Self-assessment · United States
COPPA Rule — Children’s Online Privacy Self-Assessment
Practical Yes/No/Not applicable review of child privacy practices and, separately, approved safe-harbor administrator obligations. This checklist does not certify legal compliance.
Based on Children's Online Privacy Protection Rule (COPPA Rule) · COPPA consolidated rule research — 31 October 2026 · Federal Trade Commission (FTC) · Reviewed 2026-10-31- Questions
- 10
- Sections
- 2
- Account
- Not needed to start
Scope
What the assessment covers
Every question is shown here before you start, with its source.
Who it may be relevant to: Commercial operators of child-directed online services or services with actual knowledge of under-13 personal-data collection; safe-harbor program sections apply only to approved administrators or participants as indicated.
01Scope, mixed audiences and internal-operations exceptions4 questions
- Have you established a process to meet this requirement: collect age information neutrally for mixed-audience age screening? 16 CFR § 312.2 (mixed audience definition)A mixed-audience service that uses an age screen must not default the age or encourage users to falsify their age. This is a condition of the mixed-audience definition, not a general duty for every service. Answer Not applicable if the condition does not apply; this self-assessment is not a legal certification.
- Have you established a process to meet this requirement: determine age before other personal-information collection on mixed-audience services? 16 CFR § 312.2 (mixed audience definition)To rely on the mixed-audience treatment, do not collect personal information from visitors (except the limited §312.5(c) purposes) before collecting age information or using another reasonably calculated age-determination method. Answer Not applicable if the condition does not apply; this self-assessment is not a legal certification.
- Have you established a process to meet this requirement: restrict internal-operations identifier use and disclosure? 16 CFR § 312.2 (support for internal operations)When relying on the support-for-internal-operations definition, use or disclose identifiers only for enumerated activities; not to contact a person, build a profile, or serve behavioral advertising outside the permitted purposes. Answer Not applicable if the condition does not apply; this self-assessment is not a legal certification.
- Have you established a process to meet this requirement: remove identifying information from child posts before public display when claiming the exclusion? 16 CFR § 312.2 (collection definition)An operator relying on the exclusion for public child postings must take reasonable measures to delete all or virtually all identifying information before publication and from its records. Answer Not applicable if the condition does not apply; this self-assessment is not a legal certification.
02Parental and online notices6 questions
- Have you established a process to meet this requirement: provide direct notice to parents of collection, use and disclosure practices? 16 CFR § 312.4(b)Make reasonable efforts to deliver direct notice to parents of child-data practices, taking account of available technology, before applicable collection and consent. Answer Not applicable if the condition does not apply; this self-assessment is not a legal certification.
- Have you established a process to meet this requirement: notify parents of material changes to previously consented practices? 16 CFR § 312.4(b)Provide direct notice to parents when materially changing collection, use, or disclosure practices for which consent was previously given. Answer Not applicable if the condition does not apply; this self-assessment is not a legal certification.
- Have you established a process to meet this requirement: include all mandatory details in parental-consent direct notice? 16 CFR § 312.4(c)(1)Direct consent notice must cover information collected, purposes, third-party identities or categories and purposes, the separate disclosure choice where applicable, online notice link, consent mechanism and deletion consequence for no consent. Answer Not applicable if the condition does not apply; this self-assessment is not a legal certification.
- Have you established a process to meet this requirement: delete parental and child contact details if consent is not provided in a reasonable time? 16 CFR § 312.4(c)(1)(vii)Where name/contact data were collected solely to obtain parental consent, delete them if consent is not obtained within a reasonable time after notice. Answer Not applicable if the condition does not apply; this self-assessment is not a legal certification.
- Have you established a process to meet this requirement: include prescribed content in optional parental participation notice? 16 CFR § 312.4(c)(2)If voluntarily notifying parents of participation without other personal-data collection, disclose contact-only purpose, non-reuse, right to refuse participation and delete contact information, and link to online notice. Answer Not applicable if the condition does not apply; this self-assessment is not a legal certification.
- Have you established a process to meet this requirement: include prescribed details in multiple-contact parental notice? 16 CFR § 312.4(c)(3)When using the multiple-contact exception, tell parents about contact collection, purpose limitations, refusal and deletion options, nonresponse consequence, and link to online notice. Answer Not applicable if the condition does not apply; this self-assessment is not a legal certification.
What it does
- Records your answers about your current practices
- Shows the source behind every question
- Summarizes your answers by section and lists every No to review
- Lets you keep results and track related obligations with a free account
What it doesn’t establish
- It is not a certification or an audit
- It does not establish that you comply with the law
- It is not legal advice, and it does not decide what applies to you
- It does not verify your answers or require evidence uploads
01
Answer
Yes, No or Not applicable, with optional notes.
02
Saved as you go
Your progress is kept while you work.
03
Review
Check and change answers before you submit.
04
Results
See a summary and keep it in a free workspace.
Sources
Built from the official text
- 0116 CFR Part 312 — Children’s Online Privacy Protection Rule (eCFR current through 29 October 2026)
Official document · Office of the Federal RegisterOfficial text ↗
Related obligations
Duties from this policy you may need to track. A checklist is not a deadline.
- Perform child-data security risk assessments at least annually
- Evaluate and modify the security program at least annually
- Independently assess each safe-harbor member’s privacy and security at least annually
- Submit the annual FTC safe-harbor report by October 22
- Post initial certified-operator list by July 21, 2025
- Submit first triennial safe-harbor technology and assessment report by April 22, 2028
- Submit initial safe-harbor guideline changes by October 22, 2025
This checklist is a self-assessment tool provided for information. It is not legal advice, and completing it does not certify, verify or guarantee compliance with any law or regulation. Review dates you set are your own and are not legal deadlines.
Applicability depends on your circumstances. Review official sources and obtain professional advice where appropriate.
Ready to see where you stand?
10 questions across 2 sections. Start now — no account needed.