentionally? As it turns out, the punishments can be fairly harsh:

Huge Fines

Here's a number for you: $4 million. That's the highest fine imposed by the FTC for a COPPA violation as of the publication of this article.

The average FTC fine for COPPA violations is around $400,000. That's money most publishers cannot afford to burn.

Don't be fooled by the limits noted in FTC regulations. On its website, the FTC notes that courts can hold COPPA violators accountable for up to $46,517 per violation.

That's still a lot of money, but it's much less than $400,000 or $4 million. But there's a key phrase to remember here: "per violation." The problem is that, where there is one COPPA violation, there are usually many. And you can be held accountable for each.

Bad Publicity

As a society, we generally agree that children need to be protected. We hold them dear and support most initiatives meant to protect them. In the eyes of most people, COPPA is one of those initiatives. You do not want to be seen as someone who is trying to harm children, but if you're a COPPA violator, that's exactly how some people will see you.

In fact, major COPPA violations - particularly those that result in high-stakes litigation - frequently end up in the national news. That's a level of bad publicity that most publishers can't even begin to think about, but it's a very real possibility if you violate COPPA.

Buyers Won't Buy, Sellers Won't Sell

Perhaps one of the most damaging repercussions of violating COPPA over the long term is the fact that you become labeled as a COPPA violator. Remember - both publishers and advertisers who deal in child audiences have to comply with COPPA, and they only want to work with each other when they're reasonably certain that the other is fully COPPA-compliant.

If you're slapped with a fine for violating COPPA, your reputation could be ruined. Before you know it, you might struggle to get advertisers to purchase your ad inventory if you're a publisher. And if you're an advertiser, you may irreparably damage relationships with kids' publishers who reach the audiences you need to reach.

As of the time of publication of this article, a federal bill known as COPPA 2.0 was under consideration and headed for a likely approval. The central change this bill would bring to COPPA as it exists today is that it would raise the age for children protected by COPPA to younger than 18.

In one fell swoop, the approval of this bill could put countless publishers and advertisers who reach teen audiences in the crosshairs of the FTC and various other enforcement agencies. Smelling blood in the air, publishers and advertisers are trying to find COPPA-safe solutions that will position them to survive the pending expansion of COPPA.

Unfortunately, this change is likely to dry up advertising dollars for hundreds or thousands of publishers and content creators who reach teenage audiences. That's why Playwire is simultaneously advocating for more reasonable changes to COPPA and building new solutions that can weather any new storm COPPA and similar laws can throw at publishers.

You can read more about our efforts on behalf of publishers here.

A provision of COPPA geared toward self-regulation within the children's publishing and advertising industries has led to the creation of various so-called "Safe Harbor Programs" meant to help publishers and advertisers remain compliant.

These programs have to be approved by federal regulators to help regulate and encourage COPPA compliance within their industries. This approval process comes complete with mandatory reporting guidance, penalty requirements, and other FTC-mandated internal enforcement actions.

The first example of such a Safe Harbor Program is the kidSAFE Seal Program, which is an independent safety certification service and seal-of-approval program designed exclusively for children-friendly websites and technologies. This includes online gaming sites, educational sites and services, virtual worlds or metaverses, social media networks, mobile gaming apps, tablet devices, connected toys, and other similar online and interactive services.

Another example is The Children's Advertising Review Unit (CARU). This is a national program of the Better Business Bureau meant to help publishers and advertisers get into and remain in compliance with COPPA. CARU can enforce COPPA when companies fail to comply with the stated rules.

Navigating COPPA is one of the most pressing challenges children's publishers face today. To monetize your content as a children's publisher, COPPA compliance is all but essential, and the law is complicated and constantly changing.

What is a publisher to do? Consider the following strategies for successfully navigating COPPA:

Safe Harbor Programs

Safe Harbor Programs like KidSAFE and CARU were designed to help publishers get into compliance with COPPA and stay there. To that end, they offer all kinds of helpful resources that can translate the complexities of federal law into bite-sized and actionable tips for publishers.

Some Safe Harbor Programs will even help you audit your web properties for compliance and issue specific recommendations for the changes you should make and how to make them.

Consent Management Platforms (CMPs)

COPPA is far from the only privacy-focused law on the books around the world. To help publishers keep up with these laws and stay in compliance, ad tech companies have created consent management platforms (CMPs).

The capabilities of these tools vary widely, but the main idea is that they facilitate opt-ins for data collection and tracking within the confines of privacy laws. Applied to COPPA, a high-quality CMP could manage parental consent for data collection from children younger than 13, among various other functions.

Human-Led Programmatic

Programmatic advertising provides the ad volume publishers need to bring in real, business-sustaining revenue. But for children's publishers, it is extremely problematic. That's because it is largely automatic.

This is no criticism of automation and the convenience it provides, but the problem is that automation at scale will inevitably let a COPPA-violating piece of creative slip through the gates.

Does that mean children's publishers can't do programmatic advertising? Absolutely not. But it does mean that programmatic for children's publishers requires a human touch. You need a human being acting as the gatekeeper, giving manual approvals for ad creative and generally making sure every programmatic action taken on your behalf is well within the confines of COPPA rules.

Direct Sales

The days of insertion orders (IOs) for direct ad buys are far from over for a few reasons, not least of which is that they help ensure that children's publishers remain in compliance with COPPA.

Much like the human gatekeeper called for in the previous point, direct sales require a human touch, solving potential issues with ad creative that can lead to a costly COPPA violation. As a nice bonus, when done right, direct sales typically lead to higher CPMs than programmatic sales.

Working with an All-in-One COPPA Compliance Vendor

This one is a combination of all of the above solutions: Find a vendor you trust and entrust them with your efforts to remain in COPPA compliance. This kind of all-in-one COPPA compliance solution is rare, which is why Playwire has built a dedicated platform to lead the way for publishers in COPPA compliance.

You can learn more about Playwire's COPPA-compliant offerings here.

Like many far-reaching and frequently amended federal laws, COPPA can be confusing. That means you're likely to have some questions if you're trying to stay in compliance. In an effort to help, the Playwire team has answered some of the most frequently asked questions about COPPA below.

How does the FTC enforce COPPA?

The FTC can enforce COPPA through enforcement actions like financial penalties. Sometimes, the agency will enter into litigation with those who violate COPPA, usually with the intended outcome of issuing fines or injunctive action meant to prevent further violations.

Can other agencies enforce COPPA?

Yes. Various other agencies at the federal level could theoretically enforce COPPA, although the FTC is the primary enforcer of the law at the federal level. At the state level, on the other hand, state attorneys general and any number of other relevant agencies could enforce COPPA. This will depend on the laws of your state, of course.

What should I do if my site or app doesn't comply with COPPA?

If you are reading this and realizing that you're not in compliance with COPPA, the FTC says you should immediately stop collecting the data of children who are younger than 13. To take that a step further, you will likely need to reach out to a Safe Harbor Program and/or a vendor who can help you get into compliance and ensure your revenue is protected.

Do websites based in other countries have to comply with COPPA?

As strange as it may sound, the answer is yes. If a website or app based in another country is collecting data on children younger than 13 in the United States, it has to comply with the rules of COPPA. Of course, enforcement may look somewhat different when it has to cross national borders, but the law holds that COPPA's rules apply to any web property reaching kids in the United States.

What if some kids interact with my content? Do I have to comply with COPPA?

If your web property is not directed toward children and you don't have reliable knowledge that you are collecting young children's information, the answer is likely no. The law is primarily meant for publishers who are knowingly collecting data from children younger than 13.

However, the big caveat here is that only an attorney can give you legal advice regarding COPPA. With that said, it's probably best to reach out to a qualified attorney for advice if you are concerned that COPPA may apply to you.

What if kids lie about their age when entering my website or downloading my app?

According to the FTC, "The Rule [COPPA] does not require operators of general audience sites to investigate the ages of visitors to their sites or services." So, in general, you are not on the hook for COPPA compliance if children are lying about their age in order to use your web property. Keep in mind, however, that the quote above specifically pertains to "general audience sites," not necessarily sites directed toward children.

What is COPPA 2.0?

Here are several important updates that publishers, advertisers, and tech providers alike need to plan for with the United States Senate passing of COPPA 2.0:

A Wider Age Range: Previously, COPPA only impacted kids up to 13 years old, whereas this new legislation will cover everyone up to 16 years old. In other words, you’ll need to start using contextual targeting to reach a wider range of younger audiences.
Stricter Rules About Data Collection: COPPA 2.0 also further tightens the rules around how kids’ online data can be collected and used.
Stronger Enforcement: With COPPA 2.0, government regulators plan to increase the financial and legal penalties if you violate COPPA law, which is currently up to $50,000 per violation.
Updated Definition of Personal Information: As is the case with most things, technology has advanced greatly since the initial version of COPPA was drafted, so it’s no surprise that they’ve also updated the definition of “personal information” to include newer elements like voice recordings and biometrics.

Please note, that this is NOT law yet. Playwire will continue to closely monitor updates to COPPA law to ensure our partners are prepared and protected.

If COPPA compliance were easy, publishers and advertisers all over the world would be cashing in on the United States kids' vertical. But alas, COPPA compliance has been and remains a major obstacle for publishers and advertisers.

Many in your position find themselves looking for a complete solution - one they can count on to keep them in compliance and maintain their revenue. At Playwire, we heard the call for such a solution, and we stepped up to build one.

And build we did. We built our COPPA-safe advertising platform to connect publishers and advertisers in a way that's mutually beneficial. With our platform, you can rest easy knowing you're in compliance and achieve your KPIs with ease.

Interested? Reach out to the Playwire team today.

Don't Have Time To Read the Entire Guide Now?

Built with the expertise of:

Jayson Dubin, CEO

Introduction

Table of Contents

1

2

3

4

5

6

7

8

9

10

11

12

What is COPPA?

What is COPPA?

History of COPPA

COPPA Requirements

Tracking

Parental Consent

Right to Review

Privacy Policy

Reasonable Data Only

Protecting Kids' Personal Information

Data Deletion

How to Tell if a Website or App is Meant for Children

App Publishers, This Applies to You, Too

Risks of COPPA Non-Compliance

Litigation

Huge Fines

Bad Publicity

Buyers Won't Buy, Sellers Won't Sell

COPPA 2.0: What You Need to Know

Post-Publish Note

Taking COPPA Compliance to the Next Level

Navigating COPPA

Safe Harbor Programs

Consent Management Platforms (CMPs)

Human-Led Programmatic

Direct Sales

Working with an All-in-One COPPA Compliance Vendor

COPPA FAQs

How does the FTC enforce COPPA?

Can other agencies enforce COPPA?

What should I do if my site or app doesn't comply with COPPA?

Do websites based in other countries have to comply with COPPA?

What if some kids interact with my content? Do I have to comply with COPPA?

What if kids lie about their age when entering my website or downloading my app?

What is COPPA 2.0?

Playwire: COPPA Compliance You Can Count On

Related Content

AMPLIFY YOUR AD REVENUE