COPPA Compliance & Online Research: What Parents Should Know
Learn how COPPA protects your child's data in online research, what consent means, and your rights as a parent.
# COPPA Compliance & Online Research: What Parents Should Know
The Children's Online Privacy Protection Act (COPPA) is a U.S. federal law enforced by the Federal Trade Commission (FTC) to safeguard the privacy of children under 13. If your child participates in online surveys, research studies, or data collection activities, understanding COPPA is essential to protecting their information.
What COPPA Covers
COPPA regulates how personal information is collected, used, and disclosed online, applying to operators of commercial websites, apps, and online services directed at children or those with actual knowledge of collecting data from minors. While the law primarily targets commercial entities, its reach extends to researchers conducting studies involving children through digital platforms, even in non-commercial or academic settings.
Personal information that falls within COPPA compliance requirements includes children's names, nicknames, email addresses, telephone numbers, home addresses, geolocation information, social security numbers, photos, video and audio files, persistent identifiers or trackers, and any information enabling physical or online contact with a specific individual.
Parental Consent Requirements
Researchers must obtain explicit consent from parents or guardians before collecting any personal information. An operator must choose a method reasonably designed in light of available technology to ensure that the person giving the consent is the child's parent.
Acceptable methods include phone calls, postal mail, multistep email verification, or digital signatures with identity verification. When amended rules take effect, you will also be able to collect verifiable consent using a 'text plus' method, which works similarly to the email plus method, except the initial verification goes to the parent's cell phone instead of their email address.
Your Rights as a Parent
Your privacy policy must tell parents that the parent can review or delete the child's personal information and refuse to permit further collection or use of that information, and state the procedures for doing so. The rule requires covered operators to only retain personal information for as long as reasonably necessary to fulfill a specific purpose for which it was collected, and explicitly states that operators cannot retain the information indefinitely.