COPPA, the Children’s Online Privacy Protection Act, is a U.S. law that applies to online services collecting personal data from children under 13. It requires clear notice, verifiable parental consent before most data collection, and parental rights to review, delete, or block further use of a child’s information.
In cyber security, COPPA matters because it shapes how platforms design account creation, age checks, analytics, advertising, and messaging for young users. Defenders use age-gating, consent workflows, data minimization, and retention limits to reduce legal and privacy risk. Attackers may try to bypass age checks, impersonate parents, or abuse weak consent flows to collect children’s data. Good COPPA compliance is both a legal safeguard and a security control: it limits what data is gathered, who can access it, and how much harm follows if a system is abused.