COPPA 16 CFR §312.11(h) - Operator participation in approved safe harbor programs
Assess actual guideline compliance and the service-specific scope of any COPPA safe-harbor reliance
Where this comes from
Provision: 16 CFR §312.11(h) - Operator participation in approved safe harbor programs
Instrument: Children's Online Privacy Protection Act (COPPA)
Citation: 16 CFR §312.11(b)(2), (g), (h); 15 U.S.C. §6503
Text version: 16 CFR 312.11(h), with (b)(2) and (g) context; eCFR displayed through 2026-09-03. FTC approved-program directory and May 2020 membership-claims guidance checked 2026-09-06; current approval decisions and individual guidelines must be checked at reliance.
Checked against the source: 6 September 2026
Who it applies to
It applies when all of these are true:
- COPPA assessed activity Q_COPPA_SAFE_HARBOR_RELIANCE: YES
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Record the actual operator and each proposed or current covered service; participation is optional and an assessed pathway is not legal approval.
- Verify current FTC approval, applicable guideline version and service-specific membership/certification from original sources; a badge, application or certificate alone does not establish compliance.
- Assess actual guideline compliance and the program's at-least-annual independent privacy/security review; preserve findings, remediation and disciplinary history without assuming immunity.
- Reassess changed features/guidelines, expiry, suspension, departure and revoked approval; remove or correct unsupported public membership claims.
- Distinguish member-operator conditions from program-administrator reporting, records, public-list and technology-review duties; assign the latter only after a separate actor-specific assessment.
Evidence an auditor expects
- Assessment documentDocument review
Operator safe-harbor reliance assessment
Record the actual operator and each proposed or current covered service; participation is optional and an assessed pathway is not legal approval. Verify current FTC approval, applicable guideline version and service-specific membership/certification from original sources; a badge, application or certificate alone does not establish compliance. Assess actual guideline compliance and the program's at-least-annual independent privacy/security review; preserve findings, remediation and disciplinary history without assuming immunity. Reassess changed features/guidelines, expiry, suspension, departure and revoked approval; remove or correct unsupported public membership claims. Distinguish member-operator conditions from program-administrator reporting, records, public-list and technology-review duties; assign the latter only after a separate actor-specific assessment. Preserve minimized source/version/scope/status evidence and test stale badges, uncovered services and unresolved findings; do not copy child records or unredacted complaints into the general register. Completion is not legal approval.
Questions people ask
- Does COPPA 16 CFR §312.11(h) - Operator participation in approved safe harbor prog… apply to my service?
- It applies when COPPA assessed activity Q_COPPA_SAFE_HARBOR_RELIANCE: YES.
- From when does this apply?
- COPPA 16 CFR §312.11(h) - Operator participation in approved safe harbor prog… applies from 21 April 2000. Its current status is: in force.
- What evidence does an auditor expect?
- Operator safe-harbor reliance assessment.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.