Evaluate and modify the security program at least annually
Under Children's Online Privacy Protection Rule (COPPA Rule)
At least annually evaluate and modify the security program in light of identified risks, tests, new safeguards and material changes. Imported research notes (check before approving): • Duty holder: regulated entity (Covered commercial website or online service operator, including qualifying mixed-audience and actual-knowledge operators) • Timing in the source: "At least annually"
When it’s due
At least annually — exact deadline not calculated
When you track it, you set the due date that applies to you. Remindash schedules reminders before it.
From the source
Open source document ↗“At least annually, evaluate and modify the information security program”16 CFR § 312.8(b)(5), 16 CFR § 312.8(b)(5) · COPPA Rule
Key information
- Obligation type
- Other
- Frequency
- Annually
- Applies to
- Covered commercial website or online service operator, including qualifying mixed-audience and actual-knowledge operators; consult section-specific exceptions, parental consent exceptions and the 2026 FTC age-verification enforcement policy.
- Suggested owner
- Privacy and Security Lead
- Source
- 16 CFR § 312.8(b)(5), 16 CFR § 312.8(b)(5)
- Policy last reviewed
- Oct 31, 2026
Check that it applies to you. This requirement was identified from the source document. Whether it applies depends on your organization’s circumstances — review the official source and get professional advice where appropriate.