Privacy & regulation · also called Children’s Online Privacy Protection Act
COPPA
COPPA is the US Children's Online Privacy Protection Act, enforced by the FTC, which requires verifiable parental consent before collecting personal information from children under 13 online.
COPPA applies to websites, apps and online services directed at children under 13, and to general-audience services that knowingly collect personal information from children. The FTC's COPPA Rule defines personal information broadly: since 2013 it includes persistent identifiers such as cookies and device IDs used to track across sites or over time.
In practice, that means child-directed services cannot use behavioral targeting or retargeting without verifiable parental consent. They may still show contextual ads, and some limited uses of identifiers are allowed to "support internal operations", such as frequency capping and fraud prevention. Enforcement has been significant: in 2019 Google and YouTube agreed to pay $170 million to settle FTC and New York allegations of collecting children's data without consent.
The FTC finalised amendments in 2025 that, among other changes, require separate parental consent for disclosing children's data to third parties, including for targeted advertising, and tighten data retention and security requirements, with compliance required from 2026. Ad tech platforms usually honour a COPPA flag in bid requests to switch off personalised ads.
Think of it like this
COPPA is like a rule that no one may ask a child for their address or follow them around the shop without first asking their parents.
An example
A kids' games app in the US marks all ad requests as child-directed. SSPs and DSPs then strip identifiers and serve only contextual ads, and the app avoids passing device IDs to ad partners.
Related terms
PII (personally identifiable information)
PII (personally identifiable information) is information that identifies, or can be used to identify, a specific person, such as a name, email, phone number or government ID number.
Behavioral targeting
Behavioral targeting shows ads to people based on their past online behaviour, such as sites visited, searches, purchases or app use, collected over time and often across different services.
Contextual targeting
Contextual targeting places ads based on the content being viewed, such as the topic, keywords or sentiment of a page, video or app, rather than on data about the individual viewer.
Digital Services Act (DSA)
The Digital Services Act (DSA) is an EU regulation setting rules for online platforms on illegal content, transparency and user protection, including ad labelling, targeting limits and public ad repositories.
India DPDP Act
India's Digital Personal Data Protection (DPDP) Act 2023 is the country's main data protection law, with Rules notified in November 2025 that bring its obligations into force in phases.
Sources: FTC: Children’s Online Privacy Protection Rule (COPPA), FTC finalizes changes to children’s privacy rule (January 2025), FTC: Complying with COPPA, frequently asked questions