What must a COPPA privacy policy include?

The Rule (§ 312.4) lists the contents, including who collects the data, what you collect and how you use and disclose it, and parents’ rights to review and delete. Read 16 CFR 312.4 and get legal advice.

Does COPPA apply to apps outside the US?

The FTC applies COPPA to foreign operators whose services are directed to, or knowingly collect from, children in the US. This is not legal advice.

FTC COPPA Rule (16 CFR Part 312) · Platform guide

Privacy policy for kids’ apps (COPPA)

If your app is directed to children under 13 or knowingly collects their data, the FTC’s COPPA Rule (16 CFR Part 312) requires a prominent, clearly labeled link to an online notice of your practices, verifiable parental consent before collecting personal information, and keeping children’s data only as long as reasonably necessary. Not legal advice.

§ 1

What FTC COPPA Rule (16 CFR Part 312) requires

§ 312.4(d) Notice on the website or online service

“an operator must post a prominent and clearly labeled link to an online notice of its information practices with regard to children on the home or landing page or screen of its website or online service”

Source: ecfr.gov verified 2026-10-30

1.1Verifiable parental consent (§ 312.5). Operators must “obtain verifiable parental consent before any collection, use, or disclosure of personal information from children”. Source: ecfr.gov

1.2Retention (§ 312.10). Keep children’s data “for only as long as is reasonably necessary to fulfill the specific purpose(s) for which the information was collected.” It “may not be retained indefinitely.” Source: ecfr.gov

1.3Google Play Families. Google Play’s Families policy requires apps in the program to protect children’s privacy, use only self-certified ad SDKs, and have a privacy policy that accurately reflects their data practices. Source: support.google.com

1.4Apple Kids Category (Guideline 1.3). Kids Category apps “must not include links out of the app, purchasing opportunities, or other distractions to kids unless reserved for a designated area behind a parental gate.” Source: developer.apple.com

§ 2

What common SDKs collect

SDK / API	Data it collects	Source
Ad SDKs in Families apps	Must be Google Play Families self-certified ad SDKs No personalized advertising to children	Source: support.google.com

Everything in this table must appear in your policy if the SDK ships in your build.

§ 3

Where to put the URL

3.1Home or landing screen of the app: a prominent, clearly labeled link to the notice.
3.2Every screen where you collect personal information from children, close to the request.
3.3Store listings (App Store Connect, Play Console).

Source: ecfr.gov

§ 4

Sample clause

§ 4.1 · Children’s information

Our app is designed for children. We do not collect personal information from children without first getting a parent’s verifiable consent. We collect only a nickname and game progress, keep it only while the account is active, and delete it on a parent’s request. We do not show personalized ads.

Illustrative wording. Your generated policy is written from your own answers.

§ 5

Questions

What must a COPPA privacy policy include?: The Rule (§ 312.4) lists the contents, including who collects the data, what you collect and how you use and disclose it, and parents’ rights to review and delete. Read 16 CFR 312.4 and get legal advice.
Does COPPA apply to apps outside the US?: The FTC applies COPPA to foreign operators whose services are directed to, or knowingly collect from, children in the US. This is not legal advice.