COPPA 16 CFR 312.2, 312.5(c)(7)-(8) - Assess persistent identifiers and complete exception conditions
Treat qualifying persistent identifiers as personal information and assess consent, internal-operations limits and the distinct registered-user exception
Where this comes from
Provision: 16 CFR 312.2, 312.5(c)(7)-(8) - Assess persistent identifiers and complete exception conditions
Instrument: Children's Online Privacy Protection Act (COPPA)
Citation: 16 CFR 312.2 (personal information (7), support for internal operations and child-directed definition (2)), 312.5(c)(7)-(8), 312.4(d)(3); 90 FR 16918, effective 23 June 2025, general compliance date 22 April 2026
Text version: 16 CFR 312.2, 312.4, 312.5, eCFR displayed through 3 September 2026, retrieved 6 September 2026; 2025 final rule, 90 FR 16918
Checked against the source: 6 September 2026
Who it applies to
It applies when all of these are true:
- COPPA assessed activity Q_COPPA_COVERED_ACTIVITY: YES
- COPPA assessed activity Q_COPPA_PERSISTENT_IDENTIFIER: YES
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Inventory qualifying persistent identifiers independently of behavioral-advertising or audience labels, including linked personal information, recipient purposes and actual uses.
- For 312.5(c)(7), establish identifier-only collection with no other personal information and the sole necessary internal operation under 312.2.
- Assess functioning, network communications, authentication/content personalization, contextual ads/frequency caps, security, legal compliance or permitted request fulfillment; enforce the definition's limits on contact, behavioral advertising, profiles and other use/disclosure.
- Publish specific internal operations and the means preventing prohibited identifier uses under 312.4(d)(3); contextual advertising or a vendor label does not remove this notice.
- For the distinct 312.5(c)(8) pathway, establish the paragraph-(2) embedded operator, affirmative user interaction, previous registration with that same operator indicating non-child status and identifier-only collection; passive loading, the host's role or a new age answer is insufficient.
Evidence an auditor expects
- Assessment documentDocument review
Complete exception assessment and implemented boundary evidence
Source/version/activity-specific evidence: Inventory qualifying persistent identifiers independently of behavioral-advertising or audience labels, including linked personal information, recipient purposes and actual uses. For 312.5(c)(7), establish identifier-only collection with no other personal information and the sole necessary internal operation under 312.2. Assess functioning, network communications, authentication/content personalization, contextual ads/frequency caps, security, legal compliance or permitted request fulfillment; enforce the definition's limits on contact, behavioral advertising, profiles and other use/disclosure. Publish specific internal operations and the means preventing prohibited identifier uses under 312.4(d)(3); contextual advertising or a vendor label does not remove this notice. For the distinct 312.5(c)(8) pathway, establish the paragraph-(2) embedded operator, affirmative user interaction, previous registration with that same operator indicating non-child status and identifier-only collection; passive loading, the host's role or a new age answer is insufficient. If every exception condition is not established, resolve the consent basis and remaining notice/disclosure duties; test denied uses and retain minimized evidence without raw identifier exports. A DRAFT source, selected feature or generated task is not consent or an approved exception.
Questions people ask
- Does COPPA 16 CFR 312.2, 312.5(c)(7)-(8) - Assess persistent identifiers and compl… apply to my service?
- It applies when COPPA assessed activity Q_COPPA_COVERED_ACTIVITY: YES; COPPA assessed activity Q_COPPA_PERSISTENT_IDENTIFIER: YES.
- From when does this apply?
- COPPA 16 CFR 312.2, 312.5(c)(7)-(8) - Assess persistent identifiers and compl… applies from 22 April 2026. Its current status is: in force.
- What evidence does an auditor expect?
- Complete exception assessment and implemented boundary evidence.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.