Definition
COPPA is the common acronym for the Children's Online Privacy Protection Act of 1998, a federal statute that regulates the online collection, use, and disclosure of personal information from children under the age of 13. The Act applies to operators of websites and online services directed at children, as well as to general-audience operators who have actual knowledge they are collecting personal information from children under 13. Before collecting, using, or disclosing such information, covered operators must obtain verifiable parental consent.
The Federal Trade Commission (FTC) is the primary enforcement authority and has issued implementing regulations — the COPPA Rule (16 C.F.R. Part 312) — that define operative terms, specify what constitutes verifiable parental consent, and describe safe harbor programs through which operators may achieve compliance.
Common Language
Modern common usage (Wiktionary): An acronym for the Children's Online Privacy Protection Act, a U.S. law requiring children under 13 to obtain parental consent to use social media.
The Wiktionary gloss captures the popular understanding but understates the statute's scope. COPPA is not limited to social media; it applies broadly to any commercial website or online service directed to children or with actual knowledge of child users. Its requirements extend well beyond a consent trigger — operators must maintain privacy policies, allow parental review and deletion of collected data, and implement data security measures. Treating COPPA as a simple social media parental consent rule will cause a researcher to miss most of what the statute regulates.
Common Confusion
COPPA (Children's Online Privacy Protection Act) is frequently confused with COPPA as a stand-alone word appearing in historical English and ecclesiastical law, where it denotes a crop of grass, hay, or corn divided into titheable portions. The two terms share only their spelling. The historical agricultural and tithe law sense is entirely unrelated to the modern federal statute. Researchers encountering "coppa" in pre-20th-century English legal sources — particularly in tithe, ecclesiastical, or agrarian contexts — should not read any privacy law meaning into the term.
Core Elements
COPPA compliance analysis turns on several formal threshold questions and substantive requirements:
Covered operator: A person or entity operating a commercial website or online service directed to children, or any operator with actual knowledge of collecting personal information from users under 13.
Directed to children: Determined by the FTC using a totality-of-circumstances test considering subject matter, visual content, music, animated characters, celebrities who appeal to children, and advertising on the site.
Personal information: Defined broadly in the COPPA Rule to include name, address, online contact information, screen name, telephone number, Social Security number, persistent identifiers (such as cookies or device IDs that can be used to recognize a user over time), photos, videos, and audio files containing a child's image or voice.
Verifiable parental consent: The operator must make reasonable efforts to obtain consent from a parent before collection. Acceptable methods are specified in the COPPA Rule and have expanded over time as the FTC has updated the Rule (most significantly in 2013 and under ongoing review).
Privacy notice: Operators must post a clear and comprehensive online privacy policy describing their information practices with respect to children.
Parental rights: Parents may review personal information collected from their child and request deletion. Operators must provide reasonable means to do so.
Why It Matters in Research
COPPA is a fast-moving regulatory area. The FTC's COPPA Rule was substantially revised in 2013, expanding the definition of personal information to include persistent identifiers and geolocation data. The FTC proposed further amendments in 2023 that, if finalized, would tighten consent requirements, limit data retention, and restrict targeted advertising to children. Researchers relying on pre-2013 secondary sources or pre-2013 editions of reference works risk using outdated definitions of key operative terms.
The statute's age threshold — 13 — has shaped industry practice far beyond strict compliance. Platforms routinely prohibit users under 13 as a COPPA avoidance strategy rather than a substantive age verification mechanism. This regulatory architecture produces significant gaps between the statute's formal coverage and its real-world effect that researchers examining platform governance or children's online safety should account for.
COPPA intersects with a growing body of state-level children's privacy legislation. Several states have enacted statutes that apply to older minors (typically under 16 or under 18) or impose requirements beyond federal COPPA, creating a layered compliance landscape. Researchers should not treat COPPA as the ceiling of children's online privacy law.
For historical law dictionary research: the Black's Law Dictionary entries for "coppa" refer exclusively to the English tithe-law meaning. Neither edition addresses the federal statute. Researchers using historical editions of Black's will find no useful guidance on the modern acronym.
Historical Dictionary Support
Both the standard edition and second edition of Black's Law Dictionary define "coppa" solely in its English ecclesiastical law sense: a crop of grass, hay, or corn divided into titheable portions to facilitate fair assessment of the tithe. Neither source has any bearing on the modern federal privacy statute. This is an instance where the shared orthography of a historical legal term and a modern statutory acronym creates a potential research dead end. The historical dictionary shelf offers nothing on COPPA as a privacy law instrument; researchers should move directly to the FTC's regulatory materials, the statute itself (15 U.S.C. §§ 6501–6506), and secondary sources postdating 1998.
Jurisdictional Note
COPPA is a federal statute with nationwide application to covered commercial operators regardless of where they are incorporated or hosted, provided they direct services to U.S. child users. State laws in California, Texas, Connecticut, and others now supplement COPPA with additional requirements for minors up to age 16 or 18. Compliance with COPPA alone does not ensure compliance with applicable state law.
Encyclopedia Cross-Reference
See Law Mind Encyclopedia: Children's Online Privacy; FTC Regulatory Authority; Online Privacy Law