Perform child-data security risk assessments at least annually
Under Children's Online Privacy Protection Rule (COPPA Rule)
Perform additional internal/external risk and safeguard-sufficiency assessments at least once annually. The operator chooses the initial annual review date. Imported research notes (check before approving): • Duty holder: regulated entity (Covered commercial website or online service operator, including qualifying mixed-audience and actual-knowledge operators) • Timing in the source: "at least annually"
When it’s due
at least annually — exact deadline not calculated
When you track it, you set the due date that applies to you. Remindash schedules reminders before it.
From the source
Open source document ↗“at least annually, perform additional assessments to identify internal and external risks”16 CFR § 312.8(b)(2), 16 CFR § 312.8(b)(2) · COPPA Rule
Key information
- Obligation type
- Assessment
- Frequency
- Annually
- Applies to
- Covered commercial website or online service operator, including qualifying mixed-audience and actual-knowledge operators; consult section-specific exceptions, parental consent exceptions and the 2026 FTC age-verification enforcement policy.
- Suggested owner
- Privacy and Security Lead
- Source
- 16 CFR § 312.8(b)(2), 16 CFR § 312.8(b)(2)
- Policy last reviewed
- Oct 31, 2026
Check that it applies to you. This requirement was identified from the source document. Whether it applies depends on your organization’s circumstances — review the official source and get professional advice where appropriate.