COPPA reason codes

Each COPPA Audience assessment and COPPA Violation Risk rating comes with a reason code: a sentence that names the signals behind the result. You see reason codes in the Media Ratings Terminal, in Analytics compliance reports, and in the coppaAudienceReason and coppaViolationRiskReason fields of the Enrichment API. For field definitions, see the COPPA data dictionary.

COPPA Audience: mobile apps

In the reason text, <<App’s Store Content Rating>> is replaced with the app’s actual content rating in its store, for example “Everyone” or “4+”. For which ratings and categories apply, see the data dictionary.

Pixalate uses both app stores to assess an app, so a Google Play app’s reason code can cite its iOS version, and the reverse.

Likely directed to children

Likely general audience

COPPA Violation Risk: mobile apps

The risk rating combines the audience assessment with the app’s sensitive permissions, privacy policy, residential IP and location signals. The table lists every possible outcome and the signals its reason code names. A dash means the reason code doesn’t name that signal.

Reason codes, numbered to match the table:

1. The COPPA risk is low because the app is likely not directed to children under 13.
2. The COPPA risk is medium because the app is likely directed to children under 13, and it has sensitive permissions. The app has a privacy policy detected as required by the COPPA Rule.
3. The COPPA risk is medium because the app is likely directed to children under 13, but does not have sensitive permissions. The app has a privacy policy detected.
4. The COPPA risk is high because the app is likely directed to children under 13, it has sensitive permissions, and it passes residential IP data. The app has a privacy policy detected.
5. The COPPA risk is high because the app is likely directed to children under 13, it has sensitive permissions, and it passes location information. The app has a privacy policy detected.
6. The COPPA risk is high because the app is likely directed to children under 13, and it passes location information. The app has a privacy policy detected.
7. The COPPA risk is high because the app is likely directed to children under 13, and it passes residential IP data. The app has a privacy policy detected.
8. The COPPA risk is critical because the app is likely directed to children under 13, and it does not have a privacy policy detected as required by the COPPA rule.

An app assessed as likely general audience always gets a low risk rating.

COPPA Audience: CTV apps

CTV COPPA assessments cover apps in the Amazon Fire TV and Roku app stores.

COPPA Violation Risk: CTV apps

Reason codes, numbered to match the table:

1. The COPPA risk is low because the app is likely not directed to children under 13.
2. The COPPA risk is medium because the app is likely directed to children under 13, and it is not passing residential IP or location information. It has a privacy policy as required by the COPPA Rule.
3. The COPPA risk is high because the app is likely directed to children under 13, and it passes residential IP and location information. It has a privacy policy as required by the COPPA Rule.
4. The COPPA risk is high because the app is likely directed to children under 13, and it passes location information. It has a privacy policy as required by the COPPA Rule.
5. The COPPA risk is high because the app is likely directed to children under 13, and it passes residential IP. It has a privacy policy as required by the COPPA Rule.
6. The COPPA risk is critical because the app is likely directed to children under 13, and it does not have a privacy policy as required by the COPPA Rule.

Methodology

For the full methodology, see Pixalate’s COPPA methodology for mobile apps and COPPA methodology for CTV apps.

If you disagree with an app’s assessment, use Suggest Edit next to the COPPA Audience result on the app’s MRT Insights page, or contact support@pixalate.com.

Disclaimer

Pixalate’s COPPA Compliance Tools render opinions that Pixalate believes may be useful to our clients and others in the digital media industry. It is important to note, however, that the mere fact that an app appears to be directed to children (e.g., data subjects under 13 years of age, as defined by the COPPA Rule) does not mean that any such app, or its operator, is failing to comply with the COPPA Rule. Further, with respect to apps that appear to be child-directed and have characteristics that, in Pixalate’s opinion, may trigger related privacy obligations and/or risk, such assertions reflect Pixalate’s opinions (i.e., they are neither facts nor guarantees); and, although Pixalate’s methodologies used to render such opinions are derived from a combination of automated processing coupled with significant human intervention, no assurances can be – or are – given by Pixalate with respect to the accuracy of any such opinions.