COPPA 16 CFR 312.5(c)(4) and 312.4(c)(3) - Repeated response exception
Verify every repeated-response exception condition; repeated messages or push notifications alone do not remove the parental-consent requirement
Where this comes from
Provision: 16 CFR 312.5(c)(4) and 312.4(c)(3) - Repeated response exception
Instrument: Children's Online Privacy Protection Act (COPPA)
Citation: 16 CFR 312.5(c)(4), 312.4(c)(3), and 312.2 (online contact information); 90 FR 16918 (22 April 2025)
Text version: 16 CFR 312.5(c)(4) and 312.4(c)(3), eCFR as of 3 September 2026; 2025 final rule considered
Checked against the source: 6 September 2026
Who it applies to
It applies when all of these are true:
- COPPA assessed activity Q_COPPA_COVERED_ACTIVITY: YES
- COPPA assessed activity Q_COPPA_RECONTACT: YES
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Verify the child's specific request, both child and parent online contact details and the direct repeated-response purpose before relying on 312.5(c)(4).
- Enforce no other use, no disclosure and no combination with other information collected from the child.
- Provide all six 312.4(c)(3) notice elements, including collection of both contact details, limited use, refusal and deletion of both sets, default continuation and the online-notice link.
- Treat undeliverable notice as unresolved reasonable-efforts compliance; a queued message or opt-out link alone is insufficient.
- Honor parental prevention/deletion requests and obtain a separately assessed consent basis when exception conditions fail; generic push or marketing contact is not automatically exempt.
Evidence an auditor expects
- Assessment documentDocument review
Source-linked COPPA activity, authority and control assessment
Verify the child's specific request, both child and parent online contact details and the direct repeated-response purpose before relying on 312.5(c)(4). Enforce no other use, no disclosure and no combination with other information collected from the child. Provide all six 312.4(c)(3) notice elements, including collection of both contact details, limited use, refusal and deletion of both sets, default continuation and the online-notice link. Treat undeliverable notice as unresolved reasonable-efforts compliance; a queued message or opt-out link alone is insufficient. Honor parental prevention/deletion requests and obtain a separately assessed consent basis when exception conditions fail; generic push or marketing contact is not automatically exempt. Record the exact source version, reviewer, activity and evidence limits. A template or seed is not consent or qualified legal approval.
Questions people ask
- Does COPPA 16 CFR 312.5(c)(4) and 312.4(c)(3) - Repeated response exception apply to my service?
- It applies when COPPA assessed activity Q_COPPA_COVERED_ACTIVITY: YES; COPPA assessed activity Q_COPPA_RECONTACT: YES.
- From when does this apply?
- COPPA 16 CFR 312.5(c)(4) and 312.4(c)(3) - Repeated response exception applies from 1 July 2013. Its current status is: in force.
- What evidence does an auditor expect?
- Source-linked COPPA activity, authority and control assessment.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.