COPPA 16 CFR 312.2 and 312.3 - Operator, child-directed status and actual knowledge
Assess and document the operator, child-directed and actual-knowledge basis for this activity's COPPA coverage
Where this comes from
Provision: 16 CFR 312.2 and 312.3 - Operator, child-directed status and actual knowledge
Instrument: Children's Online Privacy Protection Act (COPPA)
Citation: 16 CFR 312.2 (Operator; Website or online service directed to children), 312.3; FTC Not Just for Kids' Sites (May 2026), https://www.ftc.gov/business-guidance/resources/childrens-online-privacy-protection-rule-not-just-kids-sites; 15 U.S.C. 6505 (agency-specific administration and applicability)
Text version: 16 CFR 312.2 and 312.3, eCFR displayed through 3 September 2026, checked 6 September 2026; FTC May 2026 Not Just for Kids' Sites and Six-Step Compliance Plan used as staff guidance. 2025 final amendments generally require compliance from 22 April 2026. Current metadata does not implement historical-version evaluation. 15 U.S.C. 6505, House preliminary text through 5 September 2026, checked 6 September: https://uscode.house.gov/view.xhtml?edition=prelim&num=0&req=granuleid%3AUSC-prelim-title15-section6505
Checked against the source: 6 September 2026
Who it applies to
It applies when all of these are true:
- Has this activity been assessed as covered by COPPA? is covered activity assessed and documented or outside COPPA coverage, assessed and documented
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Record the actual operator, commercial activity, territory, applicable enforcement jurisdiction (including 15 U.S.C. 6505), collection/maintenance and on-behalf data flows. Absence of FTC enforcement jurisdiction alone is not a COPPA exemption. Review positive and negative coverage conclusions without treating this assessment task as a legal finding of coverage.
- Assess the complete 312.2 child-directed factors for the service or portion, including content/design/advertising and reliable actual/intended-audience evidence; an adult label, terms excluding children or likely-child-access answer alone does not decide coverage.
- For general-audience activity, assess age information actually learned and communication awareness; distinguish a known child's age from suspicion, an unread post or an unverified message. COPPA does not require universal age screening or new date-of-birth collection.
- Assess the embedded collector's distinct actual knowledge of direct collection from another child-directed service; a mere hyperlink does not establish this pathway.
- Test an actual-knowledge case despite an adult audience label, an uncertain message, a child-directed service without registration and a documented outside-scope case. Reassess changes and route unresolved facts to review.
Evidence an auditor expects
- Assessment documentDocument review
Activity-specific COPPA coverage-basis review
[ ] Record the actual operator, commercial activity, territory, applicable enforcement jurisdiction (including 15 U.S.C. 6505), collection/maintenance and on-behalf data flows. Absence of FTC enforcement jurisdiction alone is not a COPPA exemption. Review positive and negative coverage conclusions without treating this assessment task as a legal finding of coverage. [ ] Assess the complete 312.2 child-directed factors for the service or portion, including content/design/advertising and reliable actual/intended-audience evidence; an adult label, terms excluding children or likely-child-access answer alone does not decide coverage. [ ] For general-audience activity, assess age information actually learned and communication awareness; distinguish a known child's age from suspicion, an unread post or an unverified message. COPPA does not require universal age screening or new date-of-birth collection. [ ] Assess the embedded collector's distinct actual knowledge of direct collection from another child-directed service; a mere hyperlink does not establish this pathway. [ ] Test an actual-knowledge case despite an adult audience label, an uncertain message, a child-directed service without registration and a documented outside-scope case. Reassess changes and route unresolved facts to review. [ ] Preserve minimized basis/source-version and synthetic/redacted evidence. Do not collect extra ages, IDs or raw child messages merely for proof; review mixed-audience treatment and the February 2026 enforcement policy separately. This evidence supports review; it is not legal approval, consent or an automatic exception.
Questions people ask
- Does COPPA 16 CFR 312.2 and 312.3 - Operator, child-directed status and actual kno… apply to my service?
- It applies when Has this activity been assessed as covered by COPPA? is covered activity assessed and documented or outside COPPA coverage, assessed and documented.
- From when does this apply?
- COPPA 16 CFR 312.2 and 312.3 - Operator, child-directed status and actual kno… applies from 21 April 2000. Its current status is: in force.
- What evidence does an auditor expect?
- Activity-specific COPPA coverage-basis review.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.