If your blog attracts children under 13, COPPA applies to you. The Children's Online Privacy Protection Act sets strict rules about collecting data from kids. Violating it can mean massive fines and a banned AdSense account. Here's everything bloggers need to know to stay compliant.
What You'll Learn:
- What COPPA is and who it applies to
- How COPPA affects your blog and ads
- Steps to make your site COPPA compliant
- How Google handles child-directed content
- Real penalties for COPPA violations
What Is COPPA?
COPPA stands for the Children's Online Privacy Protection Act. The FTC enforces it in the United States. It protects children under 13 by restricting how websites collect, use, and share their personal information.
COPPA was enacted in 1998 and updated in 2013. According to the FTC's COPPA Rule, any website or online service "directed to children" or that has "actual knowledge" it's collecting data from children under 13 must comply.
Personal information under COPPA includes:
- Full name
- Home address
- Email address
- Phone number
- Photos, videos, or audio recordings
- Geolocation data
- Persistent identifiers (cookies, device IDs, IP addresses)
That last item is key for bloggers. Cookies and tracking codes — including those used by Google AdSense and analytics — count as personal information under COPPA.
Does COPPA Apply to Your Blog?
COPPA applies if your site is "directed to children" under 13. The FTC looks at several factors to determine this:
- Subject matter: Does your content cover topics that appeal to kids? (cartoons, games, toys, school activities)
- Visual content: Do you use animated characters, bright colors, or child-friendly design elements?
- Language: Is your writing aimed at young readers?
- Advertising: Do you run ads for children's products?
- Audience data: Does your analytics show a significant portion of visitors under 13?
Even if your blog is a general-audience site, COPPA still applies if you have "actual knowledge" that specific users are under 13. This means if a child tells you their age in a comment or form, you must comply.
For more on this topic, see our guide on Image Attribution & Copyright: The Complete Blogger Guide →
Mixed-Audience Sites
If your blog targets a general audience but some content appeals to kids, the FTC treats it as a "mixed audience" site. You must either:
- Apply COPPA protections to the entire site
- Age-screen users and apply COPPA protections only to users who identify as under 13
How COPPA Affects Your AdSense Account
Google takes COPPA very seriously. If your site is directed to children, Google limits or disables certain ad features:
- Personalized ads are blocked. Google won't serve interest-based or remarketing ads to children.
- Only contextual ads appear. Ads are based on page content, not user data.
- Lower RPMs. Contextual ads typically earn less than personalized ads — expect 40-60% lower CPMs.
- No remarketing lists. You can't build audience lists from child visitors.
- Limited analytics. Some Google Analytics features are restricted.
In your AdSense account, you must properly tag child-directed content. Go to Account → Content → "Tag your sites for child-directed treatment." If you fail to tag properly and Google discovers child-directed content, your account can be suspended.
Steps to Make Your Blog COPPA Compliant
Step 1: Determine If COPPA Applies
Review your content honestly. Ask yourself:
Related reading: Copyright Laws for Bloggers: How to Use Images Legally →
- Could kids under 13 be interested in my topics?
- Does my analytics show visitors under 13?
- Do I use visual elements or language that targets children?
If the answer to any of these is yes, proceed with compliance steps.
Step 2: Post a COPPA-Compliant Privacy Policy
Your privacy policy must clearly disclose:
- What data you collect from children
- How you use that data
- Who you share the data with (including ad networks)
- How parents can review and delete their child's data
- That you won't condition participation on unnecessary data collection
Link to your privacy policy from every page where you collect information. Make it easy to find and easy to read. Check our privacy policy guide for AdSense for a starting template.
Step 3: Get Verifiable Parental Consent
Before collecting any personal data from a child under 13, you need verifiable parental consent. Acceptable methods include:
See also: Sponsored Content Disclosure: Legal Requirements Every Blogger Must Know →
- A signed consent form returned by mail, fax, or email
- Credit card transaction (charge a small amount)
- Video conference with the parent
- Government-issued ID check
- Knowledge-based challenge questions
For most bloggers, the simplest approach is to avoid collecting data from children entirely.
Step 4: Tag Content in Google AdSense
If any of your content is directed at children:
- Log in to your AdSense account
- Go to Account → Content
- Find "Tag your sites for child-directed treatment"
- Tag the appropriate sites or pages
This tells Google to serve only non-personalized ads and disable data collection on those pages.
Step 5: Restrict Data Collection
On child-directed pages:
Learn more in Earnings Disclaimer Template for Blogs: Free Copy-Paste Guide →
- Disable Google Analytics tracking or use privacy-safe settings
- Remove comment forms or disable them for children
- Don't use newsletter signup forms
- Remove social sharing buttons that could track users
- Disable cookies except essential ones
Real COPPA Penalties and Enforcement
The FTC doesn't go easy on COPPA violators. Here are some notable cases:
- Google/YouTube (2019): $170 million fine for collecting children's data without parental consent on YouTube channels directed at kids.
- TikTok (2019): $5.7 million fine for collecting names, email addresses, and other personal information from children under 13.
- Epic Games (2022): $275 million fine for violating COPPA through Fortnite's data practices.
- Microsoft (2023): $20 million fine for collecting personal data from children who signed up for Xbox accounts.
The current maximum penalty is $50,120 per violation. Each child whose data was improperly collected counts as a separate violation. For a site with thousands of young visitors, fines can add up to millions.
Practical Tips for Bloggers
If Your Blog Is NOT for Children
- Add a clear statement in your Terms of Service: "This site is not directed at children under 13"
- Avoid content, visuals, or language that specifically targets kids
- If a commenter reveals they're under 13, delete their data immediately
- Don't run ads for children's products
If Your Blog IS for Children
- Implement full COPPA compliance (privacy policy, parental consent, data minimization)
- Tag all content as child-directed in AdSense
- Accept lower ad revenue from contextual-only ads
- Consider alternative monetization: affiliate programs for parents, sponsored content, digital products
- Use a COPPA-compliant comment system or disable comments
If Your Blog Has Mixed Audiences
- Implement age-gating on relevant pages
- Tag specific child-directed pages in AdSense
- Use different tracking configurations for child-directed vs adult content
- Clearly separate content meant for different age groups
Beyond COPPA: Other Child Privacy Laws
COPPA is the U.S. law, but other regions have similar protections:
- GDPR (EU): Children under 16 (or 13 in some countries) need parental consent for data processing. See our GDPR compliance guide.
- UK Age Appropriate Design Code: Requires child-friendly privacy settings for services likely accessed by kids.
- California (CPRA): Adds extra protections for children under 16.
- Australia Privacy Act: Additional protections being introduced for children's data.
If your blog has an international audience, you may need to comply with multiple child privacy laws. When in doubt, apply the strictest standard across your entire site.
Learn more in Financial Disclaimer for Money Blogs: Free Template + Legal Guide →
Frequently Asked Questions
Does COPPA apply if I'm not based in the U.S.?
Yes, if your website is accessible to U.S. children. COPPA applies to any commercial website or service — regardless of where you're located — if it collects data from children in the United States.
Can I just add "you must be 13 or older" to my terms?
That alone isn't enough. If your content is clearly directed at children (cartoons, kids' games, etc.), a terms-of-service disclaimer won't override the FTC's determination. The content and design of your site matter more than disclaimers.
Does having a contact form violate COPPA?
A contact form collects personal information (at minimum, an email address). If children use your site, you either need parental consent before they submit the form, or you need to remove the form from child-directed pages.
What about user comments?
Comments can contain personal information. On child-directed pages, either disable comments, moderate them to remove personal info, or implement age verification before allowing comments.
Will Google ban my AdSense account for COPPA violations?
Yes, Google can and does suspend AdSense accounts for COPPA violations. Google is legally liable as the ad provider, so they take this very seriously. Properly tag child-directed content to stay in good standing.
Conclusion
COPPA compliance isn't optional — it's a legal requirement with serious penalties. For most adult-audience bloggers, the simplest approach is to make sure your content clearly targets adults and to have a clear terms-of-service statement.
If your blog does target children or has mixed audiences, take the compliance steps seriously. Tag your content properly in AdSense, update your privacy policy, and restrict data collection on child-directed pages.
The revenue impact is real, but the cost of non-compliance is far greater. A single FTC enforcement action can result in fines that dwarf any ad revenue you've ever earned. Stay compliant, stay safe, and protect your readers.