COPPA Compliance & Minors in Research: What Parents Must Know
Survey Cash Club Research Desk
April 25, 2026
Understanding COPPA's parental consent requirements, data protections, and your rights when your child participates in online research studies.
What Is COPPA and Why It Matters
The Children's Online Privacy Protection Act (COPPA) is a U.S. federal law enforced by the Federal Trade Commission (FTC) to safeguard the privacy of children under 13. It regulates how personal information is collected, used, and disclosed online, applying to operators of commercial websites, apps, and online services directed at children or those with actual knowledge of collecting data from minors.
When your child participates in online research studies—whether through Survey Cash Club or other platforms—COPPA compliance is essential. For clinical researchers, COPPA's relevance is particularly pronounced when studies involve collecting data from children under 13 via online tools. Key requirements include verifiable parental consent, where researchers must obtain explicit consent from parents or guardians before collecting any personal information.
Verifiable Parental Consent: The Foundation
When it comes to the collection of personal information from children under 13, the Children's Online Privacy Protection Act (COPPA) puts parents in control. The Federal Trade Commission, the nation's consumer protection agency, enforces the COPPA Rule, which spells out what operators of websites and online services must do to protect children's privacy and safety online.
The COPPA Rule does not mandate the method a company must use to get parental consent. Instead, it says that an operator must choose a method reasonably designed in light of available technology to ensure that the person giving the consent is the child's parent. The final rules expand on this requirement by adding three additional methods of consent: knowledge-based authentication process using dynamic, multiple-choice questions; photo identification using phone or web facial recognition technology (with deletion of the parent's identification after confirmation); and text-plus verification involving text messages coupled with additional verification steps.
What Information Can Be Collected?
COPPA defines children's personal information to include persistent online identifiers, such as a profile, cookie, IP address, device serial number or other identifier to recognize a user over time and across different online locations, websites or services; any visual record (photo, video) or audio record containing a child's image and/or voice; and any personal information about the child's parents, family members or friends.
Research companies must be transparent about what they're collecting. A clear and comprehensive privacy policy must outline how children's data will be collected, used, and protected. Only the information necessary for the study should be collected, and robust safeguards must be implemented to protect sensitive data from breaches or misuse.
Your Rights as a Parent
Even if parents have agreed that a company may collect information from their kids, parents have ongoing rights and continuing obligations. Parents must be given a way to revoke their consent and refuse the further use or collection of personal information from their child.
The Rule requires operators to provide parents the opportunity to review the types of personal information collected from their child, delete the collected information, and prevent further use or future collection of personal information from their child.
Recent COPPA Updates (2025)
On January 16, 2025, the FTC unanimously agreed to amend the COPPA Rule. The Amendments were eventually published on April 22, 2025 and will take effect on June 23, 2025.
Critical updates to the COPPA Rule include enhanced data security and retention requirements, with operators required to evaluate data security risks, deploy safeguards to mitigate those risks, and test and monitor the efficacy of safeguards, including evaluating the entire information security program annually. The Rule now requires operators to obtain separate and additional verifiable parental consent prior to disclosing a child's personal information to third parties like advertisers and data brokers.
Data Breach Risks: What Parents Should Know
In 2022, some 1.7 million children fell victim to a data breach, meaning 1 in every 43 kids had personal information exposed or compromised, according to a survey by Javelin Strategy and Research. This underscores why COPPA compliance and data security matter.
Common issues in apps include frequent data sharing or lax security measures, including permission requests and third-party data transmissions.
Questions to Ask Before Your Child Participates
Before allowing your child to participate in any online research study:
Verify COPPA compliance: Ask if the platform is COPPA-compliant and whether it participates in an FTC-approved Safe Harbor program.
Review the privacy policy: Ensure it clearly explains what data will be collected, how it's used, and who it's shared with.
Understand consent methods: Confirm you'll receive direct notice and that your verifiable consent is required before data collection begins.
Check data retention: Ask how long your child's data will be kept and whether deletion is available upon request.
Clarify third-party sharing: Know exactly which third parties will receive your child's information and for what purposes.
Enforcement and Penalties
Non-compliance carries serious consequences, including fines of up to $53,088 per violation and reputational harm. This means research companies have strong incentives to follow COPPA rules—and parents have protection through FTC enforcement.
Bottom Line
COPPA is designed to put you in control of your child's online data. When your child participates in legitimate research studies, COPPA-compliant platforms will obtain your explicit consent, clearly explain what data they're collecting, and protect that information with robust security measures. If a platform doesn't follow these rules, it's a red flag.
