Running an online course? If kids under 13 are signing up-even if it’s just one-you’re legally required to follow COPPA. It’s not optional. It’s not a suggestion. It’s federal law in the U.S., and the Federal Trade Commission (FTC) enforces it strictly. Ignore it, and you could face fines of up to $50,120 per violation. That’s not a typo. One accidental data collection from a 10-year-old could cost you more than a month’s revenue.
What COPPA Actually Requires
COPPA, the Children’s Online Privacy Protection Act, was passed in 1998 and updated in 2013. It doesn’t just apply to games or social media. It covers any website, app, or online service-including online courses-that collects personal information from children under 13. That includes names, email addresses, geolocation data, cookies, IP addresses, and even persistent identifiers like device IDs used to track behavior across sites.
Most course creators think: "I don’t collect any data." But if your course uses a login system, a quiz that saves progress, a comment section, or even a third-party analytics tool like Google Analytics, you’re collecting data. And if a child under 13 uses it, COPPA kicks in.
How to Know If Your Course Is Covered
Ask yourself these three questions:
- Is your course aimed at children under 13? (Think cartoons, educational games, kids’ science experiments, or content with child-friendly characters.)
- Do you have actual knowledge that a child under 13 is using your course? (For example, a parent signs up their 9-year-old, or a user enters "I’m 11" in a form.)
- Is your platform generally recognized as directed to children? (Even if you don’t market to kids, if your content, colors, or language are clearly child-focused, the FTC considers it directed.)
If you answered yes to any of these, you’re subject to COPPA. There’s no gray area. You can’t say "I didn’t know"-the law holds you responsible if you should have known.
Step-by-Step Compliance Checklist
Here’s what you must do right now if you’re collecting data from kids under 13:
- Post a clear privacy policy on your course site. It must explain exactly what data you collect, why, and how it’s used. No legalese. Use plain language a parent can understand.
- Get verifiable parental consent before collecting any personal information. This isn’t just a checkbox. You need a method that proves the person giving consent is actually the parent. Options include: signed consent forms sent by mail or fax, video calls with a trained operator, government-issued ID verification, or credit card verification (where the parent is billed a nominal amount).
- Give parents control. They must be able to review their child’s data, delete it, and stop further collection. Your system must include a simple way for parents to do this-like a "Manage Child’s Account" button.
- Don’t collect more than you need. If your course doesn’t need an email to function, don’t ask for one. If you don’t need location data, turn off geolocation tracking. Less data = less risk.
- Use age gates carefully. A simple "Are you 13 or older?" checkbox is not enough. The FTC has ruled that these are easily bypassed. If you’re serious about compliance, you need a real verification system.
What Happens If You Don’t Comply?
The FTC doesn’t just send warning letters. In 2024, they fined a popular educational platform $3.5 million for collecting data from over 100,000 children without parental consent. The platform claimed they "didn’t realize" kids were using it. The FTC didn’t buy it. They pointed out the site had animated characters, colorful graphics, and child-friendly language-all clear signals that the service was designed for kids.
And it’s not just fines. If your course is hosted on a platform like Teachable, Thinkific, or Kajabi, they may suspend your account if they find COPPA violations. Your payment processor could freeze funds. Your reputation could tank.
How to Handle Mixed-Audience Courses
Many courses serve both adults and children. You can’t just block kids-you might be losing customers. But you also can’t ignore COPPA.
The cleanest solution? Build two separate access paths:
- One for adults (no data collection beyond what’s needed for billing or support)
- One for children under 13 (with full COPPA compliance: parental consent, limited data, clear policy)
Use a simple age verification screen at login: "Are you over 13?" If yes, proceed. If no, show a message: "This course requires parental consent. Contact [email] to set up a child account." Then route them to a separate, compliant portal.
Third-Party Tools You Can’t Ignore
You might think: "I don’t collect data-I use Teachable." But Teachable doesn’t handle COPPA for you. If you embed YouTube videos, use Google Analytics, or integrate a chatbot, those tools are collecting data too. And under COPPA, you’re responsible for everything on your platform-even if you didn’t build it.
Here’s what to audit:
- Analytics: Google Analytics, Hotjar, Mixpanel-turn off IP collection and anonymize data if kids are involved.
- Video platforms: YouTube’s child-directed mode must be enabled if you’re embedding videos for kids.
- Payment processors: Stripe, PayPal, and others may require separate agreements if you’re processing payments for minors.
- Chatbots and AI tutors: If they store messages or track usage patterns, they’re collecting personal information.
Every third-party tool needs its own COPPA review. Don’t assume they’re compliant. Ask them. Get it in writing.
Real Example: A Math Course That Got It Right
A small business called MathMates runs a popular online math course for grades 3-6. They didn’t want to lose their young students, but they also didn’t want to get sued.
Here’s what they did:
- Created a separate login portal for kids under 13
- Required parents to upload a signed consent form (PDF upload) or verify via video call with a staff member
- Only collected name, email, and progress data-nothing else
- Deleted all data after 30 days of inactivity
- Added a "Parent Dashboard" where moms and dads could see what data was stored and delete it with one click
They now have 12,000 active child users-and zero legal issues.
What About Outside the U.S.?
COPPA only applies if you’re collecting data from children in the United States. But if you have international students, you’re not off the hook. The EU’s GDPR for children (under 16) is even stricter. Canada’s PIPEDA, Australia’s Privacy Act, and others also have child-specific rules.
Best practice? Treat every child as if they’re under 13 and in the U.S. That way, you’re compliant everywhere.
Final Warning: Don’t Wait for a Lawsuit
The FTC doesn’t need a complaint to investigate. They scan the web. They monitor forums. They check course platforms. If your site has child-friendly design and collects any data, you’re on their radar.
Compliance isn’t about being perfect. It’s about being intentional. If you’ve built a course for kids, you owe it to their parents-and to your business-to do it right.
Does COPPA apply if my course is free?
Yes. COPPA applies regardless of whether you charge for the course. The law is based on data collection, not payment. Even if your course is free, if you collect personal information from a child under 13, you must comply.
Can I just block all users under 13?
You can, but it’s not foolproof. A child can easily lie about their age. The FTC considers this a weak defense. If your content is clearly aimed at children, simply blocking based on age input won’t protect you. You must either comply with COPPA or redesign your course to avoid collecting personal information entirely.
What if a parent signs up for their child without my knowledge?
If you didn’t know the user was under 13, you’re not automatically liable. But if you later learn the user is a child (for example, they mention their grade level or school), you must stop collecting data and get parental consent before continuing. Ignoring the information doesn’t make it go away.
Do I need a lawyer to comply with COPPA?
Not necessarily. The FTC provides a detailed compliance guide on their website. Many course platforms now offer COPPA-ready templates. But if you’re unsure about your setup-especially if you’re using third-party tools-consulting a legal professional who specializes in children’s privacy is a smart investment.
Can I use a third-party service to handle COPPA compliance?
Yes. Services like ParentalVerify, KIDSAFE, and iKeepSafe offer certified parental consent systems that integrate with course platforms. These tools handle verification, record-keeping, and consent management. They’re not cheap, but they’re far cheaper than a FTC fine.
Comments (12)
Jeff Napier March 19 2026
Look, I get the FTC wants to be a nanny, but this whole COPPA thing is just corporate fear-mongering dressed up as 'child protection.' Kids lie about their age on every platform ever. You think a 10-year-old can't click 'yes' to 'I'm 13+'? The law doesn't fix stupidity. It just makes life harder for small creators who aren't Google. Let parents handle their kids. The government doesn't need to police every quiz on the internet.Sibusiso Ernest Masilela March 21 2026
Oh please. Another American overreaction. You treat children like fragile porcelain dolls while ignoring that in 90% of the world, kids are using smartphones before they can tie their shoes. This isn't 'compliance'-it's digital colonialism. You build walls around a sandbox while the rest of the planet lets kids roam. Pathetic. And don't even get me started on how you Americans outsource your moral panic to third-party vendors who charge $500/month to verify a parent's identity. What a racket.Daniel Kennedy March 22 2026
I've been running a small coding course for middle schoolers for three years, and COPPA compliance was easier than I thought. We switched to a simple parent email verification system-no video calls, no credit cards. Just a signed PDF upload. We stopped collecting IP addresses, turned off Google Analytics for under-13 users, and built a clean 'parent portal' with one-click data deletion. Took two weeks. No fines. No drama. And guess what? Parents loved it. They felt respected. You don't need a lawyer. You need a system. And a little empathy.Taylor Hayes March 24 2026
I appreciate how thorough this breakdown is. Honestly, the biggest mistake I see is people thinking they can 'avoid' COPPA by ignoring it. You can't. But you also don't need to overcomplicate it. Start small: audit your tools. Turn off non-essential tracking. Use age gates that are more than checkboxes. And if you're unsure? Ask. There are free FTC resources, community forums, even Reddit threads like this one. Compliance isn't about fear-it's about responsibility. And yeah, it's totally doable.Sanjay Mittal March 26 2026
In India, we have kids as young as 8 using educational apps daily. COPPA is American law, but the problem is global. If you're targeting global users, treat everyone like they're under 13. Simple. No need for complex verification systems. Just don't collect anything unnecessary. No cookies, no tracking, no emails unless absolutely required. Build for privacy from day one. It's cheaper, safer, and honestly-more ethical.Mike Zhong March 26 2026
COPPA is a symptom, not the disease. The real issue is the normalization of surveillance capitalism. We've trained a generation to believe that every click, every scroll, every quiz answer must be logged, monetized, and sold. COPPA tries to patch a leak in a sinking ship. Meanwhile, the entire digital ecosystem is built on harvesting children's attention as raw material. You can comply with the law and still be complicit. True ethics don't require a federal mandate. They require a moral reckoning.Jamie Roman March 26 2026
I just want to say-this whole thing hit me hard because I built a course for kids and thought I was fine because I didn't 'collect data.' Then I realized: our embedded YouTube video was tracking them. Our quiz system saved progress via cookies. Our contact form collected emails. I didn't even think about it. It took me three weeks to overhaul everything. I created a separate 'child mode' that disables all tracking, uses a dummy email system, and requires a parent to confirm via a phone call. It's a pain. But now I sleep better. And my users? They're more engaged. Weird, right? When you treat kids like humans instead of data points, they show up. And so do their parents.Salomi Cummingham March 27 2026
I'm a mom of three, and I run an art course for kids. I was terrified of COPPA until I read the FTC's guide. Then I realized-this isn't about punishment. It's about power. Parents should have control over their children's digital footprint. So I built a dashboard. Parents log in, see exactly what data is stored, delete it, pause access, or even request a copy. I don't store anything longer than 30 days. I don't use cookies. I don't track IPs. And I say this plainly on my site: 'We don't sell your child's data. We don't even keep it.' It sounds simple. It is. But it’s rare. And it’s made all the difference. My course has grown because parents trust me. Not because I’m perfect. Because I’m honest.Johnathan Rhyne March 28 2026
You say 'verifiable parental consent' like it's a thing. Good luck with that. How exactly do you verify a parent's identity? A faxed signature? In 2025? You're asking for a government-issued ID from a mom in rural Alabama? Or a video call with a trained operator? Who pays for that? And what if the parent doesn't have a credit card? You're not protecting kids-you're excluding them. This law was written by lobbyists who never met a real child. It's a bureaucratic nightmare disguised as protection. The FTC should be embarrassed.Jawaharlal Thota March 28 2026
I've worked with 15+ online education platforms in India and Africa, and the most effective approach isn't legal compliance-it's simplicity. No login required for kids. No email. No tracking. Just a unique ID tied to a parent's phone number. The child enters a code, the parent gets an SMS to approve access. Done. No cookies, no analytics, no third-party tools. If you don't collect data, COPPA doesn't apply. Period. And guess what? Kids still learn. They still engage. They still love the content. The problem isn't the law. The problem is over-engineering. Sometimes, less is more. And sometimes, the simplest solution is the most compliant.Lauren Saunders March 29 2026
Honestly? This whole COPPA obsession is just another way for wealthy edtech companies to crush small creators. You think a solo teacher in Nebraska can afford a ParentalVerify subscription? Of course not. So they shut down. Meanwhile, big platforms with legal teams just build their own compliant systems and call it 'innovation.' It's not about child safety. It's about market consolidation. The FTC doesn't care about the little guy. They care about the ones who can afford to pay them. This isn't regulation. It's a tax on creativity.sonny dirgantara March 29 2026
i just dont get why people make this so hard. if you got kids on your site, dont collect nothin. no emails, no cookies, no analytics. just let em learn. its that simple. i run a drawing course and we dont even ask for a name. they pick a cartoon username and go. no problems. no stress. no lawyers. just art.