What COPPA Is
The Children's Online Privacy Protection Act protects the personal information of children under 13 in the United States. Congress passed it in 1998, and the Federal Trade Commission enforces it through the COPPA Rule, which took effect in 2000 and was updated in 2013 and again in 2025.
COPPA is a notice and consent law. Covered operators must post a clear privacy policy, give parents direct notice of their data practices, get verifiable parental consent before collecting personal information from children, let parents review and delete their child's data, and keep the data secure.
This entry explains COPPA for app and growth teams. It is not legal advice.
Who It Applies To
COPPA covers two kinds of operators. The first is anyone running a website, app or online service directed to children under 13, judged by factors such as subject matter, visual content, characters, music, ads and the actual audience. The second is a general audience service with actual knowledge that it collects personal information from a child under 13.
Third parties are covered too. An SDK, ad network or analytics provider that has actual knowledge it collects data from users of a child-directed app is treated as an operator for that collection. This is why many SDKs and ad platforms offer a child-directed flag, and why app stores ask developers about their target age groups.
What Counts as Personal Information
COPPA's definition is wide. It includes names, addresses, emails and phone numbers, and also photos, videos and audio of the child, geolocation precise enough to identify a street and city, and persistent identifiers that recognise a user over time and across services, such as advertising IDs, cookies and device serial numbers. The 2025 amendments added biometric identifiers, such as fingerprints, voiceprints and facial templates.
There is a narrow exception for persistent identifiers used only to support the internal operations of the service, such as site maintenance, personalising content within the app, frequency capping and fraud prevention. Behavioral advertising and building profiles across services fall outside that exception.
The 2025 Rule Update
The FTC finalised amendments to the COPPA Rule in January 2025. They were published in April 2025, took effect on 23 June 2025, and most obligations required compliance by 22 April 2026. The main changes for apps are a requirement for separate verifiable parental consent before disclosing a child's personal information to third parties, including for targeted advertising; a written data retention policy with limits on how long data is kept; a written information security program; more detail in privacy notices about third-party disclosures; and new rules for FTC-approved safe harbor programs.
What COPPA Means for Attribution
For a child-directed app, standard ad measurement needs care. Collecting advertising IDs or sharing device-level data with ad networks for behavioral advertising requires verifiable parental consent, now separately for third-party disclosure. Many child-directed apps instead limit measurement to contextual ads and aggregate reporting, and set child-directed flags in every SDK that supports them.
Platform rules add another layer. Apple does not allow apps in the Kids category to include third-party analytics or advertising that transmit personal information, with narrow exceptions, and Google Play's Families policy restricts which SDKs and identifiers child-directed apps may use. On iOS, App Tracking Transparency consent is also required before any tracking.
Linkrunner displays a COPPA badge on its Trust Center. The IDFA is collected only with ATT consent and PII hashing is an opt-in SDK setting. Mixed-audience apps should work with counsel to decide which flows apply to which users.
Mixed-Audience Apps
Many apps are not directed primarily at children but have some young users, such as family games or education apps used by students of many ages. The COPPA Rule lets such mixed-audience services age-screen users in a neutral way, without encouraging children to lie about their age, and then treat users under 13 under COPPA's rules while treating others normally.
In practice, that means an age gate early in onboarding, separate data flows for younger users, and SDKs that support a child-directed or under-age flag per user. Measurement and advertising for flagged users is limited to what COPPA allows without consent, such as contextual ads and support for internal operations, unless verifiable parental consent has been obtained.
Keep the logic simple and testable. The most common failure is an age gate that works in onboarding but is not passed to every SDK, so data for younger users still flows to partners. Audit what each SDK sends for a test user under 13 before release.