When Email Sign-Ups and Online Rules Need a Parent’s OK
Under the Children’s Online Privacy Protection Act, or COPPA, even something as small as signing up for an email newsletter can require verifiable parental consent (VPC) if it collects personal information from children under 13.
For example, if a site asks for a child’s email address to send product updates or new services, that’s collecting personal data. If the site asks the child to read a privacy policy or agree to terms and conditions before hitting submit, that’s a legal interaction that a minor cannot complete. If the site is aimed at kids, a parent’s approval is required before any of these examples can take place.
This step makes sure parents know what’s being gathered and why—before it happens.
For kids, the important details should be easy to understand and not buried in legal text. For more complex matters, the explanation should be aimed at parents directly.
If kids are asked to agree to something without understanding what it means, they may share more information than they should. Parental involvement and plain-language notices give families the chance to review requests for personal information before anything is collected. This helps ensure kids aren’t signing up for things without knowing the privacy trade-offs.
Behavioral advertising means showing ads based on a user’s online activity over time. While this is common for adults, it raises bigger concerns for kids under 13. Targeted ads work by tracking online behavior to create detailed profiles that help companies identify targets for advertising. For kids, this tracking can result in ads that aren’t age-appropriate or can feel invasive. Requiring parental consent puts the decision in the family’s hands and allows them to weigh whether targeted advertising is acceptable for their child.
Before collecting data for targeted ads, a website must clearly tell parents:
Only after parents get this information and agree can the data be used for advertising purposes.
Even when parents give consent, limited data retention rules still apply. Companies must delete the information once it’s no longer needed for the stated purpose. Holding on to it longer increases the risk of misuse or accidental exposure.
BBB National Programs’ Children’s Advertising Review Unit (CARU) helps companies understand these limits and when consent is required. This guidance supports responsible use of children’s data and keeps privacy protections in place for younger audiences.
Use CARU’s Pre-Screening Services to have the CARU team review your promotion, website, contest, or other digital campaign before it goes live to save you the hassle of getting it wrong.
For example, if a site asks for a child’s email address to send product updates or new services, that’s collecting personal data. If the site asks the child to read a privacy policy or agree to terms and conditions before hitting submit, that’s a legal interaction that a minor cannot complete. If the site is aimed at kids, a parent’s approval is required before any of these examples can take place.
This step makes sure parents know what’s being gathered and why—before it happens.
Keeping Privacy Information Clear
When a child wants to join a contest, view a video, or get important information online, COPPA’s Direct Notice & Consent rules require that parents receive clear, direct explanations about what data will be collected, how it will be used, and who it may be shared with.For kids, the important details should be easy to understand and not buried in legal text. For more complex matters, the explanation should be aimed at parents directly.
If kids are asked to agree to something without understanding what it means, they may share more information than they should. Parental involvement and plain-language notices give families the chance to review requests for personal information before anything is collected. This helps ensure kids aren’t signing up for things without knowing the privacy trade-offs.
Sharing Data for Ads
COPPA prohibits child-directed websites from giving children’s personal information to third parties for behavioral advertising without getting VPC first.Behavioral advertising means showing ads based on a user’s online activity over time. While this is common for adults, it raises bigger concerns for kids under 13. Targeted ads work by tracking online behavior to create detailed profiles that help companies identify targets for advertising. For kids, this tracking can result in ads that aren’t age-appropriate or can feel invasive. Requiring parental consent puts the decision in the family’s hands and allows them to weigh whether targeted advertising is acceptable for their child.
Before collecting data for targeted ads, a website must clearly tell parents:
- What information will be collected.
- How it will be used.
- Which third parties will receive it.
Only after parents get this information and agree can the data be used for advertising purposes.
Even when parents give consent, limited data retention rules still apply. Companies must delete the information once it’s no longer needed for the stated purpose. Holding on to it longer increases the risk of misuse or accidental exposure.
BBB National Programs’ Children’s Advertising Review Unit (CARU) helps companies understand these limits and when consent is required. This guidance supports responsible use of children’s data and keeps privacy protections in place for younger audiences.
Use CARU’s Pre-Screening Services to have the CARU team review your promotion, website, contest, or other digital campaign before it goes live to save you the hassle of getting it wrong.