COPPA 16 CFR 312.5(b)(1)-(3) - Assess and implement verifiable parental consent methods
Assess the actual parental-verification conditions, notice, disclosure limits and prompt ID/image deletion before selecting a consent method
Where this comes from
Provision: 16 CFR 312.5(b)(1)-(3) - Assess and implement verifiable parental consent methods
Instrument: Children's Online Privacy Protection Act (COPPA)
Citation: 16 CFR 312.5(b)(1)-(3), 312.2 and 312.12(a); 90 FR 16918 (22 April 2025), effective 23 June 2025, general compliance date 22 April 2026
Text version: 16 CFR Part 312, 2025 amended Rule (90 FR 16918); eCFR as of 3 September 2026; retrieved 6 September 2026
Checked against the source: 6 September 2026
Who it applies to
It applies when all of these are true:
- COPPA assessed activity Q_COPPA_COVERED_ACTIVITY: YES
- COPPA assessed activity Q_COPPA_PARENTAL_CONSENT_FLOW: YES
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Document the parental-consent flow, applicable notice and material-change assessment before choosing a method; no selected method authorizes every data use.
- Implement all conditions of the chosen named method, including notified transactions, trained phone/video personnel, household-child difficulty and low guessing probability for knowledge-based authentication.
- For photo comparison, authenticate the ID, perform facial comparison and obtain trained-person confirmation; promptly delete required identification and images after verification.
- Permit email/text plus only after assessing no disclosure under 312.2, implementing additional parental assurance and providing revocation notice; test public-availability and internal-operations boundaries.
- Preserve minimized attributable consent and prompt-deletion evidence; do not require intrusive identity collection solely because a child's data includes a voice recording or biometric identifier.
Evidence an auditor expects
- Assessment documentDocument review
Parental-verification method assessment and implemented conditions
Reviewed and attributable source/version/activity assessment: Document the parental-consent flow, applicable notice and material-change assessment before choosing a method; no selected method authorizes every data use. Implement all conditions of the chosen named method, including notified transactions, trained phone/video personnel, household-child difficulty and low guessing probability for knowledge-based authentication. For photo comparison, authenticate the ID, perform facial comparison and obtain trained-person confirmation; promptly delete required identification and images after verification. Permit email/text plus only after assessing no disclosure under 312.2, implementing additional parental assurance and providing revocation notice; test public-availability and internal-operations boundaries. Preserve minimized attributable consent and prompt-deletion evidence; do not require intrusive identity collection solely because a child's data includes a voice recording or biometric identifier. A questionnaire answer or generated task is not consent or a verified exception.
Questions people ask
- Does COPPA 16 CFR 312.5(b)(1)-(3) - Assess and implement verifiable parental conse… apply to my service?
- It applies when COPPA assessed activity Q_COPPA_COVERED_ACTIVITY: YES; COPPA assessed activity Q_COPPA_PARENTAL_CONSENT_FLOW: YES.
- From when does this apply?
- COPPA 16 CFR 312.5(b)(1)-(3) - Assess and implement verifiable parental conse… applies from 22 April 2026. Its current status is: in force.
- What evidence does an auditor expect?
- Parental-verification method assessment and implemented conditions.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.