What Keel scores in the COPPA Rule, and what it does not

Part 312 has 13 sections. Keel scores duties from 7 of them. The other 6 are out, along with 4 paragraphs inside sections that are scored. This page is all of them by number, so you can disagree with a specific line instead of with a total.

The rule

A provision of Part 312 is scored where it creates something an operator must do, must not do, or must be able to demonstrate. Out: scope and definitions, enforcement, provisions addressed to the Commission or to a safe harbor program, immunities and savings clauses that impose no residual action, and permissions the operator may simply decline to use.

And how big a scored row is. A second rule decides the size of a row rather than whether it exists. The leaf is the Rule’s own designated paragraph, except where sub-paragraphs enumerate the contents of one required notice or the alternative ways one duty may be met, which are carried in the parent row’s summary instead. That is why §312.4(c)(1) is one row and not seven, and why §312.8(b)(1) through (b)(5) are five rows: each of those states a distinct action, on its own cadence, with its own evidence.

Out of scope is not the same as inapplicable. Out of scope is not the same as inapplicable. An operator is subject to the whole of Part 312, and a workspace scoring 100% here has not been told the definitions or the safe harbor rules do not reach it. What Keel scores is the set of duties an operator can implement, mark and evidence, because those are the ones a readiness percentage can honestly be measured against.

The near misses

Each of these mentions the operator, or reads like a duty, and is still out. They are the calls most worth checking first, which is why they are named rather than absorbed into the counts above.

• §312.11(h) A permission the operator may simply decline to use
  Safe harbor programs: effect of participation.

  This paragraph IS about operators, which is why it is the first call to check. It deems an operator following Commission-approved safe harbor guidelines to be in compliance with §§312.2 through 312.8 and §312.10, and describes how the Commission weighs program participation in an enforcement decision. It is an elective alternative route plus an evidential clause, and it asks the operator to do nothing. Joining a program removes no obligation scored here; it changes who assesses it. Same call GDPR makes on Arts 40 to 43.

• §312.5(b)(2) Lists the contents of, or the ways of meeting, a duty scored elsewhere
  The recognized methods of verifiable parental consent.

  Nine methods, including the knowledge-based authentication and text-message routes added in 2025, and none of them is a scored row. The duty to obtain verifiable consent is scored, at §312.5(b)(1), and the methods are the ways of discharging it. Scoring the menu as well would ask an operator to satisfy every alternative to one obligation.

• §312.6(c) A permission the operator may simply decline to use
  Termination of service after a parent refuses.

  Reads as a consequence an operator can impose, and a reader may expect it scored because §312.7 constrains it. It is out because it grants a power rather than imposing a duty: an operator that never terminates anything has not failed it. The constraint in §312.7 IS scored.

• §312.6(b) A protection from liability rather than an obligation
  Good faith disclosure in response to a parent’s request.

  Contains the words "reasonable procedures", which look like a duty to have them, and is out because the operative effect is immunity: it says who is not liable, on condition that procedures exist. The duty to have those procedures is scored at §312.6(a).

• §312.2 States what the Part covers, or what a word means
  Definitions.

  The 2025 amendments moved real ground inside this section, adding biometric and government-issued identifiers to "personal information" and creating the "mixed audience website or online service" category, so a reviewer is right to look here first. It stays out because a definition changes what the scored duties reach rather than adding one: the wider "personal information" is applied inside every row that uses the term.

• §312.3 Lists the contents of, or the ways of meeting, a duty scored elsewhere
  The five duties restated in the general prohibition.

  Not an exclusion, and listed here so its treatment does not read as one. §312.3 is scored as ONE row rather than five: its (a) through (e) are a roadmap, each restating a duty authored in full at §312.4 through §312.8 and ending in a cross-reference to it. Scoring them would ask an operator the same five questions twice.

Out entirely, by section

Section headings are the Rule's own and are quoted rather than paraphrased.

• §312.1 States what the Part covers, or what a word means
  Scope of regulations in this part.

  States what the Part implements. It imposes no duty on anyone.

• §312.2 States what the Part covers, or what a word means
  Definitions.

  You cannot comply with a definition. The defined terms are load-bearing and are used throughout the scored rows, including the 2025 additions of biometric and government-issued identifiers and the "mixed audience website or online service" category. They are simply not scored rows.

• §312.9 A consequence of breach, not something to implement
  Enforcement.

  Says a violation is treated as an unfair or deceptive act or practice under section 18(a)(1)(B) of the FTC Act. That is what happens after a breach of the Rule, not a requirement to implement.

• §312.11 Binds the Commission or a safe harbor program, not an operator
  Safe harbor programs.

  Paragraphs (a) through (g) bind an industry group running an approved program and the Commission: application, approval criteria, assessment mechanisms, disciplinary actions, annual reporting, recordkeeping, member listings, post-approval modifications, triennial capability reports and revocation. None of it is an operator duty. Paragraph (h) is about operators and is still out; it is argued below.

• §312.12 Binds the Commission or a safe harbor program, not an operator
  Voluntary Commission approval processes.

  Commission procedure for approving new consent methods and new internal-operations activities, open to any interested party. The deadlines it sets run against the Commission.

• §312.13 A consequence of breach, not something to implement
  Severability.

  Addressed to a court considering whether the rest of the Part survives, not to an operator.

Out by paragraph, inside sections that are scored

This is the half that stops "§312.5 is in scope" from licensing any subset of it. A ref here matches no scored row.

• §312.5(b)(2) Lists the contents of, or the ways of meeting, a duty scored elsewhere

  The enumerated list of recognized methods for obtaining verifiable parental consent. It is not a separate duty: it lists the ways the single duty in §312.5(b)(1) may be met, so the methods are carried in that row’s summary.

• §312.5(b)(3) Binds the Commission or a safe harbor program, not an operator

  A Commission-approved safe harbor program may approve a consent method for its members. That binds the program.

• §312.6(b) A protection from liability rather than an obligation

  Neither an operator nor its agent is liable under federal or state law for a good faith disclosure made under reasonable procedures in responding to a §312.6 request.

• §312.6(c) A permission the operator may simply decline to use

  An operator MAY terminate service to a child whose parent has refused further use or collection, or required deletion, subject to §312.7. Nothing must be done.

Where the inventory came from

16 CFR Part 312, the FTC’s Children’s Online Privacy Protection Rule as amended in 2025. The inventory was derived from the eCFR text of Part 312 retrieved 2026-08-11, section by section and paragraph by paragraph, rather than from recollection of the pre-2025 Rule; the section headings on this page were re-read against the eCFR on 2026-09-03. The scope calls are Keel’s, applying the rule above to the published text, and they have had no external legal review.

Think one of these belongs in scope? That is the point of publishing it, so tell us which line. The full framework is at COPPA.