How does COPPA apply to programmatic advertising?
Part of US and Canada targeting
The short answer
COPPA applies to operators of websites or online services directed to children under 13, and to operators with actual knowledge that they collect personal information from a child under 13. In programmatic buying it reaches ad networks and bidders on child directed sites, where a persistent identifier counts as personal information. The rule counts contextual ads as internal operations support.
Key takeaways
- The COPPA Rule counts a persistent identifier, such as a cookie ID, IP address or device ID, as personal information, so a normal bid request from a child directed site can carry it.
- A service is deemed directed to children when it has actual knowledge that it collects personal information directly from users of another child directed service, which is how ad networks and bidders come into scope.
- Serving contextual advertising and capping frequency are listed as support for internal operations, provided the data is not used for behavioral advertising or to build a profile.
- The amended rule took effect June 23, 2025, and regulated entities had until April 22, 2026 to comply; it requires separate parental consent before disclosing a child's information to third parties, such as for targeted advertising.
- OpenRTB carries a coppa flag in the Regs object, 1 when the request is subject to the FTC's COPPA regulations.
How does COPPA apply to programmatic advertising?
The FTC's COPPA Rule page (opens in a new tab) states the scope: COPPA imposes certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age. Programmatic advertising meets that scope through the identifiers an ad call carries.
Definition
- Persistent identifier, in the COPPA Rule
- One of the listed kinds of personal information: an identifier that can be used to recognize a user over time and across different websites or online services, including a customer number held in a cookie, an IP address, a processor or device serial number, or a unique device identifier.
The rule's definitions, at 16 CFR 312.2 (opens in a new tab), also say that a website or online service shall be deemed directed to children when it has actual knowledge that it is collecting personal information directly from users of another website or online service directed to children. An ad network or bidder that collects identifiers on a child directed app, with actual knowledge of that app's nature, is therefore inside the rule. The FTC's COPPA FAQ (opens in a new tab) adds that the rule holds the site operator liable for collection that occurs on or through its sites, even when a third party does the collecting.
| Party | Route into the rule | Source wording |
|---|---|---|
| Child directed site or app | Operator of a service directed to children | Requirements on operators of websites or online services directed to children under 13 |
| Ad network, SSP or bidder collecting identifiers there | Actual knowledge that it collects from users of a child directed service | Deemed directed to children when it has that actual knowledge |
| General audience site | Actual knowledge of collecting from a specific child | Operators with actual knowledge that they collect personal information from a child under 13 |
| Mixed audience site | Directed to children by the factors, but children are not the primary audience | Not deemed directed to children for any visitor not identified as under 13 |
What makes a website directed to children?
Section 312.2 lists what the Commission considers when deciding whether a website or online service, or a portion of one, is directed to children. The factors below follow the current, amended text, grouped by theme.
The Commission's directed to children factors, as written in 16 CFR 312.2
- Subject matter, visual content, language or other characteristics of the site or service.
- Use of animated characters or child oriented activities and incentives, and music or other audio content.
- Age of models, and presence of child celebrities or celebrities who appeal to children.
- Whether advertising promoting or appearing on the site or service is directed to children.
- Competent and reliable empirical evidence on audience composition, and evidence on the intended audience, including marketing or promotional materials or plans, representations to consumers or third parties, reviews, and the age of users on similar services.
Two limits sit in the same definition. A site is not deemed directed to children solely because it links to a child directed site through a directory, index or hypertext link. And the FAQ says receiving a list of purportedly child directed sites alone is unlikely to create actual knowledge for an ad network, while a direct statement from the content provider, or recognition by the network's own representative, is likely to.
What did the amended COPPA Rule require by April 2026?
The FTC finalized amendments to the COPPA Rule in January 2025. The amended rule was published in the Federal Register on April 22, 2025, took effect June 23, 2025, and regulated entities had until April 22, 2026 to comply, except for three provisions of the safe harbor section. The FTC's January 16, 2025 release (opens in a new tab) said operators would be required to obtain separate verifiable parental consent to disclose children's personal information to third parties, such as for targeted advertising.
| Provision | What the current text requires |
|---|---|
| Section 312.5(a)(2), separate consent | An operator must let a parent consent to collection and use without consenting to disclosure to third parties, unless disclosure is integral to the service, and must obtain separate verifiable parental consent to that disclosure |
| Section 312.4, notice | The notice names the identities and specific categories of third parties receiving personal information and the purposes, and, if a persistent identifier is collected for internal operations, which operations and how it is kept from behavioral advertising |
| Section 312.8, security | A written information security program with safeguards suited to the sensitivity of children's information and the operator's size |
| Section 312.10, retention | Information may not be kept indefinitely; a written data retention policy sets the purposes, the business need and a timeframe for deletion, published in the notice |
| Section 312.2, directed to children | Audience evidence now explicitly includes marketing plans, representations to third parties, reviews and the age of users on similar services |
The compliance date has passed, so these provisions describe the rule in force. For YouTube specifically, where Google applies its own made for kids label and restrictions, see the cluster's made for kids YouTube ads guide.
How do bid requests flag child directed inventory?
The OpenRTB 2.6 specification (opens in a new tab) gives the Regs object a coppa field: an integer flag indicating whether the request is subject to the COPPA regulations established by the USA FTC, where 0 means no and 1 means yes. The Regs object, the specification says, contains any legal, governmental or industry regulations that the sender deems applicable to the request.
The FTC FAQ explains why such a signal matters. In its answer on signaling systems, an ad network may ordinarily rely on a not child directed signal only if the first party affirmatively selected it, not as a default the network set, and concrete contrary evidence can still establish actual knowledge. A flag of 0 on a bid request is therefore a statement by the sender, not a finding.
Four checks a buyer can run on child directed supply
- Ask how the flag is set. Find out whether each seller sets regs.coppa from the publisher's own declaration, per site or app, or by default.
- Read the bid logs. Where the buying platform exposes request fields, confirm which impressions arrived with coppa set to 1.
- Match creative to the flag. Confirm that impressions flagged 1 receive only contextual creative with no third party tracking tags or pixels.
- Record contrary evidence. If a site's content plainly addresses children but its requests arrive with the flag at 0, note it with the date and the evidence.
Can contextual ads run on child directed sites?
Yes, within limits the rule writes down. Section 312.2 defines support for the internal operations of a website or online service to include activities necessary to serve contextual advertising on the website or online service or cap the frequency of advertising. Under section 312.5(c)(7), an operator may collect a persistent identifier and no other personal information without prior parental consent when the identifier is used solely for that support, with the notice the rule requires.
The same definition sets the limit: information collected for those activities cannot be used or disclosed to contact a specific individual, including through behavioral advertising, to amass a profile on a specific individual, or for any other purpose. The FTC FAQ advises operators of child directed properties to find out, before letting anyone serve ads, whether they can limit the ads to contextual only with no behavioral targeting, and which data the ads would collect.
Fictional example. Unnamed brand, no results implied.
An Orlando family water park separates its buys
An unnamed family water park in Orlando, Florida, wants display and video ads in the US Southeast beside family travel, parenting and Florida vacation content. The planner splits the plan into two lines and records why.
The main line runs on general audience travel and parenting publishers written for adults, with the brand's normal measurement. A second line, for any impression flagged coppa 1, carries only contextual creative chosen for the page's topic, with no retargeting list, no third party pixels and no audience segment, and the plan notes each seller's answer on how the flag is set.
Contextual selection reduces what moves with the impression; it does not settle whether a given site is child directed, which turns on the factors in section 312.2.
How can a site list be built without personal data?
A contextual site list starts from what pages are about. PlacementGraph builds lists that way.
Frequently asked questions
Does COPPA apply to a general audience site that some children visit?
A general audience operator is covered when it has actual knowledge that it is collecting personal information from a child under 13. A mixed audience service, directed to children by the factors but not as its primary audience, may screen visitors by age in a neutral way before collecting personal information.
Is frequency capping allowed on child directed inventory?
The rule's definition of support for internal operations includes activities necessary to cap the frequency of advertising, alongside serving contextual ads. Information collected for that purpose still cannot be used for behavioral advertising, to amass a profile on a specific individual, or for any other purpose.
Does a list of child directed sites give an ad network actual knowledge?
The FTC FAQ says receiving a list of purportedly child directed sites alone is unlikely to constitute actual knowledge, and that there is no duty to investigate. Concrete information, such as screenshots showing a site's child directed nature, could create actual knowledge.
Does COPPA apply to campaigns in Canada?
COPPA is a US federal rule enforced by the FTC. Quebec has its own ban on commercial advertising directed at children under 13 in its Consumer Protection Act, which regulates the ad rather than the data; the cluster's Quebec advertising to children page sets out that rule.
Sources
- Children's Online Privacy Protection Rule (COPPA) (opens in a new tab)Federal Trade Commission
- 16 CFR Part 312, Children's Online Privacy Protection Rule, section 312.2 Definitions (opens in a new tab)Electronic Code of Federal Regulations
- Complying with COPPA: Frequently Asked Questions (opens in a new tab)Federal Trade Commission
- FTC Finalizes Changes to Children's Privacy Rule Limiting Companies' Ability to Monetize Kids' Data (January 16, 2025) (opens in a new tab)Federal Trade Commission
- OpenRTB 2.6 specification (Regs object) (opens in a new tab)IAB Tech Lab
Researched and written by PlacementGraph Research. Read how we research, source and update these pages. Corrections: diana@placementgraph.com.