COPPA Compliance & Minors in Research: What Parents Must Know

What Is COPPA and Why It Matters

<cite index="3-5,3-6">The Children's Online Privacy Protection Act (COPPA) is a U.S. federal law enforced by the Federal Trade Commission (FTC) to safeguard the privacy of children under 13. It regulates how personal information is collected, used, and disclosed online, applying to operators of commercial websites, apps, and online services directed at children or those with actual knowledge of collecting data from minors.</cite>

When your child participates in online research studies—whether through Survey Cash Club or other platforms—COPPA compliance is essential. <cite index="3-8,3-9">For clinical researchers, COPPA's relevance is particularly pronounced when studies involve collecting data from children under 13 via online tools. Key requirements include verifiable parental consent, where researchers must obtain explicit consent from parents or guardians before collecting any personal information.</cite>

Verifiable Parental Consent: The Foundation

<cite index="10-2,10-3">When it comes to the collection of personal information from children under 13, the Children's Online Privacy Protection Act (COPPA) puts parents in control. The Federal Trade Commission, the nation's consumer protection agency, enforces the COPPA Rule, which spells out what operators of websites and online services must do to protect children's privacy and safety online.</cite>

<cite index="16-5,16-6">The COPPA Rule does not mandate the method a company must use to get parental consent. Instead, it says that an operator must choose a method reasonably designed in light of available technology to ensure that the person giving the consent is the child's parent.</cite> <cite index="38-19,38-20,38-21">The final rules expand on this requirement by adding three additional methods of consent: knowledge-based authentication process using dynamic, multiple-choice questions; photo identification using phone or web facial recognition technology (with deletion of the parent's identification after confirmation); and text-plus verification involving text messages coupled with additional verification steps.</cite>

What Information Can Be Collected?

<cite index="9-3">COPPA defines children's personal information to include persistent online identifiers, such as a profile, cookie, IP address, device serial number or other identifier to recognize a user over time and across different online locations, websites or services; any visual record (photo, video) or audio record containing a child's image and/or voice; and any personal information about the child's parents, family members or friends.</cite>

Research companies must be transparent about what they're collecting. <cite index="3-10,3-11,3-12">A clear and comprehensive privacy policy must outline how children's data will be collected, used, and protected. Only the information necessary for the study should be collected, and robust safeguards must be implemented to protect sensitive data from breaches or misuse.</cite>

Your Rights as a Parent

<cite index="11-19,11-20">Even if parents have agreed that a company may collect information from their kids, parents have ongoing rights and continuing obligations. Parents must be given a way to revoke their consent and refuse the further use or collection of personal information from their child.</cite>

<cite index="39-4">The Rule requires operators to provide parents the opportunity to review the types of personal information collected from their child, delete the collected information, and prevent further use or future collection of personal information from their child.</cite>

Recent COPPA Updates (2025)

<cite index="31-2,31-4">On January 16, 2025, the FTC unanimously agreed to amend the COPPA Rule. The Amendments were eventually published on April 22, 2025 and will take effect on June 23, 2025.</cite>

<cite index="5-18,5-19,5-20,5-21">Critical updates to the COPPA Rule include enhanced data security and retention requirements, with operators required to evaluate data security risks, deploy safeguards to mitigate those risks, and test and monitor the efficacy of safeguards, including evaluating the entire information security program annually. The Rule now requires operators to obtain separate and additional verifiable parental consent prior to disclosing a child's personal information to third parties like advertisers and data brokers.</cite>

Data Breach Risks: What Parents Should Know

<cite index="30-1">In 2022, some 1.7 million children fell victim to a data breach, meaning 1 in every 43 kids had personal information exposed or compromised, according to a survey by Javelin Strategy and Research.</cite> This underscores why COPPA compliance and data security matter.

<cite index="23-2,23-15">Common issues in apps include frequent data sharing or lax security measures, including permission requests and third-party data transmissions.</cite>

Questions to Ask Before Your Child Participates

Before allowing your child to participate in any online research study:

Enforcement and Penalties

<cite index="3-13">Non-compliance carries serious consequences, including fines of up to $53,088 per violation and reputational harm.</cite> This means research companies have strong incentives to follow COPPA rules—and parents have protection through FTC enforcement.

Bottom Line

COPPA is designed to put you in control of your child's online data. When your child participates in legitimate research studies, COPPA-compliant platforms will obtain your explicit consent, clearly explain what data they're collecting, and protect that information with robust security measures. If a platform doesn't follow these rules, it's a red flag.