Independently assess each safe-harbor member’s privacy and security at least annually
Under Children's Online Privacy Protection Rule (COPPA Rule)
An approved safe harbor program must arrange comprehensive independent annual review of each subject operator’s privacy and security policies, practices and representations. Imported research notes (check before approving): • Duty holder: other (FTC-approved COPPA safe harbor program administrator) • Timing in the source: "not less than annually"
When it’s due
not less than annually — exact deadline not calculated
When you track it, you set the due date that applies to you. Remindash schedules reminders before it.
From the source
Open source document ↗“a comprehensive review by the safe harbor program, to be conducted not less than annually”16 CFR § 312.11(b)(2), 16 CFR § 312.11(b)(2) · COPPA Rule
Key information
- Obligation type
- Assessment
- Frequency
- Annually
- Applies to
- FTC-approved COPPA safe harbor program administrator; consult section-specific exceptions, parental consent exceptions and the 2026 FTC age-verification enforcement policy. Logic to review: Only FTC-approved safe harbor administrators are subject to the safe harbor program duties; ordinary operators do not owe these filings.
- Suggested owner
- Safe Harbor Programme Director
- Source
- 16 CFR § 312.11(b)(2), 16 CFR § 312.11(b)(2)
- Policy last reviewed
- Oct 31, 2026
Check that it applies to you. This requirement was identified from the source document. Whether it applies depends on your organization’s circumstances — review the official source and get professional advice where appropriate.