Compliance matrix
Children's Online Privacy Protection Act
United States · Updated 2026-07-19
Applies to: Online services directed to children under 13, or that knowingly collect data from them.
Requirements mapped to CIAM
Age determination
You must establish whether a user is under 13 in a neutral way before collecting data.
CIAM controls
- Neutral age-gate at signup
- No encouragement to falsify age
Evidence
- Age-gate flow documentation
Ask the vendor
- Can we add a neutral age gate and branch the flow for under-13 users?
Verifiable parental consent
Before collecting a child's personal information you must obtain verifiable consent from a parent.
CIAM controls
- Parental consent flow tied to the child account
- Consent records with method and timestamp
Evidence
- Parental consent logs
Ask the vendor
- Can the platform support a parent-linked consent flow with an audit trail?
Data minimization for children
Collect only what is necessary, and do not condition participation on unnecessary data.
CIAM controls
- Minimal child profile fields
- No behavioral advertising to children
Evidence
- Child data-collection inventory
Ask the vendor
- Can we restrict profile fields and data use for accounts flagged as children?
Take this into procurement
Turn these requirements into vendor questions.
The vendor questions above map directly into an RFP or an evaluation checklist you can share with security and procurement.
FAQ
- What CIAM features does COPPA require?
- A neutral age gate to identify under-13 users, a verifiable parental-consent flow linked to the child's account, an auditable consent record, and the ability to minimize data collection and disable behavioral advertising for children's accounts.
Source
FTC Children's Online Privacy Protection Rule (COPPA)
This matrix is practitioner guidance, not legal advice, and does not establish an attorney-client relationship. Confirm your obligations with qualified counsel. See our disclaimer.