COPPA and AI Apps, Explained for Parents

What is COPPA?

COPPA is the Children's Online Privacy Protection Act, a U.S. federal law enforced by the FTC. In plain language, it says: if an online service is directed to children under 13 — or if the operator has actual knowledge it is collecting personal information from a child under 13 — the operator must get a parent's verifiable consent first, tell the parent what it collects and why, let the parent review or delete that information, and keep it secure. Fines for violations run into the millions of dollars per case, and the FTC updated the rule in 2025 to tighten data-retention and third-party disclosure requirements.

How COPPA applies to AI apps

AI chatbots make COPPA harder, not easier. Every prompt a child types is potentially personal information: names, ages, schools, feelings, health details, photos. If a bot remembers a child across sessions, personalizes responses, or sends data to a third-party model provider, that all counts as collection, use, and disclosure under COPPA. Practically, an AI app that serves under-13s (or that a reasonable operator would know is being used by under-13s) needs verifiable parental consent before the first prompt, a child-specific privacy notice, data minimization by default, contracts with any model provider that limit training on child data, and a way for a parent to view or delete what the child has shared.

What data is protected

COPPA's definition of "personal information" is broad and covers more than just name and email. It includes:

• First and last name, home or physical address, and phone number
• Email address, screen name, or any identifier that lets someone contact the child
• Social Security number
• Persistent identifiers — cookies, device IDs, IP addresses — used to track over time
• Photos, video, or audio containing the child's image or voice
• Geolocation data precise enough to identify a street or building
• Any information the operator collects online from the child that is combined with the items above — including free-form chat content, drawings, or files uploaded in a session

Questions to ask before signing your kid up

Before you let a child use an AI app or create an account, get answers to these seven questions — most reputable apps answer them in their privacy policy or a dedicated children's-privacy page:

1. Does this service knowingly allow users under 13, and if so, how does it get my consent?
2. What exactly is collected from my child, including the content of prompts and uploads?
3. Is my child's data used to train AI models, either by this company or a third party?
4. Who else receives this data — model providers, ad networks, analytics vendors?
5. How long is it kept, and can I delete my child's account and history on request?
6. What safety controls exist — content filters, crisis routing, parental dashboards?
7. Where can I contact a human about a privacy or safety issue, and how fast do they respond?

For builders, see our guide to a COPPA-compliant compliance layer, or try the Kid-Safe AI Playground.