COPPA and Apps That Collect Data from Minors: What Florida Developers Should Know

Requirements under COPPA vary by product, audience, and data collected. This post is informational. If your app or platform reaches children, consult a licensed attorney about your specific situation before relying on general guidance.

Most developers who run into COPPA problems did not set out to build a children’s product. They built a general-audience app, added an age gate, and assumed that covered it. It often does not.

The Children’s Online Privacy Protection Act is a federal statute with FTC enforcement authority and substantial civil penalties. It applies more broadly than many developers expect, and the defenses that seem intuitive (“we have a terms of service,” “we require users to confirm they’re 13+”) do not hold up the way you might assume.

What COPPA covers

COPPA applies to operators of websites and online services that are either (1) directed to children under 13, or (2) have actual knowledge that they are collecting personal information from a child under 13.

“Personal information” under COPPA is broad. It includes the obvious categories (name, address, phone number, email) but also device identifiers, IP addresses, photos, videos, audio files, and geolocation data. If your app collects analytics data and device identifiers (which most apps do), you are collecting personal information within the meaning of COPPA.

The “directed to children” analysis is a multi-factor test, not a single bright line. Regulators look at the subject matter of the website or service, visual content, music or other audio content, the use of animated characters, celebrities appealing to children, activities or incentives that suggest a child audience, and the age of actual users. An app about youth sports, a tutoring platform, or a game with characters that appeal to children may qualify as directed to children regardless of what the terms of service say about the target audience.

The actual-knowledge standard

This is where general-audience products most commonly run into trouble.

Even if your app does not qualify as directed to children, COPPA obligations apply when you have actual knowledge that a child is using the product. “Actual knowledge” is interpreted broadly. If a user tells you their age (in a registration flow, in a support ticket, anywhere) and that age is under 13, you have actual knowledge.

A registration flow that asks “Are you 13 or older? Yes / No” creates a record. If a user clicks “No,” you now have actual knowledge. What do you do with that? If your flow simply redirects them or prevents account creation without taking further steps regarding data already collected, you may still have an exposure.

Mixed-audience products (apps with no age restriction that are popular with both adults and minors) require particular attention. The FTC has brought enforcement actions against apps that were aware of their minor user base but continued to collect data without COPPA compliance measures.

Six key COPPA obligations

If COPPA applies to your product, these are the core requirements.

Verifiable parental consent. Before collecting personal information from a child under 13, you need verifiable parental consent. Not just a checkbox. Verifiable consent requires mechanisms the FTC has blessed: signed consent forms, credit card confirmation, toll-free call-in, video conference verification. The standard is higher than you might expect.

Clear privacy notice. You must have a privacy notice on your homepage and at every point where personal information is collected from children. The notice must describe what you collect, how you use it, and your disclosure practices. It must be in plain language.

Data minimization. You may collect only as much personal information as reasonably necessary to provide the service. The COPPA rule explicitly prohibits making a child’s participation contingent on collecting more information than is necessary.

Retention limits. Personal information collected from children must be retained only as long as reasonably necessary to fulfill the purpose for which it was collected, and then securely disposed of.

Reasonable security. You must maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children.

Parental rights to access and delete. Parents have the right to review their child’s personal information and request deletion. You need a mechanism for honoring these requests and a policy that describes how to exercise them.

Common mistakes app developers make

Assuming the age gate is sufficient. An age gate that prevents users from selecting an age under 13 does not eliminate COPPA exposure. If users can circumvent it, or if the app is otherwise attractive to minors, or if users elsewhere disclose that they are under 13, you may have actual knowledge regardless of the gate.

Relying on terms of service to shift liability. A provision that says “you represent you are 13 or older” does not transfer COPPA liability to the user. COPPA obligations run with the operator. If minors are using the product and providing personal information, the compliance obligation is yours, not theirs.

Failing to update the privacy notice when features change. COPPA notices must accurately describe current data practices. Adding a feature that collects a new category of data (location, for example, or photos) requires updating the notice and potentially the consent process.

Treating analytics identifiers as not personal information. Device identifiers, IP addresses, and persistent identifiers used for analytics are personal information under COPPA. If your analytics SDK is capturing these from child users, it counts.

Ignoring sub-processor obligations. If you share personal information from child users with third-party service providers (analytics platforms, ad networks, customer support tools), COPPA requires specific contractual protections and, in many cases, restricts sharing with advertising-related services entirely.

What to do if you are not sure

The first step is a COPPA risk assessment: who actually uses the product, what data is actually collected, and what disclosures and consent processes are actually in place. For apps in spaces that commonly attract minors (education, sports, gaming, entertainment), that assessment should happen before the next feature launch, not after an FTC inquiry.

COPPA enforcement has been active, and civil penalties in significant cases have been substantial. If your app or platform reaches children, talk to MB Legal before your next release.

This post is informational and does not constitute legal advice. COPPA requirements vary by fact pattern and product structure. For guidance specific to your app, consult a licensed attorney.