COPPA · 16 CFR Part 312 (2025 amendments)
Children’s Privacy: COPPA, Google Play Families, Amazon Appstore Child-Directed Apps, Apple App Store Kids Category are one add-on at $39/mo, bought through COPPA, and together they count as one framework against your plan’s allowance.
COPPA is the FTC’s Children’s Online Privacy Protection Rule, 16 CFR Part 312. It binds any operator of a service directed to children under 13, and any operator with actual knowledge it is collecting personal information from a child — which is why it catches products that were never aimed at children. Keel models the Rule at its own designated-paragraph level: the notices, verifiable parental consent and its recognised methods and exceptions, the parent’s right to review and delete, the ban on conditioning a child’s participation on excess collection, the written children’s information security programme, and the retention-and-deletion duty. Scope, definitions, enforcement, safe harbor programmes and the Commission’s own processes are cited but not scored, because they place no implementable duty on an operator.
How much of the standard Keel models
Models its declared scope in fullKeel authors every leaf requirement in the scope declared below — all 32 of them, with nothing inside that scope left out. A test fails the build if the authored count and the declared count ever diverge, so this framework cannot quietly lose requirements after the fact.
- Authored in Keel
- 32 requirements
- In Keel’s scored scope
- 32 leaf requirements
- Checked against
- 16 CFR Part 312, the FTC’s Children’s Online Privacy Protection Rule, as amended in 2025. Inventory derived from the eCFR text of Part 312 retrieved 2026-08-11 (all 13 sections, paragraph by paragraph), not from recollection of the pre-2025 Rule.
Keel publishes this for every framework it ships, complete or not, so a readiness percentage can be read against a denominator you can see. Compare every framework →
Who needs COPPA?
- App and game studios whose product is directed to children under 13
- General-audience services that have learned they collect data from children anyway
- Anyone shipping to an app store, where COPPA is the floor and the store rules sit on top
How Keel helps with COPPA
- Every operator duty in the Rule as a scored control, at the paragraph level rather than one line per section
- The store programmes crosswalked alongside it, so shared work is evidenced once rather than three more times
- Notice, consent, retention and security tracked with owners and evidence, not as a policy PDF
Collect once, comply everywhere
COPPA shares canonical controls with GDPR, ISO/IEC 27001 and NIST SP 800-53 and others in the catalog. Implement one of those controls and it counts toward every framework it satisfies, so adding COPPA rarely means starting from scratch.
Other frameworks: ISO/IEC 27001 · CIS Critical Security Controls · PCI DSS · SOC 2 · SOX (Sarbanes-Oxley) Section 404 · NIST Cybersecurity Framework · All frameworks →