How can you align your data privacy framework with COPPA requirements?

1 Assess your COPPA applicability

The first step to align your data privacy framework with COPPA is to assess whether your website, app, or online service is subject to the law. COPPA applies to operators of online services that are directed to children under 13, or that have actual knowledge that they are collecting personal information from children under 13. Online services include any internet-based platform that collects or maintains personal information, such as websites, apps, games, social networks, online forums, or cloud services. Personal information includes any data that can identify or contact a child, such as name, address, email, phone number, social security number, photos, videos, audio recordings, geolocation, device identifiers, or persistent cookies.

2 Obtain verifiable parental consent

The second step to align your data privacy framework with COPPA is to obtain verifiable parental consent before collecting any personal information from children under 13. Verifiable parental consent means that you have a reasonable method to ensure that the person giving consent is the child's parent or legal guardian. You can use various methods to obtain consent, depending on the nature and purpose of your data collection. For example, you can use email plus, which involves sending an email to the parent and requesting a response or confirmation, along with additional steps to verify the identity of the parent. You can also use credit card transactions, phone calls, video calls, digital signatures, or government-issued IDs. You must also provide parents with a way to revoke their consent at any time, and to review or delete their children's data.

3 Provide clear and comprehensive privacy notices

The third step to align your data privacy framework with COPPA is to provide clear and comprehensive privacy notices about your data practices. You must post a privacy policy on your website, app, or online service that describes what personal information you collect from children, how you use and share it, how you protect it, and how parents can exercise their rights under COPPA. You must also provide a direct notice to parents before collecting any personal information from children, which summarizes your privacy policy and informs them of their consent options. Your privacy notices must be written in plain and simple language, and be easily accessible and conspicuous.

4 Store, secure, and dispose of children's data

The fourth step to align your data privacy framework with COPPA is to store, secure, and dispose of children's data in a responsible and compliant manner. You must implement reasonable and appropriate measures to protect the confidentiality, integrity, and availability of children's data, and to prevent unauthorized access, use, or disclosure. You must also limit the retention of children's data to the extent necessary to fulfill the purpose for which it was collected, and delete it securely when it is no longer needed. You must also ensure that any third parties that you share children's data with are also bound by COPPA obligations, and that you monitor their compliance.

5 Respond to requests from parents and regulators

The fifth step to align your data privacy framework with COPPA is to respond to requests from parents and regulators in a timely and cooperative manner. You must provide parents with a way to contact you regarding their children's data, and to request access, correction, or deletion of their children's data. You must also comply with any inquiries or investigations from the Federal Trade Commission (FTC), which is the agency that enforces COPPA, or from any state attorneys general or other authorities. You must also keep records of your COPPA compliance activities, such as your consent forms, privacy notices, data inventories, security audits, and contracts with third parties.

6 Review and update your data privacy framework

The sixth and final step to align your data privacy framework with COPPA is to review and update your data privacy framework regularly, and to keep up with any changes or updates in the law or in your data practices. COPPA is not a static or one-time compliance exercise, but a dynamic and ongoing process that requires you to monitor and evaluate your data privacy framework periodically, and to make any necessary adjustments or improvements. You should also stay informed of any new developments or guidance from the FTC or other sources, and be ready to adapt your data privacy framework accordingly.