COPPA 16 CFR 312.5(a)(2) - Separate choice and consent for third-party disclosure
Assess third-party disclosure and any integral-service qualification; provide a separate choice and obtain separate verifiable parental consent where required
Where this comes from
Provision: 16 CFR 312.5(a)(2) - Separate choice and consent for third-party disclosure
Instrument: Children's Online Privacy Protection Act (COPPA)
Citation: 16 CFR 312.5(a)(2), 312.2 and 312.4(c)(1)(iv); 90 FR 16918 (22 April 2025), effective 23 June 2025, general compliance date 22 April 2026
Text version: 16 CFR Part 312, 2025 amended Rule (90 FR 16918); eCFR as of 3 September 2026; retrieved 6 September 2026
Checked against the source: 6 September 2026
Who it applies to
It applies when all of these are true:
- COPPA assessed activity Q_COPPA_COVERED_ACTIVITY: YES
- COPPA assessed activity Q_COPPA_DISCLOSURE: YES
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Assess identifiable releases/public availability, recipient purposes and the actual 312.2 definitions rather than relying on a processor label.
- Document whether disclosure is integral to the service; treat unresolved facts as requiring review and do not infer other consent or notice exemptions.
- Where required, let the parent consent to collection/use while refusing disclosure and obtain separate verifiable parental consent before disclosure.
- State the recipients or specific categories, purposes and applicable separate choice in the direct notice; test absence, refusal, revocation and material changes at the disclosure boundary.
- Keep minimized consent, notice-version, purpose and control evidence; stronger identity verification cannot cure a missing separate choice.
Evidence an auditor expects
- Assessment documentDocument review
Disclosure, integral-service assessment and separate consent controls
Reviewed and attributable source/version/activity assessment: Assess identifiable releases/public availability, recipient purposes and the actual 312.2 definitions rather than relying on a processor label. Document whether disclosure is integral to the service; treat unresolved facts as requiring review and do not infer other consent or notice exemptions. Where required, let the parent consent to collection/use while refusing disclosure and obtain separate verifiable parental consent before disclosure. State the recipients or specific categories, purposes and applicable separate choice in the direct notice; test absence, refusal, revocation and material changes at the disclosure boundary. Keep minimized consent, notice-version, purpose and control evidence; stronger identity verification cannot cure a missing separate choice. A questionnaire answer or generated task is not consent or a verified exception.
Questions people ask
- Does COPPA 16 CFR 312.5(a)(2) - Separate choice and consent for third-party disclo… apply to my service?
- It applies when COPPA assessed activity Q_COPPA_COVERED_ACTIVITY: YES; COPPA assessed activity Q_COPPA_DISCLOSURE: YES.
- From when does this apply?
- COPPA 16 CFR 312.5(a)(2) - Separate choice and consent for third-party disclo… applies from 22 April 2026. Its current status is: in force.
- What evidence does an auditor expect?
- Disclosure, integral-service assessment and separate consent controls.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.