Minds → Data Privacy → What parental consent must a website get before collecting children's personal information? Answer in under 100 words. Cite only eCFR (www.ecfr.gov) sources.

US Federal

What parental consent must a website get before collecting children's personal information? Answer in under 100 words. Cite only eCFR (www.ecfr.gov) sources.

Under 16 C.F.R. § 312.5, an operator must obtain verifiable parental consent before any collection, use, or disclosure of personal information from children under 13. The operator must also give parents the option to consent to collection and use without consenting to third-party disclosure, unless integral to the service. Approved methods include signed consent forms, payment-card verification, toll-free calls, video-conference, government-ID checks, knowledge-based authentication, facial recognition, and (for non-disclosing operators) email-plus or text-plus confirmation.

Last verified: 2026-08-27 · Sources checked: 1/1 resolving · Next scheduled review: 2026-11-25

Details / How it works

Section 312.5(a) requires operators to obtain verifiable parental consent prior to collecting, using, or disclosing personal information from children under 13, including for any material change in practices previously consented to. Operators must also offer parents a separate option to consent to collection and use without consenting to disclosure to third parties (unless such disclosure is integral to the website or online service).

Numbers & thresholds

Requirement	Standard
Protected age group	Children under 13
Consent timing	Prior to any collection, use, or disclosure
Separate disclosure consent	Required unless disclosure is integral to the service
Knowledge-based authentication	Dynamic, multiple-choice questions; child age 12 or younger could not reasonably ascertain answers
Government-ID and selfie match	Deleted promptly after verification
Safe-harbor alternative	FTC-approved safe harbor program may approve additional methods under § 312.11

Exceptions & edge cases

Section 312.5(c) lists nine exceptions to prior parental consent, including: (1) collecting a parent's online contact info solely to provide notice and obtain consent; (2) voluntary notice to parents about a child's participation where no other personal information is collected; (3) one-time response to a child's specific request; (4) multiple direct responses to a child's request with parental notice; (5) protecting the safety of a child; (6) security, integrity, judicial process, or law enforcement; (7) persistent identifiers used solely for internal operations; (8) persistent identifiers from users previously registered as not children; and (9) audio files of a child's voice used solely to respond to a specific request.

Sources

[1]U.S. Government Publishing Office / Federal Trade Commission — 16 CFR 312.5 — COPPA — verifiable parental consent requirements · as of 2026-08-27

Ask this MIND

This answer is static and source-locked. Ask Data Privacy your version of this question.

This is general information, not advice. Data Privacy summarizes primary sources (FTC, State Attorneys General, NIST) as of the dates shown. It is not tax/legal/immigration advice and doesn’t account for your situation. Consult a qualified professional before acting. About this MIND

This page is one mind’s knowledge, published.

MIND turns your documents into a queryable, citable knowledge graph.

Make your own MIND →

Content licensed CC BY 4.0 · Attribution: "Source: MIND (m-i-n-d.ai)" · License terms