Children's Privacy and Parental Consent Policy (COPPA)

How to use this document

• Use it to document how a website, app or online service handles personal information of children under 13 in the US: online notice, direct notice to parents, verifiable parental consent, separate consent for disclosure to third parties, parental rights, written retention policy and written security program.
• Suggested owner: legal or privacy, with product and engineering responsible for implementation.
• Before adopting it, decide: whether the service is directed to children, to a mixed audience or to a general audience with actual knowledge of users under 13; what data it collects and why; which third parties receive data; which consent method it will use; and whether it uses children's data in AI systems.
• Complete the inventory in section 4 first: the rest of the document depends on it.
• Annexes 1 to 3 are public or parent-facing texts; sections 11 and 12 are the internal written policies. The summary of the retention policy also goes in the online notice.
• Keep in "Country variants" the references to the states where you have users.
• Ask internal legal or an external advisor specialized in children's privacy to review the document, especially the service classification, the consent exceptions and the third parties.
• Approve the policy in the [AI COMMITTEE] or the appropriate body, publish the online notice with prominent links and review the document whenever data collection or third parties change.

Children's Privacy and Parental Consent Policy (COPPA)

1. Purpose and scope

[ORGANIZATION NAME] establishes this policy to protect personal information of children under 13 collected online through [COMPLETE: websites, apps, games, connected devices, AI services] (the "Service").

Service classification (check one):

• Directed to children: because of its subject matter, visual content, characters, activities, music, age of models, advertising or audience composition, the Service is directed to children.
• Mixed audience: the Service is directed to children but not as its primary audience. The organization uses a neutral age screen and applies this policy only to users under 13.
• General audience with actual knowledge: the Service is not directed to children, but the organization knows it collects information from some users under 13 and applies this policy to those users.

This policy supplements the organization's general privacy notice and prevails over it for children's information.

2. Definitions

• Child: a person under 13.
• Personal information: individually identifiable information about a child collected online, including name, address, online contact information, a screen name that functions as contact information, phone number, government-issued identifiers, persistent identifiers (cookies, device IDs, IP address), photos, videos or audio files containing the child's image or voice, precise geolocation, biometric identifiers and information combined with any of these.
• Operator: whoever runs the Service and collects or maintains children's personal information, or on whose behalf it is collected.
• Parent: includes a legal guardian.
• Verifiable parental consent: consent obtained with a method reasonably designed, in light of available technology, to ensure that the person consenting is the child's parent.
• Disclosure: making personal information available to third parties or allowing the child to make it public.
• Third party: anyone other than the operator who is not a provider acting to support the internal operations of the Service.
• Support for internal operations: activities needed for the Service to work (maintenance, security, feature personalization, legal compliance), without profiling or contacting a specific child.