COPPA FAQ

The Children’s Online Privacy Protection Act (COPPA) is a U.S. federal law passed by Congress in 1998 to protect children’s online privacy. COPPA requires the Federal Trade Commission (FTC) to issue and enforce a rule implementing the law. The FTC’s COPPA Rule took effect in 2000 and was amended in 2013.

In January 2025, the FTC announced final amendments to the COPPA Rule, which were published in the Federal Register on April 22, 2025. For the current text of the Rule and its compliance dates, see the FTC’s COPPA Rule page.

COPPA is enforced by the FTC and by state attorneys general, who can seek civil penalties from companies that violate the law.

The COPPA Rule defines a website or online service directed to children as a commercial website or online service, or portion of one, that is targeted to children.

Mixed audience online services are a subset of child-directed online services: an app intended for a mixed audience is also considered child-directed under COPPA. Pixalate’s data and reports therefore group both as “child-directed” or “directed to children”.

Not at this time. A mixed audience service counts as child-directed because children under 13 are part of its target audience. The COPPA Rule has some provisions specific to mixed audience services, such as using a neutral age gate and collecting information from users under 13 only after obtaining verifiable parental consent. Pixalate has no visibility into whether an app implements age gates or obtains parental consent.

Pixalate’s automated assessment doesn’t distinguish mixed audience apps from apps that are purely child-directed. The educators on Pixalate’s Trust and Safety Advisory Board can make that distinction when they review apps manually, but the MRT doesn’t currently show it.

Besides publishers whose content is directed to children, or who have actual knowledge that a child is using their service, any company that handles persistent identifiers from an online service it knows to be directed to children is subject to COPPA. This includes demand-side platforms (DSPs), supply-side platforms (SSPs), ad networks, data management platforms (DMPs), customer data platforms (CDPs), measurement providers and other ad technologies.

COPPA doesn’t prohibit advertising to children. The COPPA Rule prohibits collecting personal information, including cookies and other persistent identifiers, from children under 13 without verifiable parental consent. Contextual advertising that doesn’t track the user over time and across online services is permitted under COPPA.

No. COPPA is a U.S. law, but foreign online service operators must comply with it if their services are directed to children in the U.S. or if they have actual knowledge that they collect information from children in the U.S. U.S. operators that collect information from children in other countries are also subject to COPPA.

Pixalate’s COPPA tools for mobile and CTV apps include:

• COPPA Audience assessment: whether an app is likely child-directed (including mixed audience) or likely general audience, shown in the Media Ratings Terminal (MRT).
• COPPA Violation Risk rating: low, medium, high or critical. See COPPA reason codes.
• Analytics compliance reports for monitoring COPPA risk in your traffic.
• MRT Discovery for building targeting or exclusion lists with COPPA data together with other Pixalate data such as IVT rate, viewability, brand safety, risk advisories, app-ads.txt and app category.
• Keyword search of app content to find apps likely intended for children, and of app privacy policies to make manual policy review faster.
• COPPA Audience and COPPA Violation Risk data feeds for automated pre-bid workflows.
• COPPA fields in the Enrichment API for automated workflows.

Pixalate assesses COPPA Audience and COPPA Violation Risk for mobile apps in the Google Play Store and Apple App Store, and for CTV apps in the Roku and Amazon Fire TV app stores. See the CTV fields and CTV reason codes.

For COPPA coverage of websites, contact your Pixalate account manager.

Anyone can view an app’s COPPA Audience assessment in the Media Ratings Terminal. Other COPPA data depends on your Pixalate subscription; contact your Pixalate account manager. To learn more about the tools, see pixalate.com/coppa-compliance-tools.

Pixalate’s automated assessment uses app store signals such as store category, content rating and child-related keywords in the app name or description. Apps can also be reviewed manually. The methodology was developed by a team of COPPA experts, data scientists and ad tech industry experts. See COPPA reason codes, the COPPA data dictionary, and Pixalate’s COPPA methodology for mobile apps and for CTV apps.

Pixalate analyzes multiple signals and produces a risk rating of low, medium, high or critical that captures the potential COPPA violation risk. The reason codes page lists every outcome and the signals behind it.

No. An app assessed as likely general audience always gets a low COPPA Violation Risk rating, because an app that likely doesn’t target children as any part of its audience is low risk from a COPPA perspective.

Pixalate doesn’t designate likely general audience streaming TV or channel aggregator apps, such as YouTube, Sling TV and Hulu, as likely child-directed, although some channels within those apps may be child-directed. For example, the FTC’s complaint against YouTube doesn’t characterize YouTube as child-directed; it states that YouTube hosts numerous channels that are “directed to children” under the COPPA Rule.

Pixalate’s methodology doesn’t assess individual channels within an app. If you serve ads in these apps, work with the apps so they flag child-directed channels or content appropriately.

Some of them. An app in the Games category is labeled likely child-directed if it has an applicable content rating (Everyone or Everyone 10+ on Google Play; 4+ or 9+ on the App Store) and its title or description contains child-related keywords.

When educators on Pixalate’s Trust and Safety Advisory Board review such apps, they apply the subjective factors in the COPPA Rule, such as subject matter, visual content, language, and use of animated characters or child-oriented activities and incentives. Some versions of games like solitaire are child-directed under these factors.

Pixalate uses both app stores to assess an app’s likely audience, because each store provides different information. If an app is assessed as likely child-directed in the Apple App Store only, Pixalate also designates it as likely child-directed in Google Play, and the Google Play reason code shows the iOS signals that led to the assessment. The same applies in reverse.

Pixalate’s Trust and Safety Advisory Board, led by a former FTC enforcer and made up of qualified educators, reviews apps to assess whether they are likely child-directed.

Review is ongoing. Pixalate prioritizes apps by popularity, measured by the number of downloads in Google Play and the number of reviews in the Apple App Store.

Yes. If a manual review finds that an app in either store is likely directed to children, Pixalate marks the app as likely child-directed in both stores.

Reviewers assess an app’s likely target audience using the child-directed factors in the COPPA Rule: subject matter; visual content; use of animated characters or child-oriented activities and incentives; language or other characteristics of the website or online service; and evidence regarding audience composition. Any of these factors can come into play.

For manually reviewed apps, the reason code says that the app is likely general audience or likely child-directed “based on manual review”. Pixalate doesn’t list the specific factors the reviewer relied on.

Pixalate measures agreement between its automated and manual assessments on statistically significant samples, and the rate varies between samples. For example, when manual review targets categories that over-index for false positives or false negatives, the two assessments diverge more. Manual assessments are fed back into Pixalate’s machine learning models to improve future automated assessments.

Pixalate updates the COPPA Violation Risk rating and the COPPA Audience assessment weekly. Some inputs to the audience assessment, such as content rating, category and app description, are refreshed monthly.

Weekly. New COPPA Violation Risk and COPPA Audience files are available every Monday at 8:00 a.m. Pacific Time. See COPPA pre-bid data feeds.

Yes. Pixalate monitors the underlying data continuously, so an app’s COPPA Violation Risk rating can move between low, medium, high and critical, and its COPPA Audience assessment can change between likely child-directed and likely general audience. A manual review by Pixalate’s Trust and Safety Advisory Board can also change an app’s audience assessment. The MRT Change Log shows an app’s recent change history.

Pixalate assesses mobile apps for COPPA Audience and COPPA Violation Risk, and analyzes new apps as they are listed in the Apple App Store or Google Play Store. CTV apps in the Roku and Amazon Fire TV stores are also assessed; see COPPA reason codes.

There are two parts. First, make sure child-directed apps are correctly identified in your systems, both when you onboard inventory and during ad transactions. Second, make sure the traffic flowing through your systems follows COPPA requirements and is privacy-safe.

The IAB Tech Lab’s OpenRTB specification carries a COPPA signal in the regs.coppa field. Confirm that regs.coppa=1 is set for every child-directed app, even if it wasn’t set upstream. Recommendations for OpenRTB exchanges and bidders:

• Let sites and apps be declared as child-directed.
• Implement the regulations (regs) object.
• Let campaigns adapt their targeting based on this signal.
• Make geographic information less precise before logging or transmitting it.
• Suppress the assignment and synchronization of identifiers, depending on usage.

When regs.coppa=1, the exchange should also change the bid request as follows:

For the current requirements, see the OpenRTB version you implement.

Not necessarily. Pixalate’s assessment helps you assess risk, but it isn’t a legal conclusion. The app’s publisher is best placed to know whether the app is child-directed. If the publisher signals that the app, or part of it, is child-directed, that is the most reliable indicator. The same applies if you notice yourself that an app appears child-directed.

If you find that an app Pixalate rates likely general audience is child-directed, tell us with Suggest Edit (see below).

On the app’s MRT Insights page, select Suggest Edit next to the COPPA Audience result. Pixalate reviews your request and replies with its assessment as soon as possible. You can also contact support@pixalate.com.