What practices are prohibited when collecting personal information from children online? Answer in under 100 words. Cite only eCFR (www.ecfr.gov) sources.

Details / How it works

Section 312.3 makes it unlawful for operators of websites, online services, mobile applications, or internet-connected device services directed to children under 13 — or operators with actual knowledge of collecting from a child under 13 — to collect personal information in violation of the COPPA Rule. The general obligations enumerated under the Rule require operators to:

• Provide notice of collection, use, and disclosure practices (§ 312.4).
• Obtain verifiable parental consent prior to collection, use, or disclosure (§ 312.5).
• Provide reasonable parental review and deletion rights (§ 312.6).
• Not condition a child's participation in a game, prize, or activity on disclosure of more personal information than reasonably necessary (§ 312.7).
• Maintain reasonable confidentiality, security, and integrity procedures, including encryption and breach response (§ 312.8).

Numbers & thresholds

Exceptions & edge cases

Section 312.5(c) enumerates nine limited exceptions to the prior-verifiable-parental-consent requirement, including one-time responses to a child's specific request, voluntary parental notice updates, child safety protections, website security/integrity, judicial process, and persistent identifiers used solely for internal operations. An FTC-approved safe harbor program under § 312.11 may also approve additional consent methods that satisfy § 312.5(b)(1).