Children's Online Privacy Protection Act (COPPA)

The Children's Online Privacy Protection Act is a United States federal law. It is codified at 15 U.S.C. §§ 6501–6506. The FTC enforces it through the COPPA Rule at 16 CFR Part 312. The statute covers operators of websites and online services directed to children under 13. It also covers operators that have actual knowledge they are collecting personal information from a child under 13.

Before those operators collect personal information, they must provide a clear privacy notice and get verifiable parental consent. Parents have rights to review the information collected from their child, to refuse further use or collection, and to have the information deleted. Operators also have duties around data security and around keeping personal information only as long as they need it.

The FTC amended the COPPA Rule in 2025. The amendments were published in the Federal Register on April 22, 2025. The amended rule took effect on June 23, 2025. Operators had until April 22, 2026 to comply with most of the new requirements. The notice sets earlier dates for 16 CFR § 312.11(d)(1), (d)(4), and (g). The FTC described the changes as a way to strengthen protection of children's personal information.

Children under 13 cannot meaningfully agree to a long privacy policy. COPPA puts that decision with a parent, and it puts the duty on the company. Personal information under the rule is broader than a name and address. It can include persistent identifiers, photos, voice, and other data that can be tied to a child. When an AI chat stores what a child types, that record can be personal information.

For families, COPPA is the reason a serious kids' service asks a parent to create the account or to approve collection. A birthday typed by the child, with no further check, is not the end of the analysis. The FTC looks at whether the service is directed to children and whether the operator has actual knowledge of a child's age.

For schools and businesses, COPPA is a design constraint. A tool used with children under 13 still needs a lawful path for collection. One path is the school acting for the parent in a school-authorized educational context, within the limits the rule describes. The team should be able to explain that path in plain language.

On HeyOtto, the parent is the account holder. A child under 13 does not self-enroll. Verifiable parental consent is part of that setup. There are no ads. Kids' chats are not sold, and conversations are not used to train models.