COPPA 16 CFR 312.2, 312.5(c)(9), 312.4(d)(4) - Assess child audio and the narrow request-response exception
Assess child-voice audio collection, consent and every condition of the specific-request audio exception, including immediate deletion and online notice
Where this comes from
Provision: 16 CFR 312.2, 312.5(c)(9), 312.4(d)(4) - Assess child audio and the narrow request-response exception
Instrument: Children's Online Privacy Protection Act (COPPA)
Citation: 16 CFR 312.2 (personal information (8), (10)), 312.5(c)(9), 312.4(d)(4), 312.10; 90 FR 16918, effective 23 June 2025, general compliance date 22 April 2026
Text version: 16 CFR 312.2, 312.4, 312.5, eCFR displayed through 3 September 2026, retrieved 6 September 2026; 2025 final rule, 90 FR 16918
Checked against the source: 6 September 2026
Who it applies to
It applies when all of these are true:
- COPPA assessed activity Q_COPPA_COVERED_ACTIVITY: YES
- COPPA assessed activity Q_COPPA_CHILD_AUDIO: YES
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Assess actual collection of a file containing the child's voice, including streaming, separately from microphone permission and recognition-capable biometric voiceprints.
- For 312.5(c)(9), establish the child's specific request and audio-only collection with no other personal information, no other use and no disclosure.
- Delete the audio immediately after responding so it is not retrievable in the normal course of business; test buffers, queues, logs, caches and storage.
- Provide the 312.4(d)(4) online notice describing use and immediate deletion; absence of a direct-notice duty under this branch does not remove online notice.
- Assess spoken/requested personal information, linked identifiers, retained transcripts, training, personalization and actual recipient conduct; unresolved or failed conditions require a separate consent/legal-basis decision.
Evidence an auditor expects
- Assessment documentDocument review
Complete exception assessment and implemented boundary evidence
Source/version/activity-specific evidence: Assess actual collection of a file containing the child's voice, including streaming, separately from microphone permission and recognition-capable biometric voiceprints. For 312.5(c)(9), establish the child's specific request and audio-only collection with no other personal information, no other use and no disclosure. Delete the audio immediately after responding so it is not retrievable in the normal course of business; test buffers, queues, logs, caches and storage. Provide the 312.4(d)(4) online notice describing use and immediate deletion; absence of a direct-notice duty under this branch does not remove online notice. Assess spoken/requested personal information, linked identifiers, retained transcripts, training, personalization and actual recipient conduct; unresolved or failed conditions require a separate consent/legal-basis decision. Preserve minimized deletion/control evidence without raw audio or extra transcripts; consent does not justify unnecessary retention under 312.10. A DRAFT source, selected feature or generated task is not consent or an approved exception.
Questions people ask
- Does COPPA 16 CFR 312.2, 312.5(c)(9), 312.4(d)(4) - Assess child audio and the nar… apply to my service?
- It applies when COPPA assessed activity Q_COPPA_COVERED_ACTIVITY: YES; COPPA assessed activity Q_COPPA_CHILD_AUDIO: YES.
- From when does this apply?
- COPPA 16 CFR 312.2, 312.5(c)(9), 312.4(d)(4) - Assess child audio and the nar… applies from 22 April 2026. Its current status is: in force.
- What evidence does an auditor expect?
- Complete exception assessment and implemented boundary evidence.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.