COPPA 16 CFR 312.7 - No conditioning participation on excessive personal information
Do not require more personal information than reasonably necessary for a child's participation, including guest activities
Where this comes from
Provision: 16 CFR 312.7 - No conditioning participation on excessive personal information
Instrument: Children's Online Privacy Protection Act (COPPA)
Citation: 15 U.S.C. 6502(b)(1)(C); 16 CFR 312.7 and 312.6(c); 90 FR 16918, 16981 (22 April 2025); original rule 64 FR 59888 (3 November 1999), effective 21 April 2000. This prohibition predates the 2025 republication.
Text version: 16 CFR 312.7, eCFR displayed through 3 September 2026, retrieved 6 September 2026; 2025 final rule, 90 FR 16918, 16981.
Checked against the source: 6 September 2026
Who it applies to
It applies when all of these are true:
- COPPA assessed activity Q_COPPA_COVERED_ACTIVITY: YES
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Inventory every required disclosure for covered games, prizes and other activities, including guest participation, registration, feature unlocks and SDK prerequisites.
- Document why each required item of personal information is reasonably necessary for the particular activity under 312.7; remove or redesign conditions whose necessity is not established.
- Test that declining unnecessary information does not block participation through interface controls, server validation or third-party requirements. Account registration is not a prerequisite for this prohibition.
- Do not replace reasonably necessary with an invented strict-necessity test, treat parental consent as curing an excessive condition, or treat this section as permission for every optional collection.
- Apply the same necessity limit to any service restriction following parental refusal/deletion under 312.6(c); assess other notice, consent, purpose and retention duties separately.
Evidence an auditor expects
- Policy documentDocument review
Activity-specific necessity and participation assessment
[ ] Inventory every required disclosure for covered games, prizes and other activities, including guest participation, registration, feature unlocks and SDK prerequisites. [ ] Document why each required item of personal information is reasonably necessary for the particular activity under 312.7; remove or redesign conditions whose necessity is not established. [ ] Test that declining unnecessary information does not block participation through interface controls, server validation or third-party requirements. Account registration is not a prerequisite for this prohibition. [ ] Do not replace reasonably necessary with an invented strict-necessity test, treat parental consent as curing an excessive condition, or treat this section as permission for every optional collection. [ ] Apply the same necessity limit to any service restriction following parental refusal/deletion under 312.6(c); assess other notice, consent, purpose and retention duties separately. [ ] Keep minimized design decisions and synthetic positive/negative test evidence without live child records; unanswered necessity and scope questions require review. Evidence supports a source-based review; it is not legal approval or proof from raw child data.
Questions people ask
- Does COPPA 16 CFR 312.7 - No conditioning participation on excessive personal info… apply to my service?
- It applies when COPPA assessed activity Q_COPPA_COVERED_ACTIVITY: YES.
- From when does this apply?
- COPPA 16 CFR 312.7 - No conditioning participation on excessive personal info… applies from 21 April 2000. Its current status is: in force.
- What evidence does an auditor expect?
- Activity-specific necessity and participation assessment.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.