Página traduzida e verificada automaticamente. Prevalece a versão em inglês. Algumas partes ainda estão em inglês enquanto a tradução é verificada. Ver em inglês · Informar um erro de tradução
COPPA
Children's Online Privacy Protection Act e respectiva Regra
Consentimento verificável dos pais antes de coletar informações pessoais de crianças menores de 13 anos, com direitos de aviso, acesso e exclusão para os pais.
The law in brief
COPPA protects the personal information of children under 13 online. Operators of websites, apps and online services directed to children, and general-audience services that know they collect information from children, must get verifiable parental consent before collecting it and must keep it secure.
The FTC enforces it through the Children's Online Privacy Protection Rule, which it updated in 2025.
A quem se aplica
- Operators of websites, apps and online services directed to children under 13, judged by factors such as subject matter, visual content, characters and advertising.
- General-audience operators with actual knowledge that they collect personal information from a child under 13.
- Operators that collect personal information through a child-directed service, such as ad networks and plug-ins, where they have actual knowledge.
- Personal information includes names, contact details, persistent identifiers used across sites, photos, voice recordings, geolocation and, since the 2025 update, biometric identifiers.
What it requires
Verifiable parental consent first
Obtain verifiable parental consent before collecting, using or disclosing personal information from a child, using a method reasonably calculated to ensure the person consenting is the parent.
Notice to parents
Post a clear online notice of your practices and send parents a direct notice explaining what you collect and how to consent.
Collect only what is needed
Do not condition a child's participation on disclosing more personal information than is reasonably necessary for the activity.
Security and retention
Keep children's information confidential, secure and intact under a written security program, and keep it only as long as reasonably necessary under a written retention policy.
Direitos das pessoas
Parents can review the personal information collected from their child, have it deleted, and refuse further collection or use, and must not be required to allow more collection than is reasonably necessary for the child to take part (16 CFR 312.6 and 312.7).
Enforcement and penalties
Penalidades civis por violação, reajustadas anualmente pela inflação, aplicadas pela FTC e pelos procuradores-gerais estaduais. Os acordos costumam incluir ordens de exclusão e programas de conformidade de longo prazo.
What's changing
Updated rule in force. The FTC's 2025 amendments require separate parental consent before disclosing children's information to third parties for purposes such as targeted advertising, a written information security program and a written data retention policy. Compliance with most of the changes was required by 22 April 2026.
What to do first
- Decide whether your service is directed to children, or whether you have actual knowledge of child users.
- Map every child data flow, including SDKs, analytics and advertising partners.
- Implement verifiable parental consent before collection, and separate consent for third-party disclosures where required.
- Publish a clear notice and a direct notice to parents.
- Adopt the written security program and retention policy the 2025 rule requires, and delete data once it is no longer needed.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Novidades recentes
-
Future of Privacy Forum expands youth policy to integrate privacy, safety, and well‑being, emphasizing AI inference risks
The initiative matters because it aims to shape product design and policy that protect children’s data and well‑being amid rising AI-driven personalization. Future of Privacy Forum (FPF) announced an expanded focus that treats privacy, safety and well‑being as interconnected for youth. The interview highlights growing concerns about AI systems inferring moods, interests and vulnerabilities of young people and the need for frameworks to govern such inferences. FPF references its upcoming "Personalization and Youth Online" report and guidance on COPPA as part of this effort.
Source: Future of Privacy Forum. COPPA in the regulations library.
-
Meta to implement age‑verification framework under $17 B settlement with 52 U.S. states
The settlement imposes extensive age‑verification and data‑retention obligations on Meta, affecting privacy and surveillance of all users. Meta has agreed to a $17 billion settlement with 52 state attorneys general that mandates age‑assurance technology for its platforms. The settlement requires Meta to apply age‑verification methods within one year, classify users into 18+, 13‑17, and under‑13 buckets, and retain age‑related data only briefly. It also obliges Meta to provide an appeal process and allows AGs to request user data for law‑enforcement purposes.
Source: EFF updates. COPPA in the regulations library.
Fontes
- Children's Online Privacy Protection Rule (16 CFR Parte 312) eCFR · Texto oficial ou regulador
Biblioteca de regulamentações
Todas as leis estaduais de privacidade dos EUA em um só mapa
24 estados têm uma lei abrangente de privacidade na biblioteca, ao lado das leis da UE, do Reino Unido, federais dos EUA e globais: 102 no total, cada uma explicada em linguagem simples com suas fontes. Selecione um estado para ver o que se aplica lá.
- Em vigor
- Entrando em vigor
- Leis setoriais