COPPA gives parents important rights over personal information collected online from children under 13. But "COPPA violation" does not mean a parent automatically has a federal lawsuit for damages.
What COPPA Actually Covers
COPPA generally applies to operators of websites and online services directed to children under 13, and to certain operators with actual knowledge that they are collecting personal information online from children under 13.
Covered operators generally must give parents notice, obtain verifiable parental consent before collecting covered personal information, provide parental access and deletion rights, and limit retention to what is reasonably necessary.
Voice, Location and Persistent Identifiers Can Count
COPPA's definition of personal information includes, among other things, audio files containing a child's voice, geolocation information sufficient to identify a street name and city or town, and certain persistent identifiers.
The FTC has specifically explained that collecting a child's latitude and longitude can fall within COPPA's geolocation rule even if the operator never asks the child to type a street address.
What Changed With the 2025 COPPA Amendments
The FTC finalized amendments in April 2025 that strengthen protections around third-party disclosures, targeted advertising, data retention, and certain categories of personal information. The rule also expanded the definition of personal information to include biometric identifiers.
The amendments became effective 60 days after Federal Register publication, with a general one-year compliance period for provisions without an earlier deadline. This is important for 2026 articles: do not describe the 2025 changes as merely proposed.
Parents Have Access and Deletion Rights
The FTC states that parents have the right to review the information collected from their child, withdraw consent, and have information collected from the child deleted. Covered operators must also maintain procedures that allow parents to exercise these rights.
The FTC's 2023 Amazon case is a useful enforcement example: the government alleged that Amazon retained children's voice recordings for years and interfered with deletion requests, leading to a settlement requiring changes to deletion practices and privacy safeguards.
A Critical Correction: COPPA Is Not a Simple Private Lawsuit Statute
Do not tell parents that COPPA automatically gives them a federal private right of action to sue a company for damages. COPPA is principally enforced by the FTC and the Department of Justice, with the Act also allowing specified state enforcement.
Parents can still pursue other legal theories in appropriate cases, including certain state-law claims, but that is a separate legal analysis and should not be presented as a direct COPPA damages claim.
What to Do When You Suspect Unlawful Collection
- Save the child's account information and the service's privacy notice.
- Record what information was collected: email, voice, location, persistent ID, etc.
- Ask the operator to provide the child's information and explain how to delete it.
- Withdraw consent where appropriate.
- Keep the operator's response and any refusal.
- Report suspected COPPA violations to the FTC at ReportFraud.ftc.gov.
What This Means Practically
- COPPA is about children under 13, with scope rules that depend on the service and actual knowledge.
- Voice recordings and sufficiently precise geolocation can be protected personal information.
- Parents have access, consent-withdrawal and deletion rights under COPPA.
- The 2025 amendments are part of the current regulatory landscape.
- Do not promise that COPPA itself guarantees a parent a private federal lawsuit for damages.
Sources
- Federal Trade Commission — Kids Privacy (COPPA), current enforcement and guidance. ftc.gov
- Federal Trade Commission — COPPA final rule amendments, April 22, 2025. ftc.gov
- Federal Trade Commission — COPPA FAQ, including geolocation and voice. ftc.gov
- Federal Trade Commission — Protecting Your Child's Privacy Online. consumer.ftc.gov
- FTC / DOJ — Amazon Alexa COPPA enforcement, May 2023. ftc.gov