---
title: "What practices are prohibited when collecting personal information from children online? Answer in under 100 words. Cite only eCFR (www.ecfr.gov) sources."
canonical: https://www.m-i-n-d.ai/minds/data-privacy/coppa-prohibited-practices
jurisdiction: "US Federal"
last_verified: 2026-08-27
license: CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/
attribution: "Source: MIND (m-i-n-d.ai)"
---

# What practices are prohibited when collecting personal information from children online? Answer in under 100 words. Cite only eCFR (www.ecfr.gov) sources.

Under 16 C.F.R. § 312.3, it is unlawful for any operator of a website or online service directed to children under 13 — or any operator with actual knowledge it is collecting personal information from a child under 13 — to collect such information in violation of the COPPA Rule. Operators must provide privacy notice (§ 312.4), obtain verifiable parental consent (§ 312.5), and may not condition a child's participation in activities on excessive disclosures.

## Details / How it works

Section 312.3 makes it unlawful for operators of websites, online services, mobile applications, or internet-connected device services directed to children under 13 — or operators with actual knowledge of collecting from a child under 13 — to collect personal information in violation of the COPPA Rule. The general obligations enumerated under the Rule require operators to:

- Provide notice of collection, use, and disclosure practices (§ 312.4).
- Obtain verifiable parental consent prior to collection, use, or disclosure (§ 312.5).
- Provide reasonable parental review and deletion rights (§ 312.6).
- Not condition a child's participation in a game, prize, or activity on disclosure of more personal information than reasonably necessary (§ 312.7).
- Maintain reasonable confidentiality, security, and integrity procedures, including encryption and breach response (§ 312.8).

## Numbers & thresholds

| Provision | Prohibited Practice | Statutory Hook |
|---|---|---|
| § 312.3 | Collecting personal information from children under 13 in violation of the Rule | 16 C.F.R. § 312.3 |
| § 312.4(b) | Failing to provide notice of collection, use, and disclosure practices | 16 C.F.R. § 312.4 |
| § 312.5 | Collecting, using, or disclosing without verifiable parental consent | 16 C.F.R. § 312.5 |
| § 312.7 | Conditioning participation on disclosure of more personal information than necessary | 16 C.F.R. § 312.7 |

## Exceptions & edge cases

Section 312.5(c) enumerates nine limited exceptions to the prior-verifiable-parental-consent requirement, including one-time responses to a child's specific request, voluntary parental notice updates, child safety protections, website security/integrity, judicial process, and persistent identifiers used solely for internal operations. An FTC-approved safe harbor program under § 312.11 may also approve additional consent methods that satisfy § 312.5(b)(1).

## Sources

- [1] U.S. Government Publishing Office / Federal Trade Commission — 16 CFR 312.3 — COPPA — regulation of unfair or deceptive acts in collecting children's personal information online · https://www.ecfr.gov/current/title-16/section-312.3 · as of 2026-08-27
- [2] U.S. Government Publishing Office / Federal Trade Commission — 16 CFR 312.4 — COPPA — notice requirements for operators collecting children's information · https://www.ecfr.gov/current/title-16/section-312.4 · as of 2026-08-27
- [3] U.S. Government Publishing Office / Federal Trade Commission — 16 CFR 312.5 — COPPA — verifiable parental consent requirements · https://www.ecfr.gov/current/title-16/section-312.5 · as of 2026-08-27