---
title: "What parental consent must a website get before collecting children's personal information? Answer in under 100 words. Cite only eCFR (www.ecfr.gov) sources."
canonical: https://www.m-i-n-d.ai/minds/data-privacy/coppa-parental-consent-requirements
jurisdiction: "US Federal"
last_verified: 2026-08-27
license: CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/
attribution: "Source: MIND (m-i-n-d.ai)"
---

# What parental consent must a website get before collecting children's personal information? Answer in under 100 words. Cite only eCFR (www.ecfr.gov) sources.

Under 16 C.F.R. § 312.5, an operator must obtain verifiable parental consent before any collection, use, or disclosure of personal information from children under 13. The operator must also give parents the option to consent to collection and use without consenting to third-party disclosure, unless integral to the service. Approved methods include signed consent forms, payment-card verification, toll-free calls, video-conference, government-ID checks, knowledge-based authentication, facial recognition, and (for non-disclosing operators) email-plus or text-plus confirmation.

## Details / How it works

Section 312.5(a) requires operators to obtain **verifiable parental consent** prior to collecting, using, or disclosing personal information from children under 13, including for any material change in practices previously consented to. Operators must also offer parents a separate option to consent to collection and use without consenting to disclosure to third parties (unless such disclosure is integral to the website or online service).

## Numbers & thresholds

| Requirement | Standard |
|---|---|
| Protected age group | Children under 13 |
| Consent timing | Prior to any collection, use, or disclosure |
| Separate disclosure consent | Required unless disclosure is integral to the service |
| Knowledge-based authentication | Dynamic, multiple-choice questions; child age 12 or younger could not reasonably ascertain answers |
| Government-ID and selfie match | Deleted promptly after verification |
| Safe-harbor alternative | FTC-approved safe harbor program may approve additional methods under § 312.11 |

## Exceptions & edge cases

Section 312.5(c) lists nine exceptions to prior parental consent, including: (1) collecting a parent's online contact info solely to provide notice and obtain consent; (2) voluntary notice to parents about a child's participation where no other personal information is collected; (3) one-time response to a child's specific request; (4) multiple direct responses to a child's request with parental notice; (5) protecting the safety of a child; (6) security, integrity, judicial process, or law enforcement; (7) persistent identifiers used solely for internal operations; (8) persistent identifiers from users previously registered as not children; and (9) audio files of a child's voice used solely to respond to a specific request.

## Sources

- [1] U.S. Government Publishing Office / Federal Trade Commission — 16 CFR 312.5 — COPPA — verifiable parental consent requirements · https://www.ecfr.gov/current/title-16/section-312.5 · as of 2026-08-27