What is a coppa? Things all founders need to know before launching a product

You have just built the perfect product, educational tools for kids. Shared on Product Hunt, Reddit and social media. The launch day was a victory. Sign up is faster. People paid. The momentum was real.

Then, a few days later, the FTC appeared in my inbox.

You are investigating for marketing to children under 13 without parental consent. And now you’re staring at a barrel of fines that can fill your startup. Everything was because of the law, you probably didn’t know: Coppa.

The Children’s Online Privacy Protection Act may sound like a niche rule, but it applies much more widely than you think. If your app looks like it could collect data, run ads, or attract younger users, you’re already in a dangerous territory.

Here’s what every founder should know before hitting a publish:

What is a coppa?

The Children’s Online Privacy Protection Act (COPPA) is a US law passed in 1998 and enacted by the Federal Trade Commission (FTC). We set rules for how our website and online services collect personal information from children under the age of 13.

It’s not just games and apps for toddlers. COPPA covers digital products targeting children or intentionally collects data from children. This includes all tools including analytics, advertising platforms and tracking.

If you ignore it, you could face a fine of up to $43,280 per child for each violation.

What is “personal information” under COPPA?

Founders often assume that if they don’t ask for names or emails they are clear. That’s a dangerous assumption.

Coppa casts a wide range of nets. The following is considered personal information:

Full Name Home Address Email Address Phone Number IP Address Location Data User Name Persistence Identifier (Cookie, Device ID, Pixel Tracking) Photo, Audio, or Video Content

If your product uses ad tracking, analytics, or building user profiles, we may collect data that is subject to COPPA.

What triggers COPPA compliance?

You will be eligible for COPPA if:

Your product is built for children under 13. Users under 13 know that they use your product

FTC not only looks at the age area of ​​the site, but also evaluates the appearance, reading and how the product is sold. This includes visuals, words, subject matter, and even the channels used to promote it. If your site has bright colors, cartoon characters, fun voices, school-related themes, or something similar to Saturday morning cartoons, you can consider it to target children, even if it wasn’t your intention.

Even if you’re not actively collecting data, a third-party script or tool embedded in your site may be doing it for you. Therefore, it is important to audit not only the content but the technology running behind the scenes. What appears to be harmless could raise a red flag with regulators.

Real World Meaning: If your product has cartoon-style designs, fun characters, or content that appeals to children, the FTC may interpret it as “directed towards children.”

Even if you don’t mean you can trigger a coppa and prohibit:

Retargeting users running ads using Google Analytics

Worse, if you use third-party tools like pixels and behavioral analysis tracking, they may be collecting data without your knowledge, but are responsible.

Things you can’t do without your parents’ consent

If your app or site falls under COPPA and does not grant guaranteed parental consent, you are not permitted to:

We collect personal data from children under the age of 13.

Real World Examples

In 2019, YouTube was fined $170 million for tracking a child’s viewing habits without parental consent. The platform intentionally provided behavioral advertising to users under the age of 13. This is something that COPPA expressly prohibits. Tiktok was immediately followed with a $5.7 million settlement to collect personal data from children without proper notice or consent.

However, these headings are not limited to famous names. Several small EDTECH startups and gaming platforms have been caught up in similar violations. Some were fined. Others were forced to pivot or shut down completely.

This isn’t just about punishing bad actors at the top. It’s a warning to all founders: COPPA also applies to you.

How Founders Protect themselves

If your product might appeal to your child:

Please add Agegate when users sign up and post a clear disclaimer that it is not for children under 13. Avoid designs aimed at kids unless they are fully compliant. Do not collect user data or run advertisements.

How to become Coppa compliant

This is a practical checklist to stay on the right side of the coppa.

Know your audience – If children under the age of 13 may use your products, you can prevent access to features that do not perform behavioral ads without the consent of the verified parent to prevent minor users from collecting personal information. Branding or messaging that may appeal directly to children maintain a detailed record of consent when building and using data for children

Following these steps will not make you invincible, but it will go far ahead of most founders who don’t pay attention to you.

Conclusion

Coppas are easy to overlook and costly to ignore. If you’re building online about how you can collect user data and attract children, it’s up to you to make sure you’re clear.

I know the rules. Look at your design. Open your eyes and start it.