COPPA: why children's data requires a special approach
Typical situation: you launch a children's learning app, App Store rates it 4+, Google Play says Everyone. But a month later, an FTC notification or parent complaint arrives—the app collected IDFA and served ads for toys. The penalty can reach $50,000 per instance of data collection without consent. TikTok paid $5.7 million for COPPA violations. We've encountered such cases many times: we've helped 30+ projects pass audits and avoid sanctions. The average cost of COPPA remediation for a mid-sized app is significantly less than a potential fine.
COPPA requires developers to meet three key conditions: disable behavioral advertising, obtain verifiable parental consent, and minimize data collection. App Store and Google Play check this formally through ratings, but the FTC controls actual implementation—and that's where the risks lie.
Prohibited data without parental consent
- Collecting name, address, email, phone, geolocation of a child
- Behavioral advertising (AdMob, Meta Audience Network)
- Transmitting Advertising ID (GAID / IDFA) — even for analytics
- Publishing children's content (photos, text, audio)
- Notifications aimed at retaining a child
How to disable advertising SDKs for child-directed mode?
The Google Mobile Ads SDK supports child-directed treatment. Set flags before the first request:
val requestConfiguration = RequestConfiguration.Builder() .setTagForChildDirectedTreatment(RequestConfiguration.TAG_FOR_CHILD_DIRECTED_TREATMENT_TRUE) .setTagForUnderAgeOfConsent(RequestConfiguration.TAG_FOR_UNDER_AGE_OF_CONSENT_TRUE) .build() MobileAds.setRequestConfiguration(requestConfiguration) After that, AdMob stops showing behavioral ads. For Meta Audience Network: AudienceNetworkAds.setDataProcessingOptions(new String[]{"LDU"}, 1, 1000). But remember: if your app participates in Google Play Families Policy, Meta Audience Network is completely banned—use only Pre-approved ad networks.
How does an age-gate and age verification work?
COPPA does not require perfect identification—only "reasonable efforts." A standard implementation:
- On registration, ask for date of birth.
- If age < 13, request parent's email.
- Send an email describing the data collected and a link for confirmation.
- Until confirmation—no data collection except the parent's email.
The FTC recognizes the Email-plus method as acceptable for most apps. For high-risk apps (communication, content publication), a credit card or video chat is needed. Email-plus is 3x faster than credit card and covers 95% of cases.
func handleAgeVerification(birthDate: Date) { let age = Calendar.current.dateComponents([.year], from: birthDate, to: Date()).year ?? 0 if age < 13 { showParentalConsentScreen() analyticsManager.setChildMode(true) } else if age < 16 { consentManager.requireParentalConsentForEU() } } How does COPPA differ from Google Play Families Policy?
| Requirement | COPPA | Families Policy |
|---|---|---|
| Ban on behavioral ads | Yes | Yes, stricter |
| Parental consent | Email-plus | Email-plus |
| List of ad networks | No | Only Pre-approved |
| Ban on purchases without controls | No | Yes |
| Restrictions on permission requests | No | Yes |
Google Play Families Policy imposes additional Google requirements on top of COPPA for apps targeting children. They ban using ad networks outside the approved list, require parental controls for purchases, and limit permission requests. Violation leads to app removal from Google Play.
What does the COPPA implementation process include?
Here are the steps we go through with every project:
| Stage | Duration | Result |
|---|---|---|
| Audit of current app | 1 day | List of violations and SDKs |
| Disable/replace ad SDKs | 1–2 days | Code without data collection |
| Age-gate and parental consent | 1–2 days | Date-of-birth screen and email flow |
| Minimize analytics | 0.5 day | Firebase without User ID |
| Documentation and DSAR | 1–2 days | Privacy policy, parent request form |
| Final testing | 0.5 day | Verification via App Review and Play Console |
How to minimize data collection?
In child mode, collect only essential data:
- Persistent ID for progress—only after parental consent.
- Analytics—aggregated, without User ID.
- Crash reports—without identifiers.
Firebase Analytics: Analytics.setUserId(nil) and disable custom events with PII.
Why trust the COPPA team with experience?
We've been working with children's apps for over 5 years, audited and remediated 30+ projects. We have ready-made parental consent templates, documentation, and proven integrations. We guarantee compliance with FTC and Google Play requirements—or your money back.
Get a COPPA consultation today. Contact us to discuss the details.