Home › Resources

COPPA Privacy Policy for Kids' Apps: What the Rule and the App Stores Require

Published October 17, 2026 · Checked against the amended 16 CFR Part 312

A COPPA privacy policy is the online notice required by 16 CFR 312.4(d) of the FTC's Children's Online Privacy Protection Rule. If your app or website is directed to children under 13, or you know you collect personal information from a child under 13, the notice must name every operator, describe what you collect from children and how you use and disclose it, publish your written data retention policy, explain any persistent identifiers collected for internal operations, and tell parents how to review, delete and stop further collection. The amended Rule took effect on June 23, 2025, with a compliance date of April 22, 2026.

For apps, the Rule is only half the gate: Google Play's Families Policy and Apple's Kids Category rules add their own SDK, identifier and advertising restrictions. This guide states what each source requires and cites the section. It is not legal advice.

When COPPA Applies to Your App or Website

COPPA covers operators of commercial websites and online services, apps included, that collect personal information from children under 13 (16 CFR 312.2). It applies when your service is directed to children, or when you run a general-audience service and have actual knowledge that a user is under 13.

"Personal information" under 312.2 goes well beyond names and emails. It includes persistent identifiers that recognize a user over time (cookie IDs, IP addresses, device identifiers), photos, video or audio containing a child's image or voice, street-level geolocation and, since the 2025 amendments, biometric identifiers such as voiceprints and facial templates.

What "directed to children" means

The 312.2 definition lists the factors the FTC weighs: subject matter, visual content, animated characters, child-oriented activities and incentives, music, models' ages, language, child-targeted ads, empirical audience data and marketing evidence. Merely linking to a child-directed service does not make yours one.

The mixed-audience test

The 2025 amendments define a mixed audience service as one that meets those factors but does not target children as its primary audience. Before collecting personal information from anyone (beyond the 312.5(c) exceptions), it must run a neutral age screen that does not default to a set age or encourage false answers, then apply COPPA to users who say they are under 13.

What a COPPA Privacy Policy Must Disclose, Clause by Clause

The Rule requires two notices: the public online notice (312.4(d)) and a direct notice to the parent before you collect (312.4(c)). Link the online notice prominently from your home or landing page and from every point where you collect children's information.

The online notice, section by section

1. Operator identity (312.4(d)(1)). Name, address, phone and email of every operator collecting or maintaining children's information through your service. One may be named as the contact for parents if all are listed.
2. Information practices (312.4(d)(2)). What you collect, whether children can make information public, how you use it, the identities or categories of third parties receiving it and why, and your 312.10 data retention policy.
3. Persistent identifiers (312.4(d)(3)). If you rely on the internal-operations exception in 312.5(c)(7), which operations the identifier supports and how you stop it being used to contact a child, for behavioral advertising or to build a profile.
4. Audio files (312.4(d)(4)). If you collect a child's voice under 312.5(c)(9), how it is used and that it is deleted immediately after the request is answered.
5. Parental rights (312.4(d)(5)). That parents can review or delete the child's information and refuse further collection, and how (backed by 312.6).

The direct notice and verifiable parental consent

Under 312.4(c)(1), the direct notice tells the parent that consent is required, what you will collect and disclose, which third parties receive it and why, how to consent, and that contact details collected only for the notice are deleted if the parent does not respond. It must link to the online notice.

Accepted consent methods are listed in 312.5(b)(2): a signed form, a payment card transaction, a call or video conference with trained staff, a checked government ID, knowledge-based questions, a photo ID matched to a live face image, and email plus or text message plus, which are only available if you do not disclose children's information.

The 2025 amendments added 312.5(a)(2): parents must be able to consent to collection without consenting to third-party disclosure, and any disclosure not integral to the service needs separate consent. The FTC's 2025 rulemaking statement names targeted advertising and AI training as not integral.

The written programs behind the policy

Section 312.8 now requires a written information security program with annual risk assessments, plus written assurances from anyone receiving children's data. Section 312.10 requires a written data retention policy giving the purpose, business need and deletion timeframe for each category. Children's information "may not be retained indefinitely", and the retention policy must appear in the online notice.

Platform Gates: Google Play Families Policy and Apple's Kids Category

Both stores make COPPA compliance a listing condition and add stricter technical limits.

Google Play: Families Policy

Select any age group under 13 in Play Console's Target audience and content section and the Families Policy applies:

• Legal compliance. The app and every API and SDK it uses must comply with COPPA, and the app needs a privacy policy that accurately reflects its data practices.
• Restricted identifiers. No transmitting the AAID, SIM serial, build serial, BSSID, MAC, SSID, IMEI or IMSI from children or users of unknown age.
• Self-certified ad SDKs. Ads to children or users of unknown age may only come from SDKs in the Families Self-Certified Ads SDK Program, with no interest-based ads or remarketing.
• Approved SDKs and permissions. Apps that solely target children may not include SDKs unapproved for child-directed services, request location permission, or request AD_ID when targeting API level 33 or higher.

These answers must agree with your Data safety section, so work through Google's Data safety questions one data type at a time before you submit.

Apple: Kids Category rules

• Guideline 1.3 (Kids Category). No links out, purchases or other distractions unless behind a parental gate. No personally identifiable or device information sent to third parties, and no third-party analytics or advertising, except analytics that never collect the IDFA or identifiable information about children or their devices, and contextual ads from services with published Kids Category practices including human review of ad creatives.
• Guideline 5.1.4 (Kids). Ask for birthdate and parental contact only to comply with laws like COPPA. Kids Category apps, and apps collecting personal information from minors, must include a privacy policy. A parental gate is not parental consent.
• Guideline 2.3.8. "For Kids" and "For Children" in metadata are reserved for the Kids Category.

Both stores turn on what your SDKs collect, so list what each bundled analytics and ads SDK collects and remove any that fail Guideline 1.3 or the Families Policy before writing the policy.

Copy-Ready Children's Privacy Disclosure Block

This block follows 312.4(d)(1) through (d)(5) for a child-directed app that obtains parental consent. Replace every bracketed item and delete clauses that don't apply. It is a starting structure, not a guarantee of compliance.

Children's Privacy (Users Under 13)

Who we are. [App name] is operated by [Company legal name],
[street address], [phone], [email]. [List any other operators that
collect children's information through the app, such as plug-in
providers, or state that we are the only operator.]

What we collect from children. With a parent's verifiable consent we
collect: [e.g. first name or nickname, parent email address, game
progress, drawings]. Children [can / cannot] make information
publicly available in the app.

How we use it. We use this information to [run the child's account,
save progress, respond to support requests]. We do not use it for
behavioral advertising or to build profiles.

Persistent identifiers. Without parental consent we collect only
[app instance ID] to support internal operations such as [security
and maintaining the app]. We do not use it to contact a child or for
behavioral advertising.

Who we share it with. We disclose children's information to
[service provider categories, e.g. cloud hosting] solely to operate
the app. [We do not disclose children's information to other third
parties.] / [We will ask for separate parental consent before
disclosing it to (third party) for (purpose).]

How long we keep it. We keep [category] for [period] because
[business need], then delete it. We do not retain children's
personal information indefinitely.

Parents' rights. A parent may review the child's information, ask us
to delete it, and refuse further collection or use by contacting
[email or in-app parent area]. We will verify that you are the
child's parent before acting.

The rest of your policy still has to cover adult users, platforms and SDKs. In the free policy builder, choose "Directed to children" or "Mixed, may include children" for who the app is for, then pick your children's privacy model (parent consent, school consent, mixed age controls or no personal data).

Frequently Asked Questions

This page summarizes the COPPA Rule and app store policies as of the date above; it is not legal advice. Sources: 16 CFR Part 312, FTC children's privacy guidance, Google Play Families Policy, Apple App Review Guidelines.