COPPA Compliance: What Parents Should Know About Children's Online Privacy

The Children's Online Privacy Protection Act (COPPA) is a United States federal law that requires apps, websites, and online services to obtain verifiable parental consent before collecting personal information from children under the age of 13. Enforced by the Federal Trade Commission (FTC), COPPA gives parents the right to review, delete, and control the data collected about their children — and imposes significant penalties on companies that violate its requirements.

If you use any app or service that collects data from your child's device — including location tracking, contact access, or behavioral monitoring — COPPA compliance is one of the most important factors to evaluate before you sign up.

What Is COPPA and Why Does It Exist?

Congress enacted COPPA in 1998 and the FTC issued its implementing rule (the COPPA Rule) in 2000, with significant updates in 2013. The law was created in response to growing concerns about websites and online services collecting personal information from children without parental knowledge or consent.

COPPA applies to any commercial website, online service, or mobile application that is directed to children under 13, or that has actual knowledge that it is collecting personal information from a child under 13. This includes family monitoring apps, educational platforms, gaming services, and social media sites.

The law covers a broad range of "personal information," including:

• Full name
• Home address
• Email address
• Phone number
• Geolocation information sufficient to identify a street name and city
• Persistent identifiers (cookies, device IDs) used to track a child across sites
• Photos, videos, or audio recordings containing a child's image or voice
• Screen names that function as online contact information

For family location tracking apps, the most relevant categories are geolocation data and persistent identifiers — both of which are collected by virtually every GPS monitoring platform on the market.

What COPPA Requires From Apps and Services

COPPA imposes five core requirements on operators that collect data from children under 13:

1. Clear and Comprehensive Privacy Policy

The operator must post a clear, prominently linked privacy policy describing what information is collected from children, how it is used, and whether it is disclosed to third parties. The policy must be written in plain language — not buried in legal jargon.

2. Direct Notice to Parents

Before collecting any data from a child, the operator must provide direct notice to a parent or guardian explaining exactly what information will be collected, how it will be used, and the parent's rights under COPPA.

3. Verifiable Parental Consent

The operator must obtain verifiable parental consent before collecting, using, or disclosing a child's personal information. The FTC has approved several methods of verification, including:

• Signing and returning a consent form by mail, fax, or electronic scan
• Using a credit card, debit card, or other online payment system where a transaction notification is sent to the parent
• Calling a toll-free number staffed by trained personnel
• Video conferencing with trained personnel
• Government-issued ID checked against a database, with the ID deleted after verification
• Knowledge-based authentication questions

A simple checkbox or "I am over 13" confirmation does not constitute verifiable parental consent. If an app monitoring your child's location only asked you to check a box, that app may not be COPPA compliant.

4. Parental Access and Control

COPPA gives parents the right to:

• Review all personal information collected about their child
• Request deletion of that information
• Refuse further collection and have existing data deleted
• Revoke consent at any time

These rights are not optional features — they are legal requirements. If a monitoring app makes it difficult to view, export, or delete your child's data, that is a compliance red flag.

5. Data Minimization and Security

Operators may collect only as much personal information as is reasonably necessary for the child's participation in the activity. They must also maintain reasonable security procedures to protect the confidentiality, integrity, and availability of the information collected.

How COPPA Applies to Family Location Tracking

Family GPS tracking apps occupy a specific position under COPPA. When a parent installs a monitoring app on a child's device, the app is collecting personal information — most critically, precise geolocation data — from a device used by a minor.

A COPPA-compliant location tracking app must:

• Obtain verifiable parental consent before collecting any data from the child's device
• Clearly explain what location data is collected, how often, and how it is stored
• Allow parents to review all location history and related data
• Allow parents to delete all data at any time
• Allow parents to stop collection entirely and have existing data removed
• Not retain data longer than necessary for the stated purpose
• Not share the child's location data with third parties for purposes unrelated to the service

Jussive was built with COPPA compliance as a foundational design principle. Verifiable parental consent is obtained before any child under 13 is monitored. Parents maintain full control to pause monitoring, modify settings, or permanently delete all collected data at any time. Family location data is never sold, shared with advertisers, or monetized in any form — and all data is encrypted with AES-256.

Red Flags: How to Spot Non-Compliant Apps

Not every family tracking app takes COPPA seriously. Watch for these warning signs:

No consent verification step. If you were able to install the app on your child's device and start collecting location data without any parental identity verification, the app may not be meeting COPPA's consent requirements.

Vague privacy policy. COPPA requires a clear, specific privacy policy explaining data practices related to children. If the privacy policy does not mention children, COPPA, or parental consent, the operator may not have considered these requirements.

No deletion mechanism. If you cannot find a way to delete your child's data — or if deletion requests are met with delays and obstacles — the app is likely not compliant.

Data sharing with third parties. If the privacy policy discloses that location data is shared with advertisers, data brokers, or analytics partners, that sharing almost certainly extends to your child's data. COPPA does not permit sharing a child's personal information for advertising purposes without specific parental consent. Read more about why this matters in our guide on zero-data-sales policies.

Free service with no clear revenue model. If a monitoring app is entirely free, consider how the company makes money. In many cases, the answer is your data — including your child's location history. See our data privacy guide for family tracking apps for a framework to evaluate these trade-offs.

FTC Enforcement: Real Consequences for Violations

The FTC actively enforces COPPA and has pursued hundreds of enforcement actions against companies that violate its requirements. Penalties can be severe:

• The FTC can impose civil penalties of up to $50,120 per violation (as adjusted for inflation)
• "Per violation" can mean per child, per data point, or per day of non-compliance
• Major COPPA settlements have reached tens of millions of dollars

Recent enforcement actions have targeted social media companies, gaming platforms, and educational technology providers. The FTC has signaled that location tracking services directed at or used by families are squarely within its enforcement focus.

For parents, the takeaway is straightforward: COPPA enforcement is real, but it is reactive — violations are often discovered only after harm occurs. The best protection is choosing a service that is proactively compliant, not one that will eventually be forced into compliance by a regulator.

What to Ask Before Choosing a Monitoring App

Before installing any monitoring tool on your child's device, ask these questions:

1. Does the app obtain verifiable parental consent? Not a checkbox — genuine identity verification before any data collection begins.

2. Can I see everything collected about my child? You should have access to all location history, contacts, and metadata at any time.

3. Can I delete everything instantly? Full deletion — not "marked for deletion in 90 days." Actual, permanent removal.

4. Does the app sell data to third parties? The answer should be an unequivocal no. Look for a zero-data-sales policy.

5. What encryption protects my child's data? AES-256 at rest and TLS 1.2+ in transit is the industry standard for sensitive personal information.

6. How long is data retained? Shorter retention windows reduce risk. Indefinite retention creates an ever-growing database of your child's movements and relationships.

COPPA and State Privacy Laws

COPPA is a federal floor, not a ceiling. Several states have enacted additional protections for children's data:

• California (CPRA and CAADCA): Extends protections through age 16 and imposes additional restrictions on profiling and data sales
• Colorado, Connecticut, Virginia, and others: Classify children's data as "sensitive data" requiring heightened protection and explicit consent
• Illinois (BIPA): Adds protections for biometric data collected from minors

These state laws operate alongside COPPA, not instead of it. A monitoring app that complies with COPPA may still fall short of state-level requirements. When evaluating platforms, look for providers that meet the most protective standard across all applicable jurisdictions.

For a broader view of legal considerations around family location monitoring, see our location tracking laws guide for parents.

Frequently Asked Questions

Does COPPA apply to apps that parents install on their child's phone?

Yes. COPPA applies whenever an app or service collects personal information from a child under 13, regardless of who installs it. If a parent installs a GPS tracking app on their child's device and the app collects location data, the app operator must comply with COPPA — including obtaining verifiable parental consent and providing access and deletion rights.

What counts as "verifiable parental consent" under COPPA?

The FTC has approved several methods, including credit card verification with a transaction notification, government ID verification, knowledge-based authentication, video conferencing with trained personnel, and signed consent forms. A simple checkbox or age-gate (such as "Are you over 13?") does not meet the standard. The key requirement is that the method must be reasonably calculated to ensure the person providing consent is actually the child's parent or guardian.

Can I file a COPPA complaint if an app is not compliant?

Yes. Parents can file complaints with the FTC at ftc.gov/complaint. You can also report suspected violations directly to the app's privacy contact. Complaints from parents are a significant driver of FTC enforcement actions, so reporting is meaningful.

Does COPPA apply outside the United States?

COPPA applies to apps and services operated by U.S. companies or directed at children in the United States, regardless of where the child is physically located. Other countries have their own children's privacy laws — the EU's GDPR sets the age of digital consent between 13 and 16 depending on the member state, and the UK's Age Appropriate Design Code imposes additional requirements for services likely to be accessed by children.

How does Jussive handle COPPA compliance?

Jussive obtains verifiable parental consent before any child under 13 is monitored. Parents can review all data collected about their child through the Jussive dashboard, and can pause monitoring, modify settings, or permanently delete all collected data at any time. Location data is encrypted with AES-256, never sold or shared with advertisers, and retained only for the duration specified by the subscription plan.

Back to Family Digital Safety Hub