What is COPPA? A plain-English guide for parents

COPPA is the Children's Online Privacy Protection Act, a U.S. law that requires apps and websites aimed at children under 13 to get a parent's permission before collecting personal information from them. It sets rules for what companies can gather, how they explain it, and your right to see and delete what they hold. It is a floor, not a ceiling, and it leaves real gaps that a careful parent should know about.

Before anything else, the practical takeaway: a COPPA badge on an app tells you a company followed a disclosure process. It does not tell you the app is good for your child, or that its data practices are strong. You still have to read and ask.

What COPPA actually protects

The law covers online services that are directed at children under 13, or that know they have users under 13. When one of those services wants to collect personal information from a child, it has to do a few specific things.

• Post a clear privacy policy that says what it collects and why.
• Get verifiable parental consent before collecting personal information from a child.
• Let you review the information collected about your child.
• Let you delete that information and refuse further collection.
• Keep the data only as long as it is needed, and secure it reasonably.

"Personal information" under COPPA is broader than many parents expect. It includes name, address, and email, and also things like a photo, a voice recording, a persistent identifier such as a device ID or cookie that tracks a child across sites, and geolocation. That last group matters, because a lot of tracking happens quietly through identifiers rather than through a form that asks for a name.

What COPPA does not do

This is where most of the confusion lives. COPPA is narrower than it sounds.

It stops at age 13

The protections apply to children under 13. A 13, 14, or 15 year old gets no special federal privacy shield from this law, even though they are still minors and still growing up online. If you are parenting a teen, COPPA is not the safety net you might assume it is.

It is about consent, not quality

COPPA governs disclosure and permission. It does not judge whether an app is educational, age-appropriate, or emotionally safe. A company can be fully compliant and still show your child ads, nudge them toward longer sessions, or build a design that keeps them hooked.

It relies on what a company "knows"

Many general-audience apps sidestep COPPA by setting a minimum age of 13 in their terms and claiming they are not directed at younger children. Kids under 13 use those apps anyway. When that happens, the app often treats them as if they were adults, with adult data collection.

It does not cover schools cleanly

When a school signs up a class for a service, the school can sometimes provide consent on parents' behalf. That does not always mean parents were told what was collected. If your child uses software assigned by a teacher, COPPA alone will not tell you much. Our guide on AI in schools and what parents should know covers the questions worth raising with the district.

The questions to ask any app

You do not need to be a lawyer to evaluate an app. A short list of plain questions gets you most of the way.

1. What personal information do you collect from my child, and why?
2. Do you use persistent identifiers or track my child across other sites and apps?
3. Is any of my child's data used to train AI models or shared with third parties?
4. Can I see everything you hold about my child, and can I delete it?
5. Do you show ads, and are they targeted based on my child's activity?
6. How long do you keep data after my child stops using the app?

If an app cannot answer these in plain language, that itself is an answer. A company confident in its practices tends to explain them without hedging.

Why we built privacy in before the child ever types

Most privacy policies describe what a company does with your child's data after it is collected. We took a different starting point. Sorin is an AI tutoring companion for ages 6 to 15, and the first thing we built was Privacy Guard, which anonymizes a child's information before any request reaches an AI model.

In practice, that means names, locations, and other identifying details are stripped or replaced with pseudonyms before the tutoring request leaves. The AI helps with the schoolwork without ever receiving the identity of the child behind it. You can read exactly what Privacy Guard redacts and pseudonymizes if you want the technical detail.

We pair that with controls COPPA gestures at but few products make easy: parents get transcripts of what their child discussed, alerts when something needs attention, and one-tap deletion. The point is not to meet a legal floor. It is to give you the visibility you would want as a parent, and to keep working long after age 13, when the law walks away.

If you are weighing AI tools more broadly, our parent's guide to whether AI is safe for kids ends with a checklist you can apply the same night.

FAQ

What age does COPPA cover?

COPPA protects children under 13. Once a child turns 13, the law no longer applies to them, even though they are still a minor. That is why privacy habits and product choices matter well into the teen years.

Does a COPPA-compliant app mean it is safe for my child?

No. COPPA compliance means a company followed rules about disclosure and parental consent. It says nothing about whether the app is age-appropriate, ad-free, or good for your child's attention and wellbeing.

Can my child's school consent to data collection for me?

In some cases yes. When a service is used for a classroom purpose, a school can sometimes provide consent on parents' behalf. That does not guarantee you were told what is collected, so it is fair to ask the teacher or district directly.

Does COPPA stop apps from using my child's data to train AI?

Not specifically. COPPA requires disclosure and consent for collecting personal information, but it does not ban particular uses like AI training. You have to read the policy or ask the company outright.

What personal information does COPPA count?

More than a name and email. It includes photos, voice recordings, geolocation, and persistent identifiers like cookies or device IDs that track a child across sites. A lot of collection happens through those identifiers rather than a form.

---

Ready to try Sorin with your child? Get started free →